Re: [dnsext] slave signing, was does making names the same NEED protocol changes at all?

[Phillip Hallam-Baker <[e-mail]>]

On Sun, Feb 27, 2011 at 10:18 AM, John Levine <[e-mail]> wrote:
>>1) How is key publication going to be effected for rDNS-SEC?
>>
>>Have we actually got a plan for deployment?
>
> As far as I can tell, we don't have a plan for deployment of rDNS on
> IPv6, with or without DNSSEC.  But like I said, I'd rather leave those
> worms in the can other than to note that dynamic generation and
> presumably signing of AAAA and PTR records may turn out to be one of
> the least bad options.

That is my suspicion.

The technology is the easy part. Its the administrative model that
concerns me. Or rather it is technology proposals that seem to assume
that the administrative details are unimportant and can be filled in
later.


> We don't have a plan for IPv6 DNSBLs and DNSWLs either, but if it
> ends up being anything like what people do for IPv4 (an open question,
> due to DNS cache explosion problems) rbldnsd is going to have to sign
> on the fly, too.

This is the sort of issue that I would hope that the IAB spent time
thinking about.

One answer to this question could well be that the people who use
blacklists have to develop their own technology designed for the
purpose.



-- 
Website: http://hallambaker.com/
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext