<html><head></head><body><div><div><div class=""><br></div><div class=""><div class="gmail_signature"><br></div></div><div class=""><br></div><div class="gmail_extra"><div class=""><br></div><div class="gmail_quote"><div class=""><span class="sh-date">On Thu, Apr 25</span> 2024 at 12:15 PM, Tim Wicinski
<<a class="" href="mailto:tjw.ietf@gmail.com">tjw.ietf@gmail.com</a>>
wrote: <br></div><div class=""> <br></div><blockquote style="margin:0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex" class="gmail_quote"><div class=""><div class="" dir="ltr"><div style="font-family:monospace" class="gmail_default">I know in our fancy pants nominum s/w we run at cox I add the line "managed-keys" and like magic we're pulling 5011 automagic maintained.<br></div><div style="font-family:monospace" class="gmail_default"><br></div><div style="font-family:monospace" class="gmail_default">got time later <span class="sh-date">today</span>? I am open<br></div></div><div class=""><br></div><div class="gmail_quote"><div class="gmail_attr" dir="ltr">On Thu, Apr 25, 2024 at 11:58 AM Edward Lewis <<a class="" href="mailto:edward.lewis@icann.org">edward.lewis@icann.org</a>> wrote:<br></div><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><div class="">An open question...<br></div><div class=""> <br></div><div class=""> Is anyone aware of any use of Automated Updates of DNS Trust Anchors, documented in RFC 5011, in the last 5 years or so? Does anyone know of a zone (other than the root) that documents or publicizes a reliance on Automated Updates?<br></div></blockquote></div></div></blockquote></div></div><div class=""><div class=""><br></div><div class="">Probably not, because there are really any (public) trust anchors other than the root. </div><div class=""><br></div></div><div class="gmail_extra"><div class="gmail_quote"><blockquote style="margin:0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex" class="gmail_quote"><div class=""><div class="gmail_quote"><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><div class=""><br></div><div class="">For the record, the last time a ccTLD published a revoked SEP key was <span class="sh-date">April 9, 2019</span> (this was not the revocation of the root zone KSK but a TLD's KSK), so I know that none of the TLDs have completed an Automated Updates roll since then.<br></div></blockquote></div></div></blockquote></div></div><div><div><br></div><div>I don't really understand under what conditions I'd want to have a trust-anchor for any (public) zone. The root is signed, the TLDs publish their DS in the root, 2nd levels publish in the TLD, etc. Having a trust anchor for anything under the root seems to just be asking for trouble — if a TLD needed to roll their keys (because of compromise or just on schedule) they can easily and quickly do so under the current paradigm. If I've also installed their key as a separate TA they have a whole long and involved process to go through. The only time that I could see this being "useful" would be if I were in a country that wanted to be able to disconnect itself from the public Internet for an extended period of time…<br></div><div><br></div></div><div class="gmail_extra"><div class="gmail_quote"><blockquote style="margin:0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex" class="gmail_quote"><div class=""><div class="gmail_quote"><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><div class=""> <br></div><div class=""> I have no historical data below the TLD level, so I'm seeking anecdotal evidence of reliance on Automated Updates anywhere (else) in the global public Internet. I doubt there is any, but that is based on absolutely no data and personal assumptions.<br></div><div class=""> <br></div></blockquote></div></div></blockquote></div></div><div><div><br></div><div>Yeah, I think that we have both been saying "public" throughout this thread because there may well be uses of this for private, non-Internet connected zones, which we will not really be able to see…<br></div><div><br></div><div>W</div><div><br></div><div><br></div></div><div class="gmail_extra"><div class="gmail_quote"><blockquote style="margin:0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex" class="gmail_quote"><div class=""><div class="gmail_quote"><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><div class=""> Private replies are fine...I'm not trying to name operators, just evaluate the mechanism's adoption.<br></div><div class=""> <br></div><div class=""> Ed Lewis<br></div><div class=""> <br></div><div class=""> <br></div><div class=""> <br></div><div class=""> _______________________________________________<br></div><div class=""> dns-operations mailing list<br></div><div class=""> <a class="" href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br></div><div class=""> <a class="" rel="noreferrer" href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br></div></blockquote></div><div class="sh-signature"><p class="sh-signature"></p><div class=""><br></div><div class="">_______________________________________________<br></div><div class=""> dns-operations mailing list <br></div><div class=""> <a target="_blank" rel="noopener noreferrer" href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a> <br></div><div class=""> <a target="_blank" rel="noopener noreferrer" href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br></div><p></p></div></div></blockquote></div></div><div class=""><br></div></div><div></div></div></body></html>