Subject: [dns-privacy] Authoritative Server Operator Perspective

From: Brian Haberman <[email-masked]>
Date: Tue, 9 Oct 2018 17:28:18 -0400

All,
     Sorry for the delay in getting this week's thread started. I would
like the focus for this week (10/8-10/14) to be on clarifying the
technical requirements from the authoritative server operator's
perspective. This will encompass the technical issues for all servers
responding to DNS queries (i.e., *LDs).

Regards,
Brian

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 10 Oct 2018 01:10:52 +0000

> responding to DNS queries (i.e., *LDs).

1) An interoperable specification for how to encrypt messages
1a) If it is layer 4, it is likely to be TLS
1b) If it is layer 7, it is likely to be CMS

2) An interoperable method to tell resolvers who might want encrypted responses how to send them.

--Paul Hoffman

---

From: Tony Finch <[email-masked]>
Date: Wed, 10 Oct 2018 10:55:19 +0100

> responses how to send them.

3) An interoperable method to tell resolvers how to authenticate an
authoritaive server.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
reject all prejudice and discrimination based upon race, colour,
religion, age, disability, gender, or sexual orientation

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 10 Oct 2018 15:13:55 +0000

> On Oct 10, 2018, at 2:55 AM, Tony Finch <[email-masked]> wrote:
> 

Yes, definitely.

--Paul Hoffman

---

From: Tony Finch <[email-masked]>
Date: Thu, 11 Oct 2018 18:56:08 +0100

Apart from the basic mechanics that we have already mentioned, I think the interesting question here is how to manage scalability to lots of zones: if we publish encryption/authentication information about nameservers in the DNS:

* is it published per server, associated with the server’s canonical name?

* what about in-bailiwick aliases?

* how important is it to avoid replicating this information in every zone hosted on the server?

* does it help to use the reverse DNS instead?

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at

---

From: Brian Haberman <[email-masked]>
Date: Thu, 11 Oct 2018 15:10:05 -0400

> * does it help to use the reverse DNS instead?

This question brings up a topic that would require a fair amount of
interchange with DANE. What are the benefits/drawbacks of having DANE
records in the reverse tree for each server?

There are probably a myriad of issues to work through, but it looks like
that would alleviate a fair amount of complexity at the zone level.

Still need to think through the gory details...

Brian