Re: [DNSOP] Delegation into the interior of a zone?

Grant Taylor <> Fri, 28 December 2018 23:02 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id ECCEF12426E for <>; Fri, 28 Dec 2018 15:02:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id X2sZbeoC-0Fy for <>; Fri, 28 Dec 2018 15:02:04 -0800 (PST)
Received: from ( [IPv6:2600:3c00:e000:1e9::8849]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 2E514130ED4 for <>; Fri, 28 Dec 2018 15:02:04 -0800 (PST)
Received: from Contact-TNet-Consulting-Abuse-for-assistance by (8.15.2/8.15.2/Debian-3) with ESMTPSA id wBSN21jw015351 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for <>; Fri, 28 Dec 2018 17:02:03 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;; s=2015; t=1546038123; bh=3nS3xooC+5/AIpkNF0vMFxUCCcKyocSR5UYt8jL6EkQ=; h=Subject:To:References:From:Message-ID:Date:User-Agent: MIME-Version:In-Reply-To:Content-Type:Cc:Content-Disposition: Content-Language:Content-Transfer-Encoding:Content-Type:Date:From: In-Reply-To:Message-ID:MIME-Version:References:Reply-To: Resent-Date:Resent-From:Resent-To:Resent-Cc:Sender:Subject:To: User-Agent; b=QUhQ+N+cve1WtvudUSKhs3lMYZIq56lWpcqqrcY0fTQWIiUSZEQoDRrUfEzPSNm7t gtKnpNOXlCC7hniIZiGqVpZF5TucT8WsQbMk/mehbxlC+6MZHAkSV+N2c6984BvBxI P4cNYogV84jbet4rsSxfYz38eui805Gp/M44lGxQ=
References: <20181228222732.6BEC3200C09338@ary.qy>
From: Grant Taylor <>
Organization: TNet Consulting
Message-ID: <>
Date: Fri, 28 Dec 2018 16:02:03 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <20181228222732.6BEC3200C09338@ary.qy>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="------------ms090805000803080009060701"
Archived-At: <>
Subject: Re: [DNSOP] Delegation into the interior of a zone?
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 28 Dec 2018 23:02:06 -0000

On 12/28/18 3:27 PM, John Levine wrote:
> I'd think it depends whether invalid delegations bother them, like if, 
> say, might not be running BIND.

You seem to be conflating the two independent issues at hand:

1)  Use of RFC 2317's CNAME technique vs the NS technique I'm advocating 
(be it to the interior or apex of the zone).

2)  Use of $GENERATE vs manually creating individual records.

#1 is what records to use.  #2 is how to create said records.  Between 
them there are four possible combinations.

  · Use CNAMEs with manual record creation.
  · Use CNAMEs with $GENERATE.
  · Use NS records with manual record creation.
  · Use NS records with $GENERATE.

Grant. . . .
unix || die