Re: [DNSOP] Verifying TLD operator authorisation

[Matthew Pounsett <[e-mail]>]

On Sat, 15 Jun 2019 at 19:36, Nick Johnson <nick=
[e-mail]> wrote:

>  On Sat, Jun 15, 2019 at 2:21 AM Stephane Bortzmeyer <[e-mail]>
> wrote:
>
>> On Fri, Jun 14, 2019 at 02:38:11PM +1200,
>>  Nick Johnson <nick=[e-mail]> wrote
>>  a message of 173 lines which said:
>>
>> > Indeed - it's my understanding that ICANN forbids publishing anything to
>> > the root zone other than necessary records such as SOA, NS and DNSKEY.
>>
>> You mean the TLD zone?
>
>
> Sorry, yes I did.
>
>
The set of allowed RRTYPEs in a gTLD zone can (and does) change, given a
reasonable justification, and enough interest and pressure from the
registries.  For example, the last revision of the Registry Services
contract that ICANN put out[0] added a record for zone versioning
independent of the SOA record.

You can get a new RRTYPE reserved for your purposes quite easily[1].  With
that, you could run a trial with some early-adopting ccTLDs (not
constrained by ICANN's Registry Services contract) to demonstrate the
utility of your scheme.  If it's attractive enough to warrant the internal
process and development costs to deploy, and the ICANN lobbying efforts,
then the gTLD operators could have it added to the contract.

Whatever your deployment method, you will need to demonstrate some benefit
to the registries if you want them to adopt your scheme.  Making changes to
their process isn't cheap, and there is no such thing as a one-off cost;
everything added to their operation needs to be maintained and monitored,
which incurs an ongoing cost.

[0]: Exhibit A, §1.1 <
https://newgtlds.icann.org/sites/default/files/agreements/agreement-approved-31jul17-en.pdf
>
[1]: <https://tools.ietf.org/html/rfc6895#section-3.1.1>