Re: [DNSSEC-Bootstrapping] Sharding?

[Peter Thomassen <[e-mail]>]

On 10/21/21 10:26 AM, Nils Wisiol wrote:
> On Wed, 2021-10-20 at 18:21 +0200, Peter Thomassen wrote:
>> However, if the parental agent (registry/registrar) does not support
>> the mechanism, bootstrapping records may remain in place more or less
>> indefinitely, until the parent changes their mind (or DS records are
>> provisioned manually). In that case, a large number of records could
>> accumulate under certain hash(ancestor) labels.
>>
>>
>>
>> Do DNS operators think this is a problem that needs to be addressed?
> 
> In this light, I believe it could make sense to support a potentially
> large number of bootstrapping records. Otherwise, DNS operators are
> forced to keep track which zone is located at supporting parental
> agents and what the security status of each zone is.

DNS operators should still clean up bootstrapping records for zones that have been secured, to keep bulk processing via NSEC walks or XFRs of the bootstrap zone efficient.

Given that no operator voiced concerns over the bootstrapping zone size, while it was argued that the protocol scales well even without sharding, I observe that there is currently no support/demand for a sharding mechanism.

I am going to rework some of the draft until Monday (IETF 112 draft submission deadline), mainly to make it relate better to RFC 8078. I am not currently planning to consider sharding in this iteration; if someone feels that is a mistake, please let me know.

Thanks,
Peter

PS: In case demand for sharding should come up later within the WG, we can revisit this (and then also discuss questions like how to do it, whether it should be configurable etc.).


-- 
Like our community service? 💛
Please consider donating at

https://desec.io/

deSEC e.V.
Kyffhäuserstr. 5
10781 Berlin
Germany

Vorstandsvorsitz: Nils Wisiol
Registergericht: AG Berlin (Charlottenburg) VR 37525