Re: [DNSOP] Asking TLD's to perform checks.

[Viktor Dukhovni <[e-mail]>]

On Wed, Nov 11, 2015 at 07:53:25AM +0100, Patrik Fältström wrote:

> > It may not be possible for everyone to agree on a comprehensive
> > set of 'wrongs' with no omissions, but it should be possible to
> > get consensus on a core set of 'wrongs' that are not controversial.
> 
> Yes and no. I think going for a minimum will be a good goal, but for
> example to have lame delegations must by definition be allowed, as some
> registration policies do require delegation (i.e. NS records). So people
> add NS records in parent zone, but nothing responds there. Until policy
> allows registration without delegation, you will see lame delegations.

My quick and dirty list is likely not "the list".  Mark correctly
points out starting with protocol (rather than content) issues is
a good idea.  Since lame delegations are content, they might be
out of scope.  I think that broken denial of existence is also a
protocol (software quality) issue, rather than zone data content.

This is not to say that no content issues can be in scope, but
likely those would need closer scrutiny.

For example, having DS RRs with no corresponding DNSKEY RRs invites
serious trouble, and does not seem to have a plausible reason (like
lame delegations).  But I'm presently setting any specifics in stone.

Just saying that progressing Mark's draft looks like a good idea
to me.

-- 
	Viktor.