Re: [v6ops] draft-bp-v6ops-ipv6-ready-dns-dnssec

[神明達哉 <[e-mail]>]

At Mon, 3 Dec 2018 16:56:51 +0000,
Ron Bonica <[e-mail]> wrote:

> Each week between now and IETF 104, we will review and discuss one draft
with an eye towards progressing it.
>
> This week, please review and comment on
draft-bp-v6ops-ipv6-ready-dns-dnssec.

I've read draft-bp-v6ops-ipv6-ready-dns-dnssec-00.

While the motivation is laudable, I have to say I'm skeptical about
its effectiveness if one main audience is "the IPv4 laggards".  Just
as it may be "unfair" that an IPv6-only service provider needs to
handle A-only DNSSEC signed zones, it would be "unfair" for these
"laggards" that they are required to deploy IPv6 services and publish
corresponding AAAAs when they only need (for whatever reasons)
IPv4-only services.  I suspect referring to RFC6540 doesn't help for
those people.

On a related note, there's one thing I'm not sure from the draft:
whether "requiring AAAA" also means "requiring to provide the
corresponding service over IPv6" (here I assume the existence of such
a service; that should normally be the case in practice).  In the
previous paragraph I assumed the draft requires this too, but if it
only means some AAAA that is correctly signed but the address doesn't
have to be accessible over IPv6, then it might be more acceptable for
lazy "laggards".  Ideally such an unreachable IPv6 address should
cause an immediate failure when an IPv6 node tries to send a packet to
it, but some smartness like HE may be good enough to handle cases
where those IPv6 addresses create a blackhole.  If that's the intent
of the draft, I'd suggest making it clearer, possibly with suggesting
some specific IPv6 addresses (maybe ::?) to be used for this purpose.

This draft seems to also talk about providing IPv6 reachability to
name servers (which is irrelevant to providing DNSSEC-signed AAAA).
For example Section 6 states:

   In the context of this document, and others that may be generated as
   a consequence of it, "IPv6-Ready DNS/DNSSEC Infrastructure" means
   that a DNS/DNSSEC server (root, TLD, authoritative NS, others) is
   fully accessible and operational if queried either from a remote
   dual-stack network or an IPv6-only network.

Is my understanding correct?  If so, I suspect it's more likely to be
just ignored by the "laggards" for the same reason as that I mentioned
above.  And, in any case, I personally think it's better if this
document focuses on the issue of interaction between DNSSEC and
DNS64.  If my understanding of this part is incorrect, then it's not
clear to me what it means and I'd suggest rewriting it.

--
JINMEI, Tatuya