MIME-Version: 1.0
References: 
 <176424596157.2804165.6883880087469641385@dt-datatracker-5bd94c585b-wk4l4>
In-Reply-To: 
 <176424596157.2804165.6883880087469641385@dt-datatracker-5bd94c585b-wk4l4>
From: Tim Wicinski <tjw.ietf@gmail.com>
Date: Thu, 4 Dec 2025 12:04:27 -0500
Message-ID: 
 <CADyWQ+HwhVNmfbwCfAdCS+pJMr6ip16mtThRke9TYaJxTYPY5w@mail.gmail.com>
To: Peter Thomassen <peter@desec.io>
Content-Type: multipart/alternative; boundary="00000000000004c88f06452353ea"
Message-ID-Hash: NOLOSDIK275SMDGWW3ILP7YIULYIMYX3
CC: dnsop-chairs@ietf.org, dnsop@ietf.org,
 draft-yorgos-dnsop-dry-run-dnssec@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BDNSOP=5D_Re=3A_Call_for_adoption=3A_draft-yorgos-dnsop-dry-run-?=
 =?utf-8?q?dnssec-04_=28Ends_2025-12-11=29?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/dnsop/EBUS4HMRa0HTF58KHvOpDE1wgW0>

--00000000000004c88f06452353ea
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi

I've reviewed the draft and feel this is something relevant for DNSOP to be
adopt.
I will sign up to assist with reviews, etc.

tim



On Thu, Nov 27, 2025 at 7:19=E2=80=AFAM Peter Thomassen via Datatracker <
noreply@ietf.org> wrote:

>
> Subject: Call for adoption: draft-yorgos-dnsop-dry-run-dnssec-04  (Ends
> 2025-12-11)
>
> This message starts a 2-week Call for Adoption for this document.
>
> Abstract:
>    This document describes a method called "dry-run DNSSEC" that allows
>    for testing DNSSEC deployments without affecting the DNS service in
>    case of DNSSEC errors.  It accomplishes that by introducing new DS
>    Type Digest Algorithms that when used in every record of a DS RRset,
>    referred to as dry-run DS, signal to validating resolvers that dry-
>    run DNSSEC is used for the zone.  DNSSEC errors are then reported
>    with DNS Error Reporting, but any bogus responses to clients are
>    withheld.  Instead, validating resolvers fallback from dry-run DNSSEC
>    and provide the response that would have been answered without the
>    presence of the dry-run DS.  A further EDNS option is presented for
>    clients to opt-in for dry-run DNSSEC errors and allow for end-to-end
>    DNSSEC testing.
>
> File can be retrieved from:
> https://datatracker.ietf.org/doc/draft-yorgos-dnsop-dry-run-dnssec/
>
> Please reply to this message keeping dnsop@ietf.org in copy by indicating
> whether you support or not the adoption of this draft as a WG document.
> Comments to motivate your preference are highly appreciated.
>
> Authors, and WG participants in general, are reminded of the Intellectual
> Property Rights (IPR) disclosure obligations described in BCP 79 [2].
> Appropriate IPR disclosures required for full conformance with the
> provisions
> of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any.
> Sanctions available for application to violators of IETF IPR Policy can b=
e
> found at [3].
>
> Thank you.
> [1] https://datatracker.ietf.org/doc/bcp78/
> [2] https://datatracker.ietf.org/doc/bcp79/
> [3] https://datatracker.ietf.org/doc/rfc6701/
>
>
>
> _______________________________________________
> DNSOP mailing list -- dnsop@ietf.org
> To unsubscribe send an email to dnsop-leave@ietf.org
>

--00000000000004c88f06452353ea
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:monospac=
e">Hi</div><div class=3D"gmail_default" style=3D"font-family:monospace"><br=
></div><div class=3D"gmail_default" style=3D"font-family:monospace">I&#39;v=
e reviewed the draft and feel this is something relevant for DNSOP to be ad=
opt.=C2=A0</div><div class=3D"gmail_default" style=3D"font-family:monospace=
">I will sign up to assist with reviews,=C2=A0etc.</div><div class=3D"gmail=
_default" style=3D"font-family:monospace"><br></div><div class=3D"gmail_def=
ault" style=3D"font-family:monospace">tim</div><div class=3D"gmail_default"=
 style=3D"font-family:monospace"><br></div><div class=3D"gmail_default" sty=
le=3D"font-family:monospace"><br></div></div><br><div class=3D"gmail_quote =
gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Nov 27=
, 2025 at 7:19=E2=80=AFAM Peter Thomassen via Datatracker &lt;<a href=3D"ma=
ilto:noreply@ietf.org">noreply@ietf.org</a>&gt; wrote:<br></div><blockquote=
 class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px so=
lid rgb(204,204,204);padding-left:1ex"><br>
Subject: Call for adoption: draft-yorgos-dnsop-dry-run-dnssec-04=C2=A0 (End=
s<br>
2025-12-11)<br>
<br>
This message starts a 2-week Call for Adoption for this document.<br>
<br>
Abstract:<br>
=C2=A0 =C2=A0This document describes a method called &quot;dry-run DNSSEC&q=
uot; that allows<br>
=C2=A0 =C2=A0for testing DNSSEC deployments without affecting the DNS servi=
ce in<br>
=C2=A0 =C2=A0case of DNSSEC errors.=C2=A0 It accomplishes that by introduci=
ng new DS<br>
=C2=A0 =C2=A0Type Digest Algorithms that when used in every record of a DS =
RRset,<br>
=C2=A0 =C2=A0referred to as dry-run DS, signal to validating resolvers that=
 dry-<br>
=C2=A0 =C2=A0run DNSSEC is used for the zone.=C2=A0 DNSSEC errors are then =
reported<br>
=C2=A0 =C2=A0with DNS Error Reporting, but any bogus responses to clients a=
re<br>
=C2=A0 =C2=A0withheld.=C2=A0 Instead, validating resolvers fallback from dr=
y-run DNSSEC<br>
=C2=A0 =C2=A0and provide the response that would have been answered without=
 the<br>
=C2=A0 =C2=A0presence of the dry-run DS.=C2=A0 A further EDNS option is pre=
sented for<br>
=C2=A0 =C2=A0clients to opt-in for dry-run DNSSEC errors and allow for end-=
to-end<br>
=C2=A0 =C2=A0DNSSEC testing.<br>
<br>
File can be retrieved from:<br>
<a href=3D"https://datatracker.ietf.org/doc/draft-yorgos-dnsop-dry-run-dnss=
ec/" rel=3D"noreferrer" target=3D"_blank">https://datatracker.ietf.org/doc/=
draft-yorgos-dnsop-dry-run-dnssec/</a><br>
<br>
Please reply to this message keeping <a href=3D"mailto:dnsop@ietf.org" targ=
et=3D"_blank">dnsop@ietf.org</a> in copy by indicating<br>
whether you support or not the adoption of this draft as a WG document.<br>
Comments to motivate your preference are highly appreciated.<br>
<br>
Authors, and WG participants in general, are reminded of the Intellectual<b=
r>
Property Rights (IPR) disclosure obligations described in BCP 79 [2].<br>
Appropriate IPR disclosures required for full conformance with the provisio=
ns<br>
of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any.<br>
Sanctions available for application to violators of IETF IPR Policy can be<=
br>
found at [3].<br>
<br>
Thank you.<br>
[1] <a href=3D"https://datatracker.ietf.org/doc/bcp78/" rel=3D"noreferrer" =
target=3D"_blank">https://datatracker.ietf.org/doc/bcp78/</a><br>
[2] <a href=3D"https://datatracker.ietf.org/doc/bcp79/" rel=3D"noreferrer" =
target=3D"_blank">https://datatracker.ietf.org/doc/bcp79/</a><br>
[3] <a href=3D"https://datatracker.ietf.org/doc/rfc6701/" rel=3D"noreferrer=
" target=3D"_blank">https://datatracker.ietf.org/doc/rfc6701/</a><br>
<br>
<br>
<br>
_______________________________________________<br>
DNSOP mailing list -- <a href=3D"mailto:dnsop@ietf.org" target=3D"_blank">d=
nsop@ietf.org</a><br>
To unsubscribe send an email to <a href=3D"mailto:dnsop-leave@ietf.org" tar=
get=3D"_blank">dnsop-leave@ietf.org</a><br>
</blockquote></div>

--00000000000004c88f06452353ea--