Subject: Re: [DNSOP] Questions on draft-ietf-dnsop-delegation-only

From: Hugo Salgado <[email-masked]>
Date: Thu, 6 Aug 2020 13:27:21 -0400

On 16:55 30/07, Patrick Mevzek wrote:
> 
> Only if you take the "hosts as objects" case (where any hosts to be used as
> to be provision like a domain but by just providing, in some cases, some IP
> addresses), which is only one of the two, the other being "hosts as
> attributes (of a domain object)"
> 

.CL uses "hosts as attributes".

> There are various solutions, all bad in some aspects:
> 
[...]
> - have the registry let the domain be deleted and then have domainB be
> broken (which it is already in a way since the delegations to those
> nameservers can be explicitly made broken; but the difference is between
> registrar A breaking registrar B stuff, or the registry breaking registrar B
> stuff).

And this approach. When DomainA is deleted/deactivated, its
nameservers are gone in the .cl zone, together with their
glues. Nameservers ns1.domainA.example and ns2.DomainA.example
are deleted from DomainB's NS set too, because there's no DomainA
anymore... and so we keep .cl consistency.

So we can say .CL is truly delegation-only. But we know there're
only a handful of registries using hosts-as-attributes.

Hugo

---

From: Patrick Mevzek <[email-masked]>
Date: Tue, 11 Aug 2020 14:37:04 -0500

On 30/07/2020 16:55, Patrick Mevzek wrote:
> registrar A breaking registrar B stuff, or the registry breaking 
> registrar B stuff).
You may have seen Afilias announcement yesterday about glue records
(as a consequence of the discussion here maybe?), with a public version 
at 
http://www.circleid.com/posts/20200811-afilias-to-protect-tlds-against-potential-orphan-glue-exploits/

It boils down to the above, that is removal of current glue records even 
if that breaks other domains using them currently.
Registrars have only a few day to mitigate this.

-- 
Patrick Mevzek

---

From: Paul Wouters <[email-masked]>
Date: Tue, 11 Aug 2020 20:55:54 -0400 (EDT)

On Thu, 30 Jul 2020, Joe Abley wrote:

>> I do not believe that is correct. The first and foremost purpose is for
>> the bit to signal the parent zone's behaviour in a public way that
>> prevents targeted / coerced attacks from the parent. This allows
>> policy violations to be rejected even if these violating DNS answers
>> are DNSSEC signed.
>
> Has anybody done a survey to find out how many TLD zones actually fits the description of "delegation-only"?
>
> I know for a fact that ORG does not today and I would say is unlikely ever to.

So this statement aged badly with today's announcement from Afilias:

 	Afilias has informed registrars and registry clients that it is
 	taking steps to remove orphan glue records from 200+ TLD zones
 	in its care. This will eliminate the potential for a handful of
 	domain names to be misused.

 	Afilias identified a handful of domain names among the 20 million names

> For example, any nameserver N that is subordinate to domain D and linked to some other domain E will be served authoritatively from the ORG zone if domain D is suspended and while E continues to be delegared. Suspensions happen regularly, e.g. for domains implicated in technical abuse. There are several thousand examples of such N today and history suggests the number is not becoming smaller. Even if the number of such N could reach zero in ORG, we could never assume the number would remain at zero and still would not be able to assert usefully that the zone is delegation-only.
>
> I don't think ORG is particularly special in this regard; it seems possible that other (possibly many other; possibly most or all) TLD zones are similar. If there are no TLD zones that actually are delegation-only then there seems no obvious application for it, regardless of whether we consider it to be useful or not.

Well, 200+ TLD's are now removing this problematic orphan glue due to
security reasons unrelated to this draft.

So my question to Joe is, did you have any other concerns with allowing
this draft to move forward?

Paul

---

From: "John Levine" <[email-masked]>
Date: 12 Aug 2020 17:30:02 -0400

>http://www.circleid.com/posts/20200811-afilias-to-protect-tlds-against-potential-orphan-glue-exploits/

Nope. Afilias is removing glue from completely deleted domains, not
from the suspended ones that Joe was describing. I know this because I
asked Jim Galvin, who wrote the CircleID piece, rather than guessing
and guessing wrong.

>this draft to move forward?

I'm not Joe but it is utterly clear while this draft is an interesting
idea, it does not match the way that TLDs are actually managed and
will not be useful. It's time to stop and work on other, more
promising ideas.

R's,
John