Subject: Re: [v6ops] [dnssec-coord] Comments? draft-byrne-v6ops-dnssecaaaa - DNSSEC Resource Record Should Include AAAA

From: Paul Wouters <[email-masked]>
Date: Tue, 11 Sep 2018 23:13:47 -0400 (EDT)

On Wed, 12 Sep 2018, Dan York wrote:

> A friend just clued me in to this draft over in v6OPS from Cameron Byrne at T-Mobile USA:
> 
> https://tools.ietf.org/html/draft-byrne-v6ops-dnssecaaaa-00
> If I understand this correctly, basically what he is saying is “everything signed with DNSSEC should have
> an IPv6 address”, right?

Yes and kind of badly phrased. It assumes DNS is only for A and AAAA
records :P It should really say "All names with an A record should also
have a AAAA record" (instead of talking about "DNSSEC signed resources")

But the intent is good and I agree with the document's BCP statement.

Although deploying IPv6 and DNSSEC "in tandem" as stated would be a
restriction too many. Instead it is better to state "deploy AAAA along
all A before deploying DNSSEC". I don't think anyone will roll out DNSSEC
and IPv6 "in tandem".

The draft is also missing another obvious exception. Clients should
really run a validating resolver themselves (with a forwarder over IPv6)
and implement DNS64 natively. Then the client can accept insecure
synthesized AAAA records safely.

Paul