Re: [DNSOP] DNS versioning, was The DNSOP WG has placed draft-woodworth-bulk-rr in state "Candidate for WG Adoption"

[Matthew Pounsett <[e-mail]>]

On 22 July 2017 at 17:40, Woodworth, John R <[e-mail]>
wrote:

> > From: DNSOP [mailto:[e-mail]] On Behalf Of Matthew
> Pounsett
>
> >
>
> > > On 20 July 2017 at 17:53, John R Levine <[e-mail]> wrote:
>
> > > That's why I don't share the fears about BULK: you cannot easily
>
> > > deploy a new feature that will require a change in the resolvers,
>
> > > because you don't know all the resolvers, and cannot change them even
>
> > > if you know they are too old. But your secondaries are only a small
>
> > > set of carefully chosen servers, and you have your say.
>
> >
>
> > I hear otherwise from people who run big DNS farms.  It's common to
>
> > use multiple secondary providers, and it's hard to tell who's running
>
> > what server software.  I also note that it took about a decade before
>
> > people felt comfortable using DNAMEs.
>
> >
>
>
>
> Hi Matthew,
>
>
>
> Thanks for your comments.
>
>
>
> I hear and understand your concerns.  We have similar concerns but
>
> *I* feel we could offer a phased-in approach to set everyone's
>
> expectations appropriately.  If one chooses to step ahead of the phase
>
> at least they'd have an idea what troubles await them.
>

Something's wrong with your email client.  Your quoted text above was not
me.


>
>
> >
>
> > Dear $VENDOR.
>
> >
>
> > I'm a customer who is considering deploying the BULK RR type into my
>
> > zone, and I would like to know whether your systems support it.
>
> >
>
> > Thank you,
>
> > $CUSTOMER.
>
> >
>
> >
>
> > That said.. there is still an issue with key distribution for online
>
> > signing which is required to make this work.   I see the utility in
>
> > BULK, but I'm persuaded that there needs to be more work before it's
>
> > deployable in an environment where *XFR is required.
>
> >
>
>
>
> Online signing in this environment will not be possible until this
>
> is solved but I believe the phased in approach would give us the time
>
> to solve for it without delaying insecure deployment (phase1).
>
>
> What's your mechanism for enforcing (or even signalling) this phased
approach in the DNS?