Re: [DNSOP] Unexpected REFUSED from BIND when using example config from RFC7706

[David Conrad <[e-mail]>]

Paul,

On Apr 6, 2017, 2:24 PM -1000, Paul Vixie <[e-mail]>, wrote:
> the proviso is, RFC 7706 is also completely unsuitable for non-hardcore or non-experienced or non-protocol-geeks;

7706 doesn't recommend editing someone else's zone file, re-signing it, and figuring out how to replicate the hints and trust anchor to _all_ relying devices (and restoring the real hints/trust anchor when you're done). This strikes me as a bit more complicated than 7706. YMMV.

> and both approaches are appropriate only for closed internal networks where the configuration is controlled by a single administration.

If I set up an open resolver using 7706, what negative repercussions do you see?

> the misstatement is, dnssec's purpose is not defeated, because iana's signatures are checked before the zone is accepted, and new signatures are added using local keys before publication.

Meaningless given you are explicitly editing the zone as published from and signed by the authority. You claim you aren't modifying the namespace content (well, except for the root NSes), but the point of DNSSEC and the rather Byzantine structures we've built around establishing trust is that we don't have to believe you: you can see _everything_ having to do with creating the trust anchor and everything down to the leaf.

The only advantage(?) I see in your approach is that is allows (forces) you to play around with the namespace and re-sign. Might be useful for neo maxi zoom DNSSEC nerd experimentation, however as mentioned previously, that doesn't strike me as something one might recommend lightheartedly.

> for my many-vm's laptop environment, running on a loopback isn't a solution.

I strongly suspect you could come up with a solution that didn't use loopback but which also didn't require modifying the root zone, resigning it, and getting all relying devices to use both your NS hints and trust anchor. Like, perhaps running on a non-loopback address within your flock of laptop VMs?

> http://www.circleid.com/posts/20160330_let_me_make_yeti_dns_perfectly_clear/

Saw that a year ago and still think it post-hoc rationalization and specious, but I'm sure that's just me.

Regards,
-drc