Subject: Re: [DNSOP] I-D Action: draft-woodworth-bulk-rr-07.txt

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 1 Feb 2018 09:03:50 +0100 (CET)

On Sun, 19 Nov 2017, JW wrote:

> Hello,
> This draft was released a couple weeks ago and includes what we feel are some very noteworthy changes.
> Please take another look when you have time, as always we look forward to and welcome any questions/ comments.
> I am disappointed I was unable to join the group in Singapore but am optimistic I'll be able to meet again in London.

Hi, I am brought here because of the notification of this in v6ops.

I am supportive of the general idea of having these kinds of bulk records 
standardized. I read the draft, and if I understand correctly it currently 
proposes to not have DNSSEC support without on-the-fly signing.

I am extremely opposed to introducing new features into DNS that doesn't 
support DNSSEC. Going from not supporting DNSSEC to supporting DNSSEC on 
your device/server/whatever should never mean you lose features. So if 
anything new is proposed that doesn't support DNSSEC (at least on the 
server side), then we need to have a "let's deprecate DNSSEC" discussion 
at the same time. If the consensus is that we shouldn't deprecate DNSSEC, 
then whatever feature is proposed that doesn't support DNSSEC needs to go 
back to the drawing table.

With that in mind, I'd rather have this feature be a new RR type that 
would involve not generating records on the fly at all, but instead sign 
this RR type using regular DNSSEC, and then the resolver needs to be 
updated in order to actually use/understand this new RR type. I know this 
(probably) brings in another world of hurt as now (I guess) the resolver 
needs to fake PTR entries towards internal APIs that don't support these 
bulk RRs?

Anyhow, suggesting this without support for offline signed zone files is a 
no-go for me (unless that of course is deprecated and we're saying DNSSEC 
now is all about on-the-fly signing, then that discussion of course 
changes).

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: "Woodworth, John R" <[email-masked]>
Date: Thu, 1 Feb 2018 18:20:47 +0000

> -----Original Message-----
> From: DNSOP [mailto:[email-masked]] On Behalf Of Mikael Abrahamsson
>
> standardized.

Hi Mikael,

Thank you for your interest and comments, they are welcome and appreciated.

>
> I read the draft, and if I understand correctly it currently

We introduced a number of concepts with our initial draft, including support
for offline DNSSEC.  After a number of discussions with others we determined
our solution (NPN RR's) may be better suited for a broader scope and are
planning to move it into its own draft.  Our hope is for others to benefit
from our effort and promote similar concepts and features yet to come.

Our immediate goal is to get the draft adopted by the WG so we can iron
out the details as a community.  I feel we've demonstrated our openness
to change and willingness to forge this draft into what can be the most
useful and greatest benefit to those concerned.  This definitely includes
support of DNSSEC its many challenges.

> support DNSSEC.

Agreed.  We only recently removed NPN RR's (offline support) from our
draft in hopes it may simplify and garner more support for the draft.

We are open to reintroducing it if that makes more sense.

Thanks again,
John
-- THESE ARE THE DROIDS TO WHOM I REFER:
This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.