Subject: Summary: DNSSECbis Q-8: Non zone KEYs at the apex

From: "Scott Rose" <[email-masked]>
Date: Tue, 6 May 2003 08:46:37 -0400

The language in the protocol document will remain as is:  namely, non-zone
KEY RRs SHOULD NOT be placed in the zone apex, but are not expressly
forbidden.  There is no consensus to make this a more stringent restriction
("SHOULD NOT/MUST NOT").  The view seems to be that there is no harm in
having non-zone DNSSEC keys at the apex as part of the KEY RR set.

There may be some benefit to allowing them and no really reason to make the
language read "MUST NOT be placed at the zone apex".

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>