Subject: Re: [dnsop] DRAFT new charter

From: Dean Anderson <[email-masked]>
Date: Tue, 21 Mar 2006 23:15:18 -0500 (EST)

Why is the first element left out:

1. Define the processes by which Domain Name System (DNS) software
      may be efficiently and correctly administered, configured, and
      operated on Internet networks. This will include root zone
      name servers, gTLD name servers, name servers for other DNS
      zones, iterative DNS resolvers, and recursive DNS resolvers.
      As part of this effort, the group will produce documents
      explaining to the general Internet community what processes
      and mechanisms should be employed for the effective management
      and operation of DNS software. 

It seems to me the issues outlined in the current charter element above are
still a fundamental and important part of the DNSOP mission, particularly with
respect to the ICANN MoU and RFC 2870, which give a substantial role to the IETF
on DNS Root server operations.

Has this change been discussed with ICANN?  If so, what is the input from ICANN?

If the DNSOP group is to abandon the topics in section 1, what group is going to
take over these subjects?  Is the IETF planning to abdicate its role in these
DNS operations subjects? Particularly DNS root server operations? If so, to what
standards organization should ICANN and others go to for root server engineering
standards and operations guidance?

I hope this omission is an oversight. If not, then a great deal more
coordination and discussion is necessary before simply re-chartering DNSOP and
leaving out this rather important subject matter from the charter.

	--Dean

On Tue, 21 Mar 2006, Peter Koch wrote:

> Dear WG,
> 
> as you might have seen on the agenda for tomorrow's meeting we'd like to
> discuss the rechartering of the dnsop WG. This is a text for the general
> mission statement, slightly adjusting the focus:
> 
> -----------------------------------------------------------------------------
> 
> The DNS Operations Working Group will develop and review guidelines for the
> correct, efficient and secure configuration of DNS authoritative servers,
> resolvers, and DNSSEC validators. Target audiences for those guidelines
> are zone administrators as well as software developers who provide tools
> for DNS zone administration or server/resolver/validator configuration.
> 
> The group will perform the following activities:
> 
> 1) develop or review guidelines for chosing zone configuration
>    parameters that affect inter-server or server-resolver communication,
>    including but not limited to SOA RR parameters, TTL values, and glue
>    information
> 
> 2) develop or review guidelines for any DNSSEC specific operational
>    parameters, such as key length or key validity periods
> 
> 3) develop or review operational guidelines that address the specifics of
>    IPv4/v6 coexistence and transition
> 
> 4) review the use of existing DNS frameworks (SRV, DDDS) in other protocols,
>    especially focussing on operational consequences and scalability
> 
> -----------------------------------------------------------------------------
> 
> The old charter can be found at <http://www.ietf.org/html.charters/dnsop-charter.html>
> 
> Please send comments to this list, during tomorrows session or on jabber
> <[email-masked]> 2120-2320 UTC. We'll have to talk about
> milestones.
> 
> -Peter
> .
> dnsop resources:_____________________________________________________
> web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
> mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html
> 
> 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   

.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Peter Koch <[email-masked]>
Date: Mon, 27 Mar 2006 23:25:21 +0200

Dean,

>       name servers, gTLD name servers, name servers for other DNS
[...]

i'd not say this was left out. Instead, the new "1" reads

While this does not enumerate particular servers or levels, it is meant to
apply to all levels of the DNS hierarchy (which we could say explicitly).
It seemed not appropriate to name just a few and discriminate against others.

> on DNS Root server operations.

Sure this is important, but that is unrelated to the ICANN MoU. Also you seem
to see a role for the IETF 'on DNS Root server operations' that I can't follow.
dnsop is and will, I assume, continue to be chartered to provide operational
guidance and document (best) current practices, but this will happen in the
form of I-Ds that eventually get published as RFCs, _not_ by commenting
or even "supervising" day to day operations.

> Has this change been discussed with ICANN?  If so, what is the input from ICANN?

This is about re-chartering an IETF WG. ICANN staff can and will comment,
if they see a need.

> DNS operations subjects? Particularly DNS root server operations? If so, to what

As said above, there is no such change. But even if the dnsop WG would be
closed, I'm sure the IETF would be able to provide for operational or other
technical expertise. But then again, we seem to have different views of that
role.

-Peter
.

---

From: Dean Anderson <[email-masked]>
Date: Tue, 28 Mar 2006 21:31:15 -0500 (EST)

It might help more if you explained what the motiviation and intent of the
re-chartering is. I am just guessing from what seems implied by the changes. Why
recharter? What is wrong with the old charter? Why now?  Resolvers and DNSSEC
oeprations are already in scope in the old charter.  Is there some new business
proposed that is presently out of scope?  And if not, why re-charter?

Specifics inline.

>    including but not limited to SOA RR parameters, TTL values, and glue

This is a very narrow interpretation of "operations". There is a great deal more
to DNS server operations (particularly to root DNS server operations) than zone
configuration parameters.  One only needs review the specifications contained in
RFC 2870 to see this.  

It would seem that RFC 2870 updates would be out of scope for this charter.  
Just about every section of RFC 2870 is out of scope in the proposed charter.  
Just for example, consider RFC 2870 section 3.1.2:

        3.1.2 Unless there is documentable experience that the local
              power grid is more reliable than the MTBF of a UPS (i.e.
              five to ten years), power continuity for at least 48 hours
              MUST be assured, whether through on-site batteries, on-
              site power generation, or some combination thereof. 

This section (and most of RFC 2870) has nothing to do with zone configuration,
but a lot to do with root DNS server operations.

It would seem that the charter you propose precludes discussion of things like
UPS, power generation, and power grid requirements for root DNS server 
operators.  

> It seemed not appropriate to name just a few and discriminate against others.

I agree that we should not discriminate against others. However, special care
must be given to root DNS operations. Lower level DNS users have no obligations
to follow RFC 2870, and the IETF has no special role in giving lower level
operators guidance. Though lower level domain operators might find RFC 2870
helpful, even if too burdensome to follow. While one shouldn't discriminate
_against_ lower level domains, clearly, the root level requires special
attention, both from a common sense point (if the root breaks, nothing works),
and from a MoU/RFC 2870 standpoint, the IETF has made commitments.

> to see a role for the IETF 'on DNS Root server operations' that I can't follow.

RFC 2870 Section 1.1:

   1.1 The Internet Corporation for Assigned Names and Numbers (ICANN)
       has become responsible for the operation of the root servers.
       The ICANN has appointed a Root Server System Advisory Committee
       (RSSAC) to give technical and operational advice to the ICANN
       board.  The ICANN and the RSSAC look to the IETF to provide
       engineering standards.

The ICANN MoU agreement then makes the root operators agree to follow RFC 2870.

I think the DNSOP working group charter needs to be broad enough to encompass 
all the topics in RFC 2870, and then some, since more operations issues might 
arise that might require standards.   

If no IETF working group has a charter to re-consider (if necessary) RFC 2870,
then the IETF has effectively abandoned its commitments to provide any further
engineering standards to Root DNS server operators.  Things can't be both
"out-of-scope" and "in-scope" simultaneously.  If there is no group charted with
the scope to consider root DNS operational standards, then ICANN and RSSAC
really shouldn't be looking to the IETF to provide these standards. Such
standards would be out-of-scope, and the IETF won't be providing them.

> or even "supervising" day to day operations.

RFC 2870 seems to do just that.  Or perhaps I misunderstand your intention. Do
you agree that every element in RFC 2870 should remain in-scope?  If so, then we
have a question of the wording to obtain that intent. Or is it the case that you
intend that most or all of RFC 2870 will be out-of-scope?  [I'm reading your
position as the latter case, but I want to be clear on where you intend to go]

> technical expertise. But then again, we seem to have different views of that

The IETF needs a working group chartered with the scope necessary to discuss new
engineering standards, or scope to even discuss and propose alterations of RFC
2870.  If the IETF has no place for that discussion, then it seems this
discussion and standards-making would have to go to another standards body.  
ICANN and the RSSAC should't be looking for the IETF to discuss these issues.  

If, as the extreme example, the IETF were to close the DNSOP working group
without some other working group chartered to take over the RFC 2870 scope, it
would effectively and officially be out of the business of providing engineering
standards for root DNS server operations.

In closing, I think there is a very good reason for the current first element
of the DNSOP charter, and I think there will be some repercussions to removing
this scope.  It is also too early to tell whether handing root server operations
standardization to another body would be a good thing or a bad thing.  

		--Dean

.