Re: DNSSEC architecture vs reality

[Jim Fenton <[e-mail]>]

On 13 Apr 2021, at 1:58, Patrik Fältström wrote:

> 1. People in the community have too much focused on getting zones 
> signed instead of getting validation deployed. In Sweden we focused in 
> validation, and as validation is happening basically everywhere, it is 
> worth it to get their zones signed.
>
> My conclusion: Continue to talk about _validation_.

Agreed, but a lot of administrators are focused on compliance with 
mandates (such as 
https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2008/m08-23.pdf 
) and it’s easy to audit signing of zones. It’s much harder to audit 
validation, resulting in lower deployment that is unfortunate because 
validation is what would benefit their own users.

-Jim