Subject: REOPEN: DNSSECbis-Q-8: non-zone KEY RRs at apex

From: "Scott Rose" <[email-masked]>
Date: Tue, 6 May 2003 15:29:44 -0400

This matter is still open.  Taking Simon Josefsson's comments:

Q:  Should the language in Section 2 of the protocol draft allow non-zone
KEY RRs at a zone's apex?

Discussion:

Section 2 of the protocol draft states:

"Other public keys associated with other DNS operations can be stored
in KEY RRs that are not marked as zone keys. Non-zone key KEY RRs
MUST NOT appear at delegation names. Non-zone key KEY RRs also
SHOULD NOT appear at the zone apex, because large KEY RRsets add
processing time at resolvers. Non-zone key KEY RRs MAY appear at any
other name in the zone. "

However, there is no clear documentation as to where this was updated from
RFC 2535 before.  RFC 3445 (Restrict KEY) only restricts KEY to DNSSEC
protocol uses, but not their location.  This was present in -00 version of
draft and unmentioned until recently on namedroppers.

Should the wording be changed to say that "non-zone KEY RRs MAY appear at a
zone apex"?

NOTE:  This discussion should be restricted to the apex.
Restricting/allowing KEY RRs at delegation points will be the subject of a
different discussion thread.

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>