IETF Logo Mail Archive

Re: [DNSOP] Questions on draft-ietf-dnsop-delegation-only

Patrick Mevzek <mevzek@uniregistry.com> Tue, 11 August 2020 19:37 UTC

Return-Path: <mevzek@uniregistry.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EBB433A0B2A for <dnsop@ietfa.amsl.com>; Tue, 11 Aug 2020 12:37:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.048
X-Spam-Level:
X-Spam-Status: No, score=-3.048 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.949, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=uniregistry.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id idHUVf0OTr6P for <dnsop@ietfa.amsl.com>; Tue, 11 Aug 2020 12:37:07 -0700 (PDT)
Received: from a-mx.uniregistry.com (a-mx.uniregistry.com [64.96.177.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB5F33A0ACF for <dnsop@ietf.org>; Tue, 11 Aug 2020 12:37:07 -0700 (PDT)
Abuse: Forward to abuse@uniregistry.com with full headers
X-Virus-Scanned: Content filter at a-mx.uniregistry.com
Powered-By: https://www.uniregistry.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniregistry.com; s=bravo; t=1597174627; bh=CtR3PMM7drEoxzDn6PuqrUBdnP26cYKgaUP8RDGzIGI=; h=Subject:From:To:References:Date:In-Reply-To; b=p4eG7Q2VIpQRz9XwtdDkl0Fza2j3SBfcJdLXldZ1SvMkmhp+17rQItLWGsUPmgweC hBWNMIypa2ZPXqeJxzuUggpj7STIK9epCD98iSRVXkE5c1NyI0dHeUQE+pNKaxSUtP 65vv5T352Gqcvz5IyyqFxjnHkZvsrjRIOg3ch93V2pN3AFnT/yl0OV/B473otLFlrf Aa/QMQxj4wUmDnvRL9CvMkz7xEA955oMYDjwy8swmKnV3OyWEmxiV181S7SVQ/fKbf stQMFV3IUah/mk8B+JSxMc5cre8fdfqbMKDKaWW8VXDohoEJqgPjlFg7E77PIZeT+M aBB80fcpvabrA==
Received: from [10.8.204.86] (b01.uniregistrar.net [52.204.70.64]) (authenticated bits=0) by a-mx.uniregistry.com (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 07BJb4gJ048471 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Tue, 11 Aug 2020 19:37:06 GMT
From: Patrick Mevzek <mevzek@uniregistry.com>
To: dnsop@ietf.org
References: <CAHbrMsDWR0Yf_66f7g6sYm5Wk5vg9avGnLLT2sqezHzJzK4qJw@mail.gmail.com> <05f9f7ce-1bb7-b195-1be5-4db4c13b3145@nic.cz> <alpine.LRH.2.23.451.2007301253530.416340@bofh.nohats.ca> <F16107A1-669C-41AD-9F59-1794C64B0737@hopcount.ca> <alpine.LRH.2.23.451.2007301446380.418549@bofh.nohats.ca> <31548781-6B30-4198-810F-32245590C7D6@hopcount.ca> <CAH1iCiouWAjSQnmkH5tVXQThyRUX3SSGOi1qOUhFw__AUG75nA@mail.gmail.com> <c22935a2-397a-754c-8da5-bc30aab18e7d@uniregistry.com>
Organization: Uniregistry
Message-ID: <0f4cefe2-51bc-980b-e472-d6356b484749@uniregistry.com>
Date: Tue, 11 Aug 2020 14:37:04 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.11.0
MIME-Version: 1.0
In-Reply-To: <c22935a2-397a-754c-8da5-bc30aab18e7d@uniregistry.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/kujatNSW_nQ9lQzNA6V_n-HnxgM>
Subject: Re: [DNSOP] Questions on draft-ietf-dnsop-delegation-only
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 11 Aug 2020 19:37:09 -0000

On 30/07/2020 16:55, Patrick Mevzek wrote:
> - have the registry let the domain be deleted and then have domainB be 
> broken (which it is already in a way since the delegations to those 
> nameservers can be explicitly made broken; but the difference is between 
> registrar A breaking registrar B stuff, or the registry breaking 
> registrar B stuff).
You may have seen Afilias announcement yesterday about glue records
(as a consequence of the discussion here maybe?), with a public version 
at 
http://www.circleid.com/posts/20200811-afilias-to-protect-tlds-against-potential-orphan-glue-exploits/

It boils down to the above, that is removal of current glue records even 
if that breaks other domains using them currently.
Registrars have only a few day to mitigate this.

-- 
Patrick Mevzek

v2.8.7 | Report a Bug | By Email