[DNSOP] An extended scenario for ZONEMD

"John R Levine" <johnl@taugh.com> Tue, 14 January 2020 03:05 UTC

Date: Mon, 13 Jan 2020 22:04:56 -0500
Message-ID: <alpine.OSX.2.21.99999.374.2001131524130.15982@ary.qy>
From: John R Levine <johnl@taugh.com>
To: dnsop@ietf.org
User-Agent: Alpine 2.21.99999 (OSX 374 2019-10-27)
MIME-Version: 1.0
Content-Type: text/plain; format="flowed"; charset="US-ASCII"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/t24OQGgJuEaNeMnv4EgBbmeJ3rk>
Subject: [DNSOP] An extended scenario for ZONEMD
Precedence: list

If the root zone hand a ZONEMD in it, for the first time I'd have a way to 
validate the IP addresses in the *.root-servers.net glue records.

Someone suggested you could validate them by trying a query and seeing if 
you get a answer, which is of course wrong.  That tells you you've found a 
server with the root zone, but it doesn't defend against someone giving 
you fake glue and sniffing your queries, something that I hear is an issue 
if the DoT/DoH discussions are to be believed.

To answer another question, I can't give you one size fits all advice 
about what to do if the ZONEMD validation fails, but if it does, it seems 
like something you'd want to know about.

R's,
John

[DNSOP] An extended scenario for ZONEMD John R Levine