Re: [sunset4] future of dnssec?

On Wed, Feb 22, 2017 at 6:36 AM Mark Andrews <marka@isc.org> wrote:

>
> In message <B5E8C545-55B9-4ECB-B0C8-C3EEFEECD320@fugue.com>, Ted Lemon
> writes:
> >
> > Nick, the solution to this is to do DNS64 in the validator.   If the
> > validator is a stub resolver, do the DNS64 hack there.   AFAIK the
> > technology to support this already exists.
>
> DNS64 really should just be made historic.  It does not work with
> DNSSEC.  There has NEVER been a NEED for NAT64 or DNS64.  They
> provides NO BENEFIT over other methods.  Every proported benefit
> turns out not to exist.
>
> Go do the comparitive analysis.

>From a network with 10s of millions of nat64 users and zero dnssec, I
disagree and suggest dnssec move to historic since it is a ddos attack
vector and provides no privacy element and generally weak cryto ... also it
has caused many wide scale outages for networks that have elected to use
it.

>
> > > On Feb 22, 2017, at 7:23 AM, Heatley, Nick <nick.heatley@ee.co.uk>
> > wrote:
> > >
> > > Post exhaustion, the majority of cellular networks and some public wifi
> > networks will use DNS64.
> > > DNSSEC and DNS64 do not get along. DNSSEC for “A records only” is
> > broken.
> > > Is this the reason why all content must go v6?
> > > Or is the case for DNSSEC still questionable?
> > > Or do end hosts need to perform DNS64 so “DNSSEC for A records only”
> > can be intact?
> > >
> > > NOTICE AND DISCLAIMER
> > > This email contains BT information, which may be privileged or
> > confidential. It's meant only for the individual(s) or entity named
> > above.
> > > If you're not the intended recipient, note that disclosing, copying,
> > distributing or using this information is prohibited.
> > > If you've received this email in error, please let me know immediately
> > on the email address above. Thank you.
> > >
> > > We monitor our email system, and may record your emails.
> > >
> > > EE Limited
> > > Registered office:Trident Place, Mosquito Way, Hatfield, Hertfordshire,
> > AL10 9BW
> > > Registered in England no: 02382161
> > >
> > > EE Limited is a wholly owned subsidiary of:
> > >
> > > British Telecommunications plc
> > > Registered office: 81 Newgate Street London EC1A 7AJ
> > > Registered in England no: 1800000
> > >
> > > _______________________________________________
> > > sunset4 mailing list
> > > sunset4@ietf.org <mailto:sunset4@ietf.org>
> > > https://www.ietf.org/mailman/listinfo/sunset4
> > <https://www.ietf.org/mailman/listinfo/sunset4>
>
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
>
> _______________________________________________
> sunset4 mailing list
> sunset4@ietf.org
> https://www.ietf.org/mailman/listinfo/sunset4
>