On Fri, 26 Jun 2026, Bob Traverz wrote:
With respect to the DKA discussion, I’d run the “edge-case” test to test if a proposed architecture makes sense. Does a domain, to have a DKA, necessarily require a website or other HTTPS assets? If not, there is no inherent dependency between a website and a DKA. Forcing a domain to have an “A” record designating a Https resource just to run a .well-known URL that delivers another endpoint is simply an end-run around the DNS. Feels like a hack rather than a well-designed architecture.
Indeed. MTA-STS is basically an end run around DNSSEC TLSA, because at least one large mail provider doesn't sign its DNS.
You know, all you really need to do is pick a name like dka-server and say that the server for example.com is at https://dka-server.example.com. All done. If you want to outsource your key server to a shared service, you know what CNAMEs are.
R's, John _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
