Re: [DNSOP] Obsoleting DLV

[Samuel Weiler <[e-mail]>]

On Tue, 2 Jul 2019, Matthijs Mekking wrote:

> Here's a draft with discussion why also the protocol should go
> away. We would like to hear what you think about it.

The discussion of the private network use case in section 2 has two 
minor errors plus one bit that is unclear.

When we designed DLV, we certainly considered a private network use 
case.  RFC5074 does not strictly have public trust anchors take 
precedence over ("mask") DLV records [1].

I suggest replacing the text in section 2 starting with "One other..." 
with:

    One other possible reason to keep DLV is to distribute trust anchors
    for private enterprises.  The authors are not aware of any such use
    of DLV.

That does not include the argument in the below bullet, which I find 
unclear.  What does "name redirection" mean in this context?

    o  Since the zones are related to private networks, it would make
       more sense to make the internal network more secure to avoid name
       redirection, rather than complicate the DNS protocol.

-- Sam


[1] Specifically, 5074 says to use public trust anchors first.  If 
they give a validation result other than "Secure", then do DLV 
processing.  I'm not 100% sure of how BIND's logic works here.