<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 17, 2020, at 4:45 PM, Brian Dickson <<a href="mailto:brian.peter.dickson@gmail.com" class="">brian.peter.dickson@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class="Apple-interchange-newline"><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Apr 17, 2020 at 12:57 PM Olafur Gudmundsson <<a href="mailto:ogud@ogud.com" class="">ogud@ogud.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;"><div style="overflow-wrap: break-word;" class=""><br class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On Jan 22, 2020, at 11:16 PM, Paul Vixie <<a href="mailto:paul@redbarn.org" target="_blank" class="">paul@redbarn.org</a>> wrote:</div><br class=""><div class=""><div class="">On Thursday, 23 January 2020 02:51:28 UTC Warren Kumari wrote:<br class=""><blockquote type="cite" class="">...<br class=""><br class="">If the parent makes the DS for me from my DNSKEY, well, then the DS<br class="">suddently "feels" like it belongs more to the parent than the child,<br class="">but this is starting to get into the "I no longer know why I believe<br class="">what I believe" territory (and is internally inconsistent), so I'll<br class="">just stop thinking about this and go shopping instead :-)<br class=""></blockquote><br class="">as you see, the DS RRset is authoritative in the parent, in spite of its name<span class="Apple-converted-space"> </span><br class="">being the delegation point, which is otherwise authoritative only in the<span class="Apple-converted-space"> </span><br class="">child. so, DS really is "owned by" the delegating zone, unlike, say, NS.<br class=""><br class="">historians please note: we should have put the DS RRset at $child._dnssec.<br class="">$parent, so that there was no exception to the rule whereby the delegation<span class="Apple-converted-space"> </span><br class="">point belongs to the child. this was an unforced error; we were just careless.<span class="Apple-converted-space"> </span><br class="">so, example._<a href="http://dnssec.com/" target="_blank" class="">dnssec.com</a><span class="Apple-converted-space"> </span>rather than<span class="Apple-converted-space"> </span><a href="http://example.com/" target="_blank" class="">example.com</a>.<br class=""><br class="">--<span class="Apple-converted-space"> </span><br class="">Paul<br class=""><br class=""></div></div></blockquote><div class=""><br class=""></div>Paul, </div><div class="">If start talking about history and looking back with hindsight </div><div class=""><br class=""></div><div class="">IMHO the second biggest mistake in DNS design was to have the same type in both parent and child zone </div><div class="">If RFC1035 had specified DEL record in parent and NS in child or the other way around it would have been obvious to </div><div class="">specify a range of records that were parent only (just like meta records) thus all resolvers from the get go would have known that types in that range only reside at the parent.</div><div class="">…… </div><div class="">If we had the DEL record then that could also have provided the glue hints and no need for additional processing, </div></div></blockquote><div class=""><br class=""></div><div class="">Would the method have potentially been to have GLUEA and GLUEAAAA records rather than effectively overloading the A/AAAA status (authoritative vs not)?</div><div class="">And then all of the new types that live only in the parent, could have been signed.</div><div class="">I'm guessing it's way to late to start doing that now, without rev'ing all of DNS to v2.</div><div class="">
</div></div></div></div></blockquote><div><br class=""></div>Assuming that GLUEx records were Parent side only that is possible, but I was thinking that DEL could be like a TXT </div><div>foo. DEL "ns1.foo” “127.0.0.1” “1::dead:beef” </div><div>and this would have been what was used to do the initial lookup into child zone. </div><div>Yes this all will require DNSng and that is a ……. </div><div><br class=""></div><div><br class=""></div><div><blockquote type="cite" class=""><div class=""><div dir="ltr" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><div class="gmail_quote"><div class="">Brian</div><div class=""><br class=""></div><div class=""> </div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;"><div style="overflow-wrap: break-word;" class=""><div class=""><br class=""></div><div class="">You may recall that in 1995 when you and I were trying to formalize for DNSSEC what the the exact semantics of NS record were, then you and Paul <span style="font-size: 13.3333px;" class="">Mockapetris </span>came up with </div><div class="">“Parent is authoritative for the existence of NS record, Child is authoritative for the contents” </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Just in case you are wondering what was the biggest mistake that is QR bit, recursion should have been on a different port than Authoritative.</div><div class=""><br class=""></div><div class="">But this is all hindsight based on 30 years of coding and operational difficulties.</div><div class=""><br class=""></div><div class="">Regards, </div><div class="">Ólafur</div><br class=""></div>_______________________________________________<br class="">dns-operations mailing list<br class=""><a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank" class="">dns-operations@lists.dns-oarc.net</a><br class=""><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank" class="">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br class=""></blockquote></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">dns-operations mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="mailto:dns-operations@lists.dns-oarc.net" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">dns-operations@lists.dns-oarc.net</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a></div></blockquote></div><br class=""></body></html>