Re: [DNSOP] I-D Action: draft-huston-kskroll-sentinel-04.txt

Joe Abley <jabley@hopcount.ca> Wed, 15 November 2017 01:45 UTC

Return-Path: <jabley@hopcount.ca>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 57B2612945D for <dnsop@ietfa.amsl.com>; Tue, 14 Nov 2017 17:45:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.698
X-Spam-Level:
X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NqEiChs-yAf3 for <dnsop@ietfa.amsl.com>; Tue, 14 Nov 2017 17:45:51 -0800 (PST)
Received: from mail-lf0-x22f.google.com (mail-lf0-x22f.google.com [IPv6:2a00:1450:4010:c07::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8505129418 for <dnsop@ietf.org>; Tue, 14 Nov 2017 17:45:50 -0800 (PST)
Received: by mail-lf0-x22f.google.com with SMTP id k66so12387814lfg.3 for <dnsop@ietf.org>; Tue, 14 Nov 2017 17:45:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:mime-version:references:in-reply-to:date:message-id:subject:to :cc; bh=k6+TNR0GpJJ+RXVj6alCzAWBFLJy9oq+/2NOC0a5c60=; b=Mtw6t/+fZF31hYjDkiUAtqc5lAJ1AfrqTpKYmvhgrMHQaRTo+Br2jQetQ3RJQM+vjl gtGiaCYVf8Wl4cD5AiL9uIzYQ01jChd1WwNFAAhX2zEpNtsMhdL9c7MdTBt3IY7UESWY gtmLtdlZUy58AZ67s0o6tt2BHamkXG8W3I0Vc=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:references:in-reply-to:date :message-id:subject:to:cc; bh=k6+TNR0GpJJ+RXVj6alCzAWBFLJy9oq+/2NOC0a5c60=; b=sU2mhA5N7UD4WydegoLgZ81EKVyvLz8kSqqms6nvYMkR4C8NdzIfiD5UDrFaPLGe7b EmihzLcdSODFRFQxakigIOTMMBdD9sLxY6/LjoZ0QERl8qynakywKuigJL9HbTjPk0xa Mu7au2e/Y+IAqefvEc2XvOBP7yGlDyEZy/CoxcZwnWUfabGm1ra0Mmc6+o4qRztK2GqG RAS/s4NXDNiMirR9cFFd9o+xU/GjJigw+WpXJm3K0aAoTfMZ+9hAxAmI4O+jNWedtrfP M4gslnyi2SrQlntEi9gOqrOgVJhrgL5HOzZI0nXhlLDHPw1XEJBq3lXScrvLZeiK8RzI ciOQ==
X-Gm-Message-State: AJaThX4AuVkhqeBf0xEUl8uIiEQxkdlHaZlm26RXS+vE20P260nL4hNc jBm+dBlJB2YfuPrMlZ2UpSVVCQzLNBk3NhuGmeEr3w==
X-Google-Smtp-Source: AGs4zMYlJAhKGwd+9mvYF1Nc0oK/PeXLMj/WV7AZoEtF/IYK2EFZrUnOy9FhltrYjxDl7V/Zwbx9kAuXatlRMkd/HPw=
X-Received: by 10.25.22.24 with SMTP id m24mr3684761lfi.185.1510710349131; Tue, 14 Nov 2017 17:45:49 -0800 (PST)
From: Joe Abley <jabley@hopcount.ca>
Mime-Version: 1.0 (1.0)
References: <151062636258.5917.14497839377888768972@ietfa.amsl.com> <CA+nkc8CQPe6eT6QGWmO30Cn1ik5oaGUxS_GQg0BproCPSu-U6Q@mail.gmail.com>
In-Reply-To: <CA+nkc8CQPe6eT6QGWmO30Cn1ik5oaGUxS_GQg0BproCPSu-U6Q@mail.gmail.com>
Date: Wed, 15 Nov 2017 09:45:47 +0800
Message-ID: <7572271693475788861@unknownmsgid>
To: Bob Harold <rharolde@umich.edu>
Cc: "internet-drafts@ietf.org" <internet-drafts@ietf.org>, IETF DNSOP WG <dnsop@ietf.org>
Content-Type: multipart/alternative; boundary="001a11407b5eb80449055dfba928"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/lh74KDWJVVXv65hjG0HaQAFShLY>
Subject: Re: [DNSOP] I-D Action: draft-huston-kskroll-sentinel-04.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Nov 2017 01:45:52 -0000

Hi Bob,

On Nov 15, 2017, at 00:23, Bob Harold <rharolde@umich.edu> wrote:

If I have to add those entries to each zone, I worry that the automated DNS
appliance that I use might not be able to create the broken records
required.

Since the implementation of the mechanism requires special handling of
queries whose QNAMEs contain the special labels, I don't see why you would
ever need to add anything to any zone.

The point of this mechanism is to require no administrator action and to be
on by default, I think.


Joe