[DNSOP] Re: [Ext] Re: what problem are we trying to solve, was Call for Adoption: draft-davies-internal-tld

[Benno Overeinder <[e-mail]>]

Hi all,

Joining in on the ongoing conversation.

In the email thread, we have seen a number of messages from DNS 
implementers and operators arguing that insecure delegation is required 
for the proper operation of validating stub resolvers.  See also RFCs 
6303, 8375 and 9665, which mention insecure delegation. The new draft by 
Joe Abley et al. discusses this issue in general terms with regard to 
private namespaces.

The chairs have asked the IETF liaison to the ICANN Board of Directors 
to also discuss this issue with the ICANN technical community.  We hope 
to report back to the DNSOP Working Group during the Madrid meeting.  We 
would like to ask the WG not to repeat the same arguments until there is 
news.

Thanks,

-- Benno
for the WG chairs and secretaries


On 17/06/2025 23:08, John R Levine wrote:
> On Wed, 18 Jun 2025, Mark Andrews wrote:
>> And if the stubs are validating then the answer for 10.in-addr.arpa DS 
>> is a provable NOERROR NODATA response that says there is a delegation 
>> at that point in the tree.  That validator does NOT need to be 
>> configured to say ‘DO NOT VALIDATE THIS NAMESPACE’.
> 
> We're going in circles here.
> 
> IF you have a validating stub resolver AND it gets all of its data from 
> the local cache AND even so it doesn't believe the cache's AD flag AND 
> you have some locally served zones AND none of those zones are a TLD you 
> picked yourself before .INTERNAL was reserved AND even though you're 
> sophisticated enough to do stub resolution you don't configure local 
> trust anchors THEN yes, the opt-outs are helpful.
> 
> On the other hand, if you think that's a rather narrow scenario and most 
> systems aren't quite like that, not so much.
> 
> Like I said, I don't see us coming to agreement any time soon.
> 
> Regards,
> John Levine, [e-mail], Taughannock Networks, Trumansburg NY
> Please consider the environment before reading this e-mail. https://jl.ly
> 
> _______________________________________________
> DNSOP mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

-- 
Benno J. Overeinder
NLnet Labs
https://www.nlnetlabs.nl/