Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
From: Mark Andrews <marka@isc.org>
In-Reply-To: <20171211231643.GA73777@KIDA-6861.local>
Date: Tue, 12 Dec 2017 10:46:27 +1100
Cc: Joe Abley <jabley@hopcount.ca>, Paul Vixie <paul@redbarn.org>,
 dnsop@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <A496F606-ACC2-4DFD-A792-ADD570A9E137@isc.org>
References: <20171211090051.qjoruin7nkdjsnvd@nic.fr>
 <5A2E4B7C.50509@redbarn.org> <20171211091800.wonjnvhl3xrx6r4s@nic.fr>
 <118C37A8-0DEF-460B-8A79-AAE470D3CED8@hopcount.ca>
 <73B3C074-6B88-4BCC-8F0C-26D09066CD0A@isc.org>
 <20171211231643.GA73777@KIDA-6861.local>
To: Kim Davies <kim.davies@iana.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/AG-RR3ca2s6muQbQ1fwKdi0q394>
Subject: Re: [DNSOP] [Ext]  DNS privacy and AS 112: the case of home.arpa
Precedence: list

Firstly they are HOME.ARPA servers.  Just because they are the same =
physical servers it doesn=E2=80=99t mean that policy for the root zone =
content has to apply to other zones on that server.  Maintaining that =
distinction is important. =20

Secondly a otherwise empty zone on these servers will fulfil the =
requirements to provide a insecure delegation.  Just drop the DNAME from =
the zone contents below.  All the servers involved can serve SOA and NS =
records and return NXDOMAIN for names under HOME.ARPA.

If you need to delegate to a different set of servers create a seperate =
constellation of servers that you control directly or by contract.  =
Trying to re-use AS112 servers will never work reliably as you don=E2=80=99=
t have agreements with *all* the operators.  This also applies to the =
operators of EMPTY.AS112.ARPA.

As for DNAME, that is a requirement of DNSSEC which, in theory, all the =
root servers support fully.

Mark

> On 12 Dec 2017, at 10:16 am, Kim Davies <kim.davies@iana.org> wrote:
>=20
> Hi Mark,
>=20
> Quoting Mark Andrews on Tuesday December 12, 2017:
>>=20
>> HOME.ARPA. SOA	A.ROOT-SERVERS.NET. NSTLD.VERISIGN-GRS.COM. =
2017121101 1800 900 604800 86400
>> HOME.ARPA.	NS	A.ROOT-SERVERS.NET.
> ..
>> HOME.ARPA.  DNAME EMPTY.AS112.ARPA.
>=20
> It is unclear to me how this avoids having root servers process DNAME
> records. Given the process of consultation, coordination and testing
> support for DNAME records in the root servers (or relocating the .arpa
> authorities) is likely to take longer than is desirable to have =
home.arpa
> insecurely delegated, the delegation to AS112 was considered as the =
best
> short-term approach even if it is not without its own difficulties.
>=20
> kim

--=20
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka@isc.org