Subject: Re: Confirming the Nominet position

From: "Jay Daley" <[email-masked]>
Date: Thu, 27 May 2004 21:15:22 +0100

Bill

[email-masked] wrote on 27/05/2004 17:52:30:

>    That aside, I suspect that -IF- one were to waive some of the 
>    fundamental design principles of the DNS and DNSSEC, it would be
>    possible to design a technical solution to your particular policy
>    drivers. 

This is the crux of it.  With DNS no fundamental principles are waived. We 
enforce our policy by controlling AXFR.  With DNSSECbis that is no longer 
possible.

Jay

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Thu, 27 May 2004 20:35:29 +0000

> enforce our policy by controlling AXFR.  With DNSSECbis that is no longer 

	Er... yes it is.  Leave your AXFR blocks in place.  You still 
	prevent zone transfers.  DNSSEC has nothing to do w/ AXFR support.
	AXFR gives an -exact- copy of the zone, at a point in time.
	
	If you wish to prevent entities from getting the data, block 
	queries as well.  If you enable queries, then entities may build
	a NEAR copy of your data - in fact this is exactly what happens
	with caching nameservers. If I wish to build a highly accuate
	copy, without DNSSEC, I must generate large numbers of queries
	in a fairly short period, guessing at lable contents.  DNSSEC 
	allows me to reduce the number of queries, but they are still
	queries for individual records.  No AXFR involved. :)  

--bill