Re: [v6ops] draft-bp-v6ops-ipv6-ready-dns-dnssec

On 2018-12-08 08:34, 神明達哉 wrote:
> At Mon, 3 Dec 2018 16:56:51 +0000,
> Ron Bonica <rbonica@juniper.net> wrote:
> 
>> Each week between now and IETF 104, we will review and discuss one draft
> with an eye towards progressing it.
>>
>> This week, please review and comment on
> draft-bp-v6ops-ipv6-ready-dns-dnssec.
> 
> I've read draft-bp-v6ops-ipv6-ready-dns-dnssec-00.
> 
> While the motivation is laudable, I have to say I'm skeptical about
> its effectiveness if one main audience is "the IPv4 laggards".  

Unfortunately I have to agree. An IETF RFC seems like the least
likely method of achieving the desired result. I think past experience
shows that hard, persistent work through the major operational
gatherings and forums, particularly the various RIR-sponsored meetings,
with help from ISOC, is the only way to get anywhere.

    Brian

> Just
> as it may be "unfair" that an IPv6-only service provider needs to
> handle A-only DNSSEC signed zones, it would be "unfair" for these
> "laggards" that they are required to deploy IPv6 services and publish
> corresponding AAAAs when they only need (for whatever reasons)
> IPv4-only services.  I suspect referring to RFC6540 doesn't help for
> those people.
> 
> On a related note, there's one thing I'm not sure from the draft:
> whether "requiring AAAA" also means "requiring to provide the
> corresponding service over IPv6" (here I assume the existence of such
> a service; that should normally be the case in practice).  In the
> previous paragraph I assumed the draft requires this too, but if it
> only means some AAAA that is correctly signed but the address doesn't
> have to be accessible over IPv6, then it might be more acceptable for
> lazy "laggards".  Ideally such an unreachable IPv6 address should
> cause an immediate failure when an IPv6 node tries to send a packet to
> it, but some smartness like HE may be good enough to handle cases
> where those IPv6 addresses create a blackhole.  If that's the intent
> of the draft, I'd suggest making it clearer, possibly with suggesting
> some specific IPv6 addresses (maybe ::?) to be used for this purpose.
> 
> This draft seems to also talk about providing IPv6 reachability to
> name servers (which is irrelevant to providing DNSSEC-signed AAAA).
> For example Section 6 states:
> 
>    In the context of this document, and others that may be generated as
>    a consequence of it, "IPv6-Ready DNS/DNSSEC Infrastructure" means
>    that a DNS/DNSSEC server (root, TLD, authoritative NS, others) is
>    fully accessible and operational if queried either from a remote
>    dual-stack network or an IPv6-only network.
> 
> Is my understanding correct?  If so, I suspect it's more likely to be
> just ignored by the "laggards" for the same reason as that I mentioned
> above.  And, in any case, I personally think it's better if this
> document focuses on the issue of interaction between DNSSEC and
> DNS64.  If my understanding of this part is incorrect, then it's not
> clear to me what it means and I'd suggest rewriting it.
> 
> --
> JINMEI, Tatuya
> 
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
> 