Subject: [DNSOP] I-D Action: draft-ietf-dnsop-delegation-only-00.txt

From: [email-masked]
Date: Wed, 06 May 2020 07:40:36 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations WG of the IETF.

        Title           : The DELEGATION_ONLY DNSKEY flag
        Authors         : Paul Wouters
                          Wes Hardaker
	Filename        : draft-ietf-dnsop-delegation-only-00.txt
	Pages           : 11
	Date            : 2020-05-06

Abstract:
   This document introduces a new DNSKEY flag called DELEGATION_ONLY
   that indicates that the particular zone will never sign zone data
   across a label.  That is, every label (dot) underneath is considered
   a zone cut and must have its own (signed) delegation.  Additionally,
   it indicates the zone is expecting its parent to never bypass or
   override the zone.  DNSSEC Validating Resolvers can use this flag to
   mark any data that violates the DELEGATION_ONLY policy as BOGUS.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-delegation-only/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-dnsop-delegation-only-00
https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-delegation-only-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Bob Harold <[email-masked]>
Date: Wed, 6 May 2020 11:17:08 -0400

> https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-delegation-only-00

Looks good to me.

Minor note:

3.1.  Affected parties and their roles
"Validating Resolver: A validating that" -> "Validating Resolver: A
validating resolver that"

-- 
Bob Harold

---

From: Ray Bellis <[email-masked]>
Date: Wed, 6 May 2020 17:49:59 +0100

§8 of the draft says:

> Some TLDs have a requirement for certain Fully Qualified Domain Names
> (FQDN) within their TLD, such as "whois.example" or "nic.example".
> These usually appear as signed data of the TLD and not as a delegated
> child zone.  These names would have to be converted to delegated
> zones before enabling the DELEGATION_ONLY flag

Requiring such records to become delegations may be impossible if the
existing names (that might now become apex records) require a CNAME.

Another non-delegation record also commonly found in TLDs is
_nicname._tcp.<tld> SRV.

Ray

---

From: Paul Wouters <[email-masked]>
Date: Wed, 6 May 2020 13:51:52 -0400 (EDT)

> existing names (that might now become apex records) require a CNAME.

Why would this _require_ to be a CNAME ?

If whois.example. is now a CNAME to somewhere.something.example. then
you could setup a new zone for whois.example. You are saying the tools
cannot set the A/AAAA records of this new zone to point to the old
CNAME? Or you are afraid the "CNAME update procedure" cannot be
easilly ported to a "A/AAAA update procedure" ?

I would say that a TLD should probably be capable of handling this.

> Another non-delegation record also commonly found in TLDs is

_underscore labels are excempted in the draft already, because it is
understand that these really always apply to the zone itself, and
are never valid delegations to other entities.

Paul

---

From: Paul Wouters <[email-masked]>
Date: Wed, 6 May 2020 14:01:16 -0400 (EDT)

> "Validating Resolver: A validating that" -> "Validating Resolver: A validating resolver that"

Fixed locally, will go out on the next revision. thanks!

Paul

---

From: "John Levine" <[email-masked]>
Date: 6 May 2020 16:19:46 -0400

>Why would this _require_ to be a CNAME ?

Administrative require, not technical.  This seems pretty
hypothetical, since I don't think I've ever seen a CNAME in a TLD
zone.

>_underscore labels are excempted in the draft already,  because
> [ they're not host names ]

Right, but that still doesn't deal with stuff like monitor-nominet.horse.

How about instead saying the zone has only names one level below the
zone cut, other than _underscore ones.  That prevents shadowed
delegations just as well and matches actual zone files a lot better.