[DNSOP] Re: Disclosure of Negative Trust Anchors in DNS Responses (draft-farrokhi-dnsop-ede-nta-00)

[Petr Špaček <[e-mail]>]

On 13. 07. 26 16:20, Petr Špaček wrote:
> On 17. 06. 26 12:47, Joe Abley wrote:
>> Babak, Sebastiaan and I put pen to paper and came up with the following:
>>
>> https://datatracker.ietf.org/doc/draft-farrokhi-dnsop-ede-nta/
>>
>> https://github.com/farrokhi/id-ede-nta (working copy)
> 
> Good idea!
> 
> In section 2:
>> This EDE is intended for use in DNS responses sent by a DNS resolver 
>> with a configured NTA and SHOULD NOT be included in other responses. 
>> For example, a DNS response sent by an authoritative-only DNS server, 
>> which does not perform validation and hence has no obvious use for an 
>> NTA, SHOULD NOT include this EDE.
> 
> Why not MUST NOT?
> 
> I think an occurrence of SHOULD NOT should (see what I did there) have 
> an explanation under what conditions it can be violated, and I can't 
> think of any.
> 
> 
> Personally I think machine parseable EXTRA-TEXT would be a good idea. 
> Something like
> {"d": "example.com", "e": "2026-07-30T00:00:00Z"}
> or so.
> 

Urgh, I hit Send button too soon.


Ad >  5. Security Considerations

> Clients that require integrity protection of these signals should use an authenticated and encrypted transport between client and resolver, such as DNS over TLS [RFC7858] or DNS over HTTPS [RFC8484]. See Section 6 of [RFC8914] for more discussion.

Could we drop the encryption part? TSIG or SIG(0) is a fine integrity 
protection, too. No need to encrypt when it's not needed.

-- 
Petr Špaček