[DNSOP] Re: [dd] Root DS/DELEG query

Philip Homburg <pch-dd@u-1.phicoh.com> Tue, 22 July 2025 16:27 UTC

Message-Id: <m1ueFph-0000O0C@stereo.hq.phicoh.net>
To: dd@ietf.org
From: Philip Homburg <pch-dd@u-1.phicoh.com>
Sender: pch-b6CAFA0C7@u-1.phicoh.com
In-reply-to: Your message of "Tue, 22 Jul 2025 18:11:13 +0200 ." <caa2df39-2483-464f-9802-24d66555866f@isc.org>
Date: Tue, 22 Jul 2025 18:27:12 +0200
Message-ID-Hash: MQIXVLR4KJ6HXNSNLXLUGLZP522AANYV
CC: dnsop@ietf.org
Precedence: list
Subject: [DNSOP] Re: [dd] Root DS/DELEG query
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/BxkTDXfxgkq9JEVgZrZYLKJznfc>

> I wonder how to interpret '. DS'/'. DELEG' queries and welcome
> opinions!
> 
> Secondly it's unclear if RFC 4035 4.3. Determining Security Status
> of Data somehow should applies to DS responses from root. I guess
> it should, but how?

My conclusion when implementing a validator was that for the purpose of
validating the a '. DS' query, the parent of the root is the root.

Basically the algorithm that finds the parent of a zone terminates in the root.
Then the NSEC at . proves that no DS record exists at the root.

[DNSOP] Root DS/DELEG query Petr Špaček
[DNSOP] Re: [dd] Root DS/DELEG query Mark Andrews
[DNSOP] Re: [dd] Root DS/DELEG query Wessels, Duane
[DNSOP] Re: [dd] Root DS/DELEG query Philip Homburg
[DNSOP] Re: [dd] Root DS/DELEG query Petr Špaček
[DNSOP] Re: [dd] Root DS/DELEG query Mark Andrews
[DNSOP] Re: [Ext] [dd] Re: Root DS/DELEG query Paul Hoffman
[DNSOP] Re: [dd] Re: [Ext] Re: Root DS/DELEG query Philip Homburg
[DNSOP] Re: [dd] Re: [Ext] Re: Root DS/DELEG query Petr Špaček
[DNSOP] Re: [dd] [Ext] Re: Root DS/DELEG query Mark Andrews