On 27-Aug-14 14:54, Doug Barton wrote: > On 8/26/14 10:35 AM, Timothe Litt wrote: >> I think this is misleading, or at least poorly worded and subject to >> misinterpretation. > > I chose my words carefully, and I stand by them. > The OP was asking about configuring a resolver (bind's).
Where I thought there could be confusion is in conflating two issues: 1) Should validating resolvers consult the DLV? 2) Should entries be made in the DLV? So you really meant that validating resolvers should only consult DLV if their administrator knows that users are looking-up names that are in the DLV? That's how I read your advice. I don't see how that can work; hence we'll disagree. I think the only viable strategy for *resolvers* is to consult the DLV - as long as it exists. If you meant that an administrator should only put entries in DLV for a domain: a) If there is no direct trust path to the root; and b) the domain benefits from being DNSSEC-secured (know your user base) then we agree. > I did not say that the DLV has no value, and I specifically mentioned > that there are circumstances when it is valuable and should be used. > You clearly have a different view, which is fine. > > When it comes to gTLDs, I completely reject the notion that users > cannot change registrars. It can be hard, no doubt, but it's a > cost/benefit analysis. If the benefit of DNSSEC outweighs the > difficulty of moving, then it's worth it. If not, it's not. The fact > that it's hard doesn't mean it's impossible. > "Impossible" is a very high standard. DNSSEC is only one part of the cost/benefit analysis in choosing/sticking with a registrar. And part of the benefit of DNSSEC goes to the registrant's users, not all to the registrant - this is hard to account for. Also, it's not just the technical/financial difficulty of switching registrars. Some have policies/practices that some users find unacceptable; unfortunately, for quite some time those were the ones that offered DNSSEC. That's improving, but it's still an issue in some circles. DLV has a different set of costs (and benefits - especially when some resolvers don't consult it). If the question is "how can I implement DNSSEC in my zones", the preferred path is certainly not DLV. But if the choice is "a difficult/expensive switch of registrar or no DNSSEC", DLV is worth considering. > That said, I do recognize that there are situations where a chain of > trust to the root is not possible (such as some reverse zones). Again, > this becomes a cost/benefit analysis. For reverse zones if DNSSEC is > important it may be worth the effort of changing providers, or even > getting a PI assignment. For TLDs where DNSSEC is not yet available, a > change may be in order. If enough people vote with their feet in this > way those providers and TLDs that lose customers may reconsider their > offerings. > > No one said it would be easy. :) > > Doug I agree that a chain to the root is the preferred option. I would love to vote with my feet. I have a few small problems with that strategy. There is no ISP in my geography that provides dnssec reverse delegation for IPv4. Not for lack of complaints/escalations from me. There is only one ISP here that offers fiber speeds at prices that an individual can afford. So it can afford not to care. For IPv6 - well, I can't get IPv6 directly from any ISP, but my tunnel provider does allow DNSSEC reverse delegation. When my ISP finally implements IPv6 (promised for over 2 years, but again, they don't care), I'll have to choose between a direct IPv6 connection with no reverse DNSSEC, or sticking with my tunnel. A provider-independent IP addresses is out of reach for all but the largest/best financed organizations. Not just getting them, but the additional costs of having to get them routed. And just try to get an ISP to route a small number of IP addresses for a home/small business (or even medium business) customer...at any price. So yes, there are trade-offs and a cost/benefit analysis is helpful. And if you're a big enough customer and/or you're fortunate enough to have a choices that enable a direct trust chain to the root, we agree that is the preferred choice from a strictly DNSSEC perspective. Certainly DNSSEC is not easy. It's getting somewhat easier, though not fast enough. One way to make it easier - for now - is to encourage *resolvers* to consult DLV. That allows validated resolution of the domains that require DLV. That's a good thing. And that's where this thread started. I think that's the only part that's strictly on-topic for this list...
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users