Re: [sunset4] future of dnssec?

[Mark Andrews <[e-mail]>]

In message <[e-mail].C
O.UK>, "Heatley, Nick" writes:
> It is not the phone where the blocker is, Mark.
> It is Core Network "policy, control and charging".
> Encapsulation obstructs any IP function that must be performed prior to t=
> he NAT to the outside.

Why does a telco *need* to look inside a encapsulated packet?  You
charge the customer based on the encapsulating packet.  If you
really need to look inside it isn't hard to take of the IPv6 header
while still remembering who the customer is based on the IPv6
addresses.

Oh dear we are a telco and we are going to play the 800lb gorrilla
and require that every device on the planet be updated do that we
can do NAT64.

RFC 6147 needs updates RFC 4034 as things currently stand.  It's
not a minor extension that only those using DNS64 need to support.
It update *every* validating product on the planet so some telco
don't need to unwrap a encapsulating header to get their accounting
correct.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]