Re: [DNSOP] nsec3-parameters opinions gathered

[Viktor Dukhovni <[e-mail]>]

> On 29 Nov 2021, at 7:55 am, Michael Bauland <[e-mail]> wrote:
> 
>> The iteration count distribution for the TLDs is presently:
>>  # TLDs NSEC3 iterations
>>  ------ ----------------
>>     147 0
>>     458 1
>>       1 2
>>      14 3
>>     112 5
>>       4 8
>>     545 10
>>      29 12
>>       1 13
>>       1 15
>>       1 17
>>       6 20
>>       2 25
>> The outliers above 10 are:
>>     ccTLDs: bn de dk pl sg ua xn--clchc0ea0b2g2a9gcd xn--yfro4i67o
>>     gTLDs: alstom barcelona bauhaus bcn cat erni eurovision eus firmdale gal gdn
>>            gmx ifm lacaixa madrid man mango nrw quebec radio ruhr sap scot seat
>>            sport swiss whoswho xn--55qw42g xn--80asehdb xn--80aswg xn--mgbab2bd
>>            xn--zfr164b
> 
> We see your argument and have now adjusted our configurations accordingly. All TLDs run by CORE Association and Knipp (i.e., almost all from the gTLDs list above) have now reduced their NSEC3 iteration count to 0.

Nice!  Thanks.  Indeed I see now only 12 TLDs with more than 10 iterations:

  ccTLDs: bn de dk pl sg ua xn--clchc0ea0b2g2a9gcd xn--yfro4i67o
  gTLDs:  firmdale gdn xn--55qw42g xn--zfr164b

The new distribution is:

    175 0
    396 1
      1 2
     14 3
    113 5
      3 8
    607 10
      1 12
      1 13
      1 15
      1 17
      6 20
      2 25

Which seems to also suggest that 62 TLDs got moved from 1 to 10. :-(
Perhaps a change of platform...  Having whoever manages the 607 to
switch to 0 would be a good next milestone...

-- 
	Viktor.