Re: [DNSOP] Working Group Last Call for draft-ietf-dnsop-negative-trust-anchors

[神明達哉 <[e-mail]>]

At Sat, 9 May 2015 18:50:28 +0000,
Evan Hunt <[e-mail]> wrote:

> Actually, weirdly enough, after I implemented NTA's in BIND, one of the
> very first applications somebody came up with for them was to temporarily
> disable DNSSEC validation by setting an NTA for ".".  This was seen as
> better than "rndc validation off" because he didn't have to send "rndc
> validation on" afterward; it would just quiety switch itself back on
> after a minute.  It's... actually a pretty clever hack, and I don't
> really want to disable it.
>
> May I suggest: "An NTA placed at a node where there is a configured
> positive trust anchor takes precendence over that trust anchor, effectively
> disabling it.  Implementations MAY issue a warning when this occurs."

Does this mean:

A: All implementations that conform to this document should prefer the
   NTA over the positive anchor in such a case, or
B: This is implementation-dependent, but if an implementation allows
   the coexistence of positive and negative anchors, it should prefer
   the NTA, or
C: something else?

I don't have a strong opinion between A and B, but I'd like this
document to be clear on this.  And, if it means A, I'd use an RFC2119
keyword (it's probably a SHOULD).

--
JINMEI, Tatuya