Re: [DNSOP] draft-ietf-dnsop-rfc6598-rfc6303-01

Dick Franks <rwfranks@acm.org> Thu, 14 August 2014 13:12 UTC

Return-Path: <rwfranks@gmail.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A57F1A0A92 for <dnsop@ietfa.amsl.com>; Thu, 14 Aug 2014 06:12:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.277
X-Spam-Level:
X-Spam-Status: No, score=-1.277 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yp5OxAe7wsqv for <dnsop@ietfa.amsl.com>; Thu, 14 Aug 2014 06:12:21 -0700 (PDT)
Received: from mail-yh0-x22e.google.com (mail-yh0-x22e.google.com [IPv6:2607:f8b0:4002:c01::22e]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98FBF1A06EA for <dnsop@ietf.org>; Thu, 14 Aug 2014 06:12:19 -0700 (PDT)
Received: by mail-yh0-f46.google.com with SMTP id a41so976289yho.19 for <dnsop@ietf.org>; Thu, 14 Aug 2014 06:12:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=2O57DrJXK/fwuL2Jb0uEDCa8/8gi+I99F21h+iELfN8=; b=lstwBbJQHmd7atp8CZT2UZB7E7oZ1WO9wWjbUD8L6VGj4dc+KlulDgG7+MajkNivmS ehc8X7vbvC68I/hc6Fk5D+3M62ae25eQ2sm7/pD11MrWnxwhI7A50FR+IfMqM7kQe1q6 fQB+ofUqNFwlaaw0bHTxrnNTITU9fUFzb6IuThc4aWE3sn1LiO7diA0kr31CAb3REc5Q FOCME8TquZDOKZbEAnVcwrROUtYe/6D3vWRG8KzKAztyILceVu/o8w4Z1gkQ0njyCvIL cV7KSy9yBB1zq8rfwQB3otLDRU3lmhwk2gwzX/Z+OFMzMlONeeclaJ3Rr5HbYLwHDhuv UxlQ==
X-Received: by 10.236.2.164 with SMTP id 24mr17524456yhf.126.1408021938677; Thu, 14 Aug 2014 06:12:18 -0700 (PDT)
MIME-Version: 1.0
Sender: rwfranks@gmail.com
Received: by 10.170.48.197 with HTTP; Thu, 14 Aug 2014 06:11:38 -0700 (PDT)
In-Reply-To: <20140814001610.3124D1CC688D@rock.dv.isc.org>
References: <20140814001610.3124D1CC688D@rock.dv.isc.org>
From: Dick Franks <rwfranks@acm.org>
Date: Thu, 14 Aug 2014 14:11:38 +0100
X-Google-Sender-Auth: UrQNq5McLedURuLYO4YtM5Rk4Sg
Message-ID: <CAKW6Ri4_Vb8_Be_q4nNY2pXNf20L=5B89ZQwCbh5+cbS0CEoHQ@mail.gmail.com>
To: Mark Andrews <marka@isc.org>
Content-Type: multipart/alternative; boundary="089e011823aa7daeb2050096a766"
Archived-At: http://mailarchive.ietf.org/arch/msg/dnsop/NeK4ogkustsjO4UErOpGTL2hSf8
Cc: dnsop@ietf.org
Subject: Re: [DNSOP] draft-ietf-dnsop-rfc6598-rfc6303-01
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Aug 2014 13:12:22 -0000

Mark,

Surely, something stronger than a reminder is appropriate.

For a mission-critical requirement, this needs to be an explicit and
unambiguous request:

    "This document directs IANA to create insecure delegations
     for the listed zones."


Dick
________________________



On 14 August 2014 01:16, Mark Andrews <marka@isc.org> wrote:

>
>         Can we please move on this.
>
>         The reverse address are not yet insecurely delegated as
>         would be required for RFC 6598 compliance.  This is starting
>         to cause operational problems for ISP's that validate DNS
>         responses as they can't deploy local IN-ADDR.ARPA zones
>         until that insecure delegation is done.
>
>         Also should I add a reminder to the IANA Considerations that
>         the insecure delegation needs to be performed?
>
>         e.g.
>
>         "IANA is reminded that a insecure delegation for these zones
>         is required for compliance with RFC 6598 to break the DNSSEC
>         chain of trust."
>
>         Mark
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE:  +61 2 9871 4742                         INTERNET: marka@isc.org
>
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop
>