[DNSOP] DS placement

Paul Vixie <paul@redbarn.org> Tue, 28 March 2017 18:00 UTC

Message-ID: <58DAA4BC.2050005@redbarn.org>
Date: Tue, 28 Mar 2017 11:00:28 -0700
From: Paul Vixie <paul@redbarn.org>
User-Agent: Postbox 5.0.12 (Windows/20170323)
MIME-Version: 1.0
To: "dnsop@ietf.org" <dnsop@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/arjoVK7nX8ffsjumNnGvKgZmgvU>
Subject: [DNSOP] DS placement
Precedence: list

Paul Vixie wrote:
> i got underscores wrong in SRV. it may be that we should not follow that
> track at all.
> 
> ...

this reminds me of the following related topic.

had SRV done underscores correctly, then the placement of DS would have
been more obvious. right now it's at the delegation point, which was
seen as the only way to make it part of the delegating zone. it's not.

if the vix.su DS could have been placed at vix._dnssec.su, where _dnssec
was an in-zone (non-delegated) label, then the middlebox RDNS servers
who do not know (and will never know) to forward DS queries to the
delegater not the delegated, would not be slowing dnssec deployment.

some of you heard me talk about this as "the cousins solution" years ago.

-- 
P Vixie

[DNSOP] DS placement Paul Vixie