Re: [DNSOP] Fwd: New Version Notification for draft-thomassen-dnsop-dnssec-bootstrapping-02.txt

Peter Thomassen <> Tue, 30 November 2021 00:31 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id E32AC3A0BC5; Mon, 29 Nov 2021 16:31:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.551
X-Spam-Status: No, score=-3.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, NICE_REPLY_A=-1.852, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=fail (2048-bit key) reason="fail (body has been altered)"
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id KnNu7q2NNjIe; Mon, 29 Nov 2021 16:31:20 -0800 (PST)
Received: from ( [IPv6:2a01:4f8:10a:1d5c:8000::8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 2EAD63A0BC9; Mon, 29 Nov 2021 16:31:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;; s=20170825; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:MIME-Version :Date:Message-ID:Subject:From:References:Cc:To:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=sGKmwu/Wl5JDpwLGitXUYAmb5+v9xMOLnf8Yub6I2CQ=; b=jvEvwL16X3bRlRRKLFM7YwvfFz MnZqycYoXnrNnv0n4POIM+pTcmQQKnBYluFC8AmXkPMcMzunR5CrVNm/Cpzi0iXJ3ekOVj8T3GS/Y 55YRik/fszSFJKkZ7dmM24uegzWYEe6BEVHnLPr1YsByFr1ou8gJAx7B6XhgFH6T8oM+ENbZ7efj5 BnnuAiOoxZuwSp8YzuN4yL0gZTOavyz7fm7ZvGNIpZwJKsuDAPQqcbfEuZyTwAB3eELBRMCdpEi3F bM19GWzw02uCDr5KOn4GC+Lue8Zc+zZoxQIBzXplYese7ai+sWG6ZeQrMcTY9mgSoWfa3+TnwPyZx yZjjB1sQ==;
Received: from ([] helo=[]) by with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from <>) id 1mrr3F-00078t-4t; Tue, 30 Nov 2021 01:31:17 +0100
To: Paul Wouters <>
Cc: " WG" <>,
References: <> <> <>
From: Peter Thomassen <>
Message-ID: <>
Date: Tue, 30 Nov 2021 01:31:16 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: de-DE
Content-Transfer-Encoding: 8bit
Archived-At: <>
Subject: Re: [DNSOP] Fwd: New Version Notification for draft-thomassen-dnsop-dnssec-bootstrapping-02.txt
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 30 Nov 2021 00:31:25 -0000

On 11/5/21 1:07 AM, Paul Wouters wrote:
> In general, the problem is that we need to make it easier for the DNS
> hoster to enable DNSSEC when their customers are non-technical. I think
> this draft does properly extend RFC 8078 and even think this document
> could deprecate the "Accept after wait" method.

I took a shot at that in -03.

> However, I do think it
> should still impose a minimum length of publication before accepting,
> so that mistakes similar to the recent outage can be
> prevented. So change "accept after wait" to "verify, then accept after
> wait".

Sure. The draft currently says in Section 3.2:
| If the above steps succeed without error, the CDS/CDNSKEY records are
| successfully validated, and the Parental Agent can proceed with the
| publication of the DS record set under the precautions described in
| [RFC8078], Section 5.

... and there, it says:
| A parent SHOULD [...] ensure
| that the zone validates correctly if the parent publishes the DS
| record.  A parent zone might also consider sending an email to its
| contact addresses to give the child zone a warning that security will
| be enabled after a certain amount of wait time -- thus allowing a
| child administrator to cancel the request.

I think that from a technical perspective, that covers the policy you're proposing.

Or did you really mean to *impose* a minimum delay, as in: it is forbidden to deploy more quickly?

Another approach would be to re-state explicitly what's in RFC 8078 Section 5 (but I don't know if text duplication between RFCs is welcome?).