Content-Type: multipart/alternative;
 boundary=Apple-Mail-487BBCCF-D749-4E51-93E2-271535812AD0
Content-Transfer-Encoding: 7bit
From: Joe Abley <jabley@strandkip.nl>
Mime-Version: 1.0 (1.0)
Message-Id: <0198BFEA-EF0B-48D7-BC44-8563DA68CE62@strandkip.nl>
Date: Sat, 20 Jul 2024 17:15:47 -0700
To: yorgos@nlnetlabs.nl
Message-ID-Hash: OAWXVJKVXFZOSUSICD7EXTKPA7YBP5GD
CC: dnsop <dnsop@ietf.org>
Precedence: list
Subject: =?utf-8?q?=5BDNSOP=5D_Does_DNSSEC_need_a_dry_run=3F?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/dnsop/6bKd1e2af5A4ufoDWfBsKzHV_kg>


--Apple-Mail-487BBCCF-D749-4E51-93E2-271535812AD0
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: quoted-printable

Hi Yorgos,

I've lost the original new version announcement to reply to so apologies for=
 the thread crime, but I have a more fundamental question about this draft.=20=


You say:

DNSSEC was introduced to provide DNS with data origin authentication and dat=
a integrity. This brought quite an amount of complexity and fragility to the=
 DNS which in turn still hinders general adoption. When an operator decides t=
o publish a newly signed zone there is no way to realistically check that DN=
S resolution will not break for the zone.

I think I understand the spirit of what you are saying but I am a little unc=
onvinced about the demand for this kind of testing.

Even after you have tested with a dry run mechanism, you need to make materi=
al changes to your zone to progress to actually signing in a way that you ex=
pect people to validate, and you can only get useful test results from valid=
ators that have implemented the test mechanism. So the thing you tested is n=
ot actually the same thing as what you deploy, and the test coverage might w=
ell ve limited. =20
This doesn't make it feel like a great test.=20

Isn't signing a test zone with exactly the processes, protocols and software=
 that will be used in real life and validating it with real deployed validat=
ing resolvers actually a better test?

Who is this mechanism for?


Joe=

--Apple-Mail-487BBCCF-D749-4E51-93E2-271535812AD0
Content-Type: text/html;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3D=
utf-8"></head><body dir=3D"auto"><div dir=3D"ltr"><meta http-equiv=3D"conten=
t-type" content=3D"text/html; charset=3Dutf-8"><div dir=3D"ltr"><meta http-e=
quiv=3D"content-type" content=3D"text/html; charset=3Dutf-8"><div dir=3D"ltr=
"><meta http-equiv=3D"content-type" content=3D"text/html; charset=3Dutf-8">H=
i Yorgos,<div dir=3D"ltr"></div></div><div dir=3D"ltr"><br></div><div dir=3D=
"ltr">I've lost the original new version announcement to reply to so apologi=
es for the thread crime, but I have a more fundamental question about this d=
raft.&nbsp;</div><div dir=3D"ltr"><br></div><div dir=3D"ltr">You say:</div><=
div dir=3D"ltr"><br></div><div dir=3D"ltr"><p id=3D"section-1-1" style=3D"bo=
x-sizing: border-box; margin-top: var(--line); margin-bottom: var(--line); m=
argin-right: 0px; margin-left: 3ch; overflow-wrap: break-word; caret-color: r=
gb(33, 37, 41); color: rgb(33, 37, 41); font-family: &quot;Noto Sans Mono&qu=
ot;, SFMono-Regular, Menlo, Monaco, Consolas, &quot;Liberation Mono&quot;, &=
quot;Courier New&quot;, monospace; font-size: 8.646px; -webkit-tap-highlight=
-color: rgba(0, 0, 0, 0); -webkit-text-size-adjust: 100%;">DNSSEC was introd=
uced to provide DNS with data origin authentication and data integrity. This=
 brought quite an amount of complexity and fragility to the DNS which in tur=
n still hinders general adoption. When an operator decides to publish a newl=
y signed zone there is no way to realistically check that DNS resolution wil=
l not break for the zone.</p></div><div dir=3D"ltr"><br></div><div dir=3D"lt=
r">I think I understand the spirit of what you are saying but I am a little u=
nconvinced about the demand for this kind of testing.</div><div dir=3D"ltr">=
<br></div><div dir=3D"ltr">Even after you have tested with a dry run mechani=
sm, you need to make material changes to your zone to progress to actually s=
igning in a way that you expect people to validate, and you can only get use=
ful test results from validators that have implemented the test mechanism. S=
o the thing you tested is not actually the same thing as what you deploy, an=
d the test coverage might well ve limited. &nbsp;</div><div dir=3D"ltr">This=
 doesn't make it feel like a great test.&nbsp;</div><div dir=3D"ltr"><br></d=
iv><div dir=3D"ltr">Isn't signing a test zone with exactly the processes, pr=
otocols and software that will be used in real life and validating it with r=
eal deployed validating resolvers actually a better test?</div><div dir=3D"l=
tr"><br></div><div dir=3D"ltr">Who is this mechanism for?</div><div dir=3D"l=
tr"><br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">Joe</div></div></d=
iv></body></html>=

--Apple-Mail-487BBCCF-D749-4E51-93E2-271535812AD0--