On 26-03-18 12:04, Michał Kępień wrote: >> What is the expected behaviour given >> example.net CNAME kskroll-sentinel-is-ta-<key-tag>.example.com >> when you query for example.net when the key-tag does not match >> a root TA? etc. > > This question is still outstanding as of version -08 of the draft.
It is indeed, and it is a question that needs to be answered before it is possible to properly implement the sentinel. For the sake of simplicity I prefer that the *original* QNAME should match the special label. -- Ralph _______________________________________________ DNSOP mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsop
