[dns-operations] any registries require DNSKEY not DS?

[Olafur Gudmundsson]

> On Jan 22, 2020, at 11:16 PM, Paul Vixie <paul at redbarn.org> wrote:
> 
> On Thursday, 23 January 2020 02:51:28 UTC Warren Kumari wrote:
>> ...
>> 
>> If the parent makes the DS for me from my DNSKEY, well, then the DS
>> suddently "feels" like it belongs more to the parent than the child,
>> but this is starting to get into the "I no longer know why I believe
>> what I believe" territory (and is internally inconsistent), so I'll
>> just stop thinking about this and go shopping instead :-)
> 
> as you see, the DS RRset is authoritative in the parent, in spite of its name 
> being the delegation point, which is otherwise authoritative only in the 
> child. so, DS really is "owned by" the delegating zone, unlike, say, NS.
> 
> historians please note: we should have put the DS RRset at $child._dnssec.
> $parent, so that there was no exception to the rule whereby the delegation 
> point belongs to the child. this was an unforced error; we were just careless. 
> so, example._dnssec.com rather than example.com.
> 
> -- 
> Paul
> 

Paul, 
If start talking about history and looking back with hindsight 

IMHO the second biggest mistake in DNS design was to have the same type in both parent and child zone 
If RFC1035 had specified DEL record in parent and NS in child or the other way around it would have been obvious to 
specify a range of records that were parent only (just like meta records)  thus all resolvers from the get go would have known that types in that range only reside at the parent.
…… 
If we had the DEL record then that could also have provided the glue hints and no need for additional processing, 

You may recall that in 1995 when you and I were trying to formalize for DNSSEC what the the exact semantics of NS record were, then you and Paul Mockapetris came up with 
“Parent is authoritative for the existence of NS record, Child is authoritative for the contents” 


Just in case you are wondering what was the biggest mistake that is QR bit, recursion should have been on a different port than Authoritative.

But this is all hindsight based on 30 years of coding and operational difficulties.

Regards, 
Ólafur

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20200417/1f06cbdd/attachment.html>