Re: [DNSOP] Delegation acceptance checks

Peter Thomassen <> Mon, 08 May 2023 10:31 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A12FCC1519A2; Mon, 8 May 2023 03:31:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id GioccjkYXctj; Mon, 8 May 2023 03:31:49 -0700 (PDT)
Received: from ( [IPv6:2a01:4f8:10a:1d5c:8000::8]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by (Postfix) with ESMTPS id AB5EDC1519A0; Mon, 8 May 2023 03:31:49 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;; s=20170825; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:Subject:From :References:Cc:To:MIME-Version:Date:Message-ID:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=cQmf0Cr1CBasYW220i6Kmp0ctsWsdyMkLg0mDJiJpQ4=; b=K9/IX8vyVkBLV52PfBLw2o4bh+ AE16hQQTuamHTUfGN0N0LRqnoC5vVXMXCdnTkelw26qB4nA4D4syAHYEu3shdHITD//I3VpFP7i/s JhYsBbavxuPei5nGQ9BfIU7Y/DFtYuH8Vv8wQl+pdRsR6QmyAGT/6lI64JU+ui6d+OtfRXJlUxqk6 27aBV20/GWcPPQwOMpNZhBqoaOy6UjUnv15CQ1ys+wUFsDSMbZWwb0QIHrwWzPoDna1/yFjkAmrSQ Dkp2pRsCDTul99MEk3djOIW9h8RkYJ1ycdXhUmRgHQX8jjWHNcfM8BNbAUIupcU/nO1OnUdA6RvSe xth7/dOg==;
Received: from ([] helo=[]) by with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from <>) id 1pvy9h-005ZM3-Tc; Mon, 08 May 2023 12:31:46 +0200
Message-ID: <>
Date: Mon, 08 May 2023 12:31:45 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.10.0
Content-Language: en-US
To: Havard Eidnes <>,
References: <> <> <> <>
From: Peter Thomassen <>
In-Reply-To: <>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Archived-At: <>
Subject: Re: [DNSOP] Delegation acceptance checks
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 08 May 2023 10:31:55 -0000

Hi Håvard,

On 5/7/23 01:10, Havard Eidnes wrote:
> I guess it depends on what service the registry is actually
> offering.
> One way to look at it is that it's offering a service to extend the
> public DNS name space to registrants.  In that scenario it makes
> perfect sense to do a one-time check on initial registration or
> update, with the intention of preventing the domain owner from
> shooting himself in the foot.

How do you know it's a shot in the foot?

It's possible a registrant doesn't want to provide DNS service and just reserve the name. Or, as Joe said, it could be a name served only in some "internal" context. If not used publicly, that doesn't seem "unhealthy".

For *registration* checks, there was no DNS service so far, so nothing breaks if none is configured.

(The situation may be different if a delegation update breaks the delegation, which might warrant a warning.)

> On the technical side, I don't think anyone has suggested to
> introduce repeated checks with de-registration either of a single NS
> or an entire domain on auto-polit.  Does any public registry
> actually do that sort of thing?  I've never heard of it.  I call
> that a straw man.

If you have a .is domain and you don't follow the requirements in [1] (including conditions on NS reachability and consistency, child-size NS RRset content and TTL, SOA MNAME/RNAME/timers), the operator will receive the following message:

	The setup of zone <name>.is on its nameservers appears not to be
	according to ISNIC's requirements for .IS delegations.

	Please see requirements [1] for information on these conditions.

	Please make sure that the setup of domain <name>.is is according to
	the above conditions. The domain can be tested [2]

	ISNIC will put on hold domains not fulfilling the delegation
	requirements for extended periods. See article 21 in the .is
	delegation rules. See our rules [3]

	ISNIC will automatically park the domain if it is still non-compliant
	after being on hold due to technical non-compliance for 30 days.