[DNSOP] Re: [Ext] Re: Call for Adoption: draft-davies-internal-tld

John Levine <johnl@taugh.com> Wed, 23 April 2025 22:06 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id B243A2049234 for <dnsop@mail2.ietf.org>; Wed, 23 Apr 2025 15:06:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.4
X-Spam-Level:
X-Spam-Status: No, score=-4.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=iecc.com header.b="GB72rv30"; dkim=pass (2048-bit key) header.d=taugh.com header.b="DUM9swEK"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fAFCFe_iRRLZ for <dnsop@mail2.ietf.org>; Wed, 23 Apr 2025 15:06:25 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 00578204921F for <dnsop@ietf.org>; Wed, 23 Apr 2025 15:06:24 -0700 (PDT)
Received: (qmail 20710 invoked from network); 23 Apr 2025 22:06:24 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:content-transfer-encoding:cleverness; s=50e268096460.k2504; t=1745445974; x=1745791574; bh=KlPR8Zb5s8zQ0HZfQkB0ZHCIXvGj2cSQUYZyV4onx/Q=; b=GB72rv30SUR4boxNsHpT9GR4o5nIGU0g5ZwT9m9mB93gBg4DKQ1D6lpG5X8zw/hp6+YDhgshNDne+LRV2dUBMSiu7UEpjRcvWZdRH+ilzxbaHt33gpGVADRQA+xa7B6BbzcxQDTD+3vQuuRLy5wf2MB+zbn3I2vCYcuJOykQIfO4fDcCO6S8mzmhvXwb17CzbXQFCPFhSbmfWIGVA+7eYJCkU2iQrWs4r9bVwIeMk1m0JOdVdt5RL4emLMuc+oxJXjBvZ+fBFbOncR2G+ZpkbBQ8mS6CkdZ5qNhTvipioD7VSGvk652/zWGeIDvjVyeVRkCmJQkOOwKC/L5aJcOxaw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:content-transfer-encoding:cleverness; s=50e268096460.k2504; bh=KlPR8Zb5s8zQ0HZfQkB0ZHCIXvGj2cSQUYZyV4onx/Q=; b=DUM9swEKhmdW8u0qQOAevV9lBVNOkFiKeaigJ0Aqp8zlKoEKPQtCk1P/M8pTLk5Nd9cZwjhgl2SfH9ONXy0+xKMoj2TyIFZAkEOTB8VVH385lQkJ3JINSxJYwUHVCsOa2pwSnWWjQNsZT0uMMngMLMlKw+hY418p1pHn7AqNoFCD6wAMPCJymBam9JVoaVXyXdaUCmGQvLU12TGtsiYcwFFLQalH0NrHz5TXQAkP6zfwxt8RxshRCZeN+YqQymJa8BS0vPJ0nEDFjvos3OHjABjL9EG0CQG9IeswDqVRLaT548hXafcPLR+fbMcKggfhkFiJoF206Zpr7e8rCQvP7w==
Received: from ary.qy ([IPv6:2001:470:1f07:1126:0:78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126:0:78:696d:6170]) with ESMTPS (TLS1.3 ECDHE-RSA CHACHA20-POLY1305 AEAD) via TCP6; 23 Apr 2025 22:06:24 -0000
Received: by ary.qy (Postfix, from userid 501) id 81B22C6078DB; Wed, 23 Apr 2025 18:06:22 -0400 (EDT)
Date: Wed, 23 Apr 2025 18:06:22 -0400
Message-Id: <20250423220623.81B22C6078DB@ary.qy>
From: John Levine <johnl@taugh.com>
To: dnsop@ietf.org
In-Reply-To: <39E139A3-A903-4D1E-BB5D-31368EF5C8B9@icann.org>
Organization: Taughannock Networks
References: <m1u5h1G-0000LcC@stereo.hq.phicoh.net> <83666fd3-a51f-46e1-a5ac-0b9a46361480@desec.io> <49E3B1B6-E960-4A46-9C5D-2721FD57132D@depht.com> <3b5fb9e7-8a2b-420f-a2fb-dd6f6a0b88ae@isc.org> <89047B78-A2B1-43F2-A996-94DF1E90538A@depht.com> <cc84f69c-c349-4d91-b942-80221b564a9b@isc.org> <ac48e27d-479f-42f3-b87f-891220ef2fe8@app.fastmail.com> <BE721880-6254-48F4-9F91-567A99E0511B@icann.org> <m1u7asT-0000MtC@stereo.hq.phicoh.net> <BB8275F1-538D-46B0-BFFA-F561A583EBFF@rfc1035.com> <39E139A3-A903-4D1E-BB5D-31368EF5C8B9@icann.org>
X-Headerized: yes
Cleverness: minimal
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 8bit
Message-ID-Hash: YUZ6SZQDCB6QCVKVTXGOQ2PZUQNLQWBL
X-Message-ID-Hash: YUZ6SZQDCB6QCVKVTXGOQ2PZUQNLQWBL
X-MailFrom: johnl@iecc.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: paul.hoffman@icann.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: [Ext] Re: Call for Adoption: draft-davies-internal-tld
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/sIf1O7p15JQ7bCjltvL-nfL7b6c>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

It appears that Paul Hoffman  <paul.hoffman@icann.org> said:
>On Apr 23, 2025, at 09:07, Jim Reid <jim@rfc1035.com> wrote:
>> ICANN already has its own list/registry of TLD strings it will never delegate: .home, .corp, .mail, etc.
>
>I'm 99% sure that there is no policy statement about "will never delegate" for .home, .corp, and .mail, but I could be wrong. I'm interested in any references to something
>official here that says "never", for many reasons.

There are 43 two letter "user assigned" ISO 3166 codes that will never be
assigned to geographic places, so I think it is safe to assume they will never
be TLDs. The AGB for the last round had a list of 33 reserved names on pages 2-9
and 2-10 that I doubt will ever be delegated. I would be pretty surprised if I
were the only person squatting on one of those names on his private network.

I don't see any reason to treat .INTERNAL differently from .NIC or .AA. None of
them are delegated, none will be delegated, and if you use them internally,
you'll have to do something local if you validate DNSSEC.

Since this issue of "yeah it works if you trust your network's resolver but not
if you do your own DNSSEC checks" comes up over and over again I think it would
be worth looking at ways for networks to tell their hosts what the local trust
anchors are, but that's a separate can of worms.

R's,
John