IETF Logo Mail Archive

Re: [DNSOP] I-D Action: draft-ietf-dnsop-compact-denial-of-existence-03.txt

Peter Thomassen <peter@desec.io> Thu, 14 March 2024 09:45 UTC

Return-Path: <peter@desec.io>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E32FC14F749 for <dnsop@ietfa.amsl.com>; Thu, 14 Mar 2024 02:45:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.906
X-Spam-Level:
X-Spam-Status: No, score=-6.906 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=a4a.de
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OWzcoGBS35IS for <dnsop@ietfa.amsl.com>; Thu, 14 Mar 2024 02:45:30 -0700 (PDT)
Received: from mail.a4a.de (mail.a4a.de [IPv6:2a01:4f8:10a:1d5c:8000::8]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A09E9C14F748 for <dnsop@ietf.org>; Thu, 14 Mar 2024 02:45:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=a4a.de; s=20170825; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:Cc:From: References:To:Subject:MIME-Version:Date:Message-ID:Sender:Reply-To:Content-ID :Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To: Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe :List-Post:List-Owner:List-Archive; bh=c4iK5+9Q8tHiKEy9PuSWm4pC7s3zvh38LcflMMs53U8=; b=HNwz898ATN904PBE7PSfORYvgp BnU5fKHkK/bzMmrAXkUTLUevf86ceyEq2QmK6COHF1Eeefe5lYEJrj/x/niZcu6T3xuEGwa3Fjaoo 4VTneIjWGEEZy071V7M46N2yRUYrOTNcQz4knO9cYATN7NyjfpWwKIOFDyXwJssRYpscUmciHlncd u7Fzu3KCbbotWguF5PJ6xlG2sFqDiYXIGYuWCHyxHaBBZ0IgXW8BicYIOex3bRxQ6ANuaUqHolVal QrU64T9tqsOYFTZmDmk4dEAHlI+6iVffwWjfsWqfwVzfP8QbVSD4Gz2H90tMPuwke54MdsbfyMZ+V 41s+T7Og==;
Received: from 60-242-4-2.static.tpgi.com.au ([60.242.4.2] helo=[192.168.30.173]) by mail.a4a.de with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from <peter@desec.io>) id 1rkheQ-003AFo-8t; Thu, 14 Mar 2024 10:45:26 +0100
Message-ID: <70db7a29-a1fc-4287-a904-ad5e4f1d60a3@desec.io>
Date: Thu, 14 Mar 2024 19:45:23 +1000
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: dnsop@ietf.org
References: <170959055561.39905.2007482768877029325@ietfa.amsl.com>
From: Peter Thomassen <peter@desec.io>
In-Reply-To: <170959055561.39905.2007482768877029325@ietfa.amsl.com>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/K37a_rqsbXlRvGbvBIjud8n8TOU>
Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-compact-denial-of-existence-03.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Mar 2024 09:45:35 -0000

Hi Shumon et al.,

On 3/5/24 08:15, internet-drafts@ietf.org wrote:
> Internet-Draft draft-ietf-dnsop-compact-denial-of-existence-03.txt is now
> available. It is a work item of the Domain Name System Operations (DNSOP) WG
> of the IETF.

I added a PR with some suggestions here: https://github.com/shuque/id-dnssec-compact-lies/pull/3

The PR just has the suggestions, with no rationale. If anything's contentious or the rationale less obvious than I thought: apologies; happy to provide it!

Also, two questions:

Section 2:

	An alternative way to distinguish NXDOMAIN from ENT is to define the synthetic Resource Record type for ENTs [...] This typically imposes less work on the server since NXDOMAIN responses are a lot more common than ENTs.

Not sure in what regard this is "less" work -- an NSEC record has to be signed in any case?


Section 4.1

	This section describes an optional but recommended scheme

How do "optional" and "recommended" relate to the corresponding uppercase keywords (which don't apply at the same time)?


Best,
Peter

-- 
https://desec.io/

v2.23.0 | Report a Bug | By Email