Re: [DNSOP] Questions on draft-ietf-dnsop-delegation-only

[Paul Wouters <[e-mail]>]

On Thu, 30 Jul 2020, Petr Špaček wrote:

> I'm going to generalize Ben's questions:
>
> It is hard to see what benefits draft-ietf-dnsop-delegation-only brings without having description of "DNSSEC Trasparency" mechanism available.
>
> Please describe intended usage of the proposed mechanism, at the moment it is hard to see all the details and interactions.

I think the draft clearly explains that without delegation-only, a
parent can just present any record of the child zone from within
its parent zone, as if there was no delegation. Even if there is
one. That is, it can still serve DS records, but also service
TLSA records past its zone cut. So if a resolver asks the .ca
nameservers for _443._tcp.nohats.ca IN TLSA, the .ca nameservers
could serve it while still also serving DS records for nohats.ca.

With this flag set, it can no longer do this and it must switch its
mechanism for overriding the child by modifing the DS for this child.

I think a concept of DNSSEC transparency where a DNS validator plugin
logs all different DS RRsets (and NSECs) from delegation-only zones and
uploads these once a day to a dnssec transparency monitor is a fairly
basic concept that I think this draft does not need to further expand.

Paul