Re: [DNSOP] fragile dnssec, was Fwd: New Version

[Matthew Pounsett <[e-mail]>]

On 16 August 2017 at 19:09, John Levine <[e-mail]> wrote:

> In article <[e-mail]> you write:
> >> A colleague says "If TLDs allowed UPDATE messages to be processed most
> >> of the issues with DNSSEC would go away. At the moment we have a whole
> >> series of kludges because people are scared of signed update messages."
>
> Someone is wildly overoptimistic.
>
> The problem I run into over and over again is that I run someone's DNS
> and other services, but I am not the registrant and I am not the
> registrar, I just run the DNS.  Either I have to walk the registrant
> through the process of installing DNSSEC keys, or she has to give me
> her registrar account password, neither of which scales.  Slightly
> more automatic processing of updates for which I do not have the
> credentials will not help.
>
>
Have a look at:
<
https://datatracker.ietf.org/doc/draft-ietf-regext-dnsoperator-to-rrr-protocol/
>

It allows a registrar (or a registry in some ccTLD environments) to do
CDS/CDNSKEY without having to constantly scan their registrants' name
servers, and provides some advice on how to safely bootstrap DNSSEC using
CDS/CDNSKEY.

There's currently a registrar implementation at Gandi, enabled for the TLDs
for which they do DNSSEC (I believe it's beta, so you have to speak to
their support to find the API URI), and registry implementations at CIRA
(.ca) and APNIC (for their reverse zones).  The CZ.NIC folks have also
started building it into Fred, their open source registry software.

There are a few more changes the draft will go through before it's ready
for last call, but the API it describes should remain largely unchanged
from this point onward.