Bill Woodcock <[email protected]> writes: > > On Jul 20, 2026, at 17:55, Stephane Bortzmeyer > > <[email protected]> wrote: > > https://datatracker.ietf.org/doc/draft-bortzmeyer-dnsop-poisonlicious/ > > I strongly support the effort, but would prefer DoT to be mandatory, > and DANE authentication to be preferred over TSIG, when available.
I also believe this draft could be beneficial and would like to see it adopted. I don't actually think that a particular security mechanism should be demanded, but rather (since this already requires operator agreement and configuration) that the needed attributes of communication (authentication/encryption) be specified instead and list some examples like TSIG, TLS, etc. More notes: I'd would expect the document to start with high level motivations, noting that even within a given administration realm that different implementations might be used and this work standardizes cache sharing across implementations. The document states that all the entities must be within the same organizational domain, which may or may not be true if organizations or collaborations exist. Why is this particular stipulation necessary? If two organizations wish to share data, so be it (with privacy considerations discussed of course). I wonder whether or not the usage of the TSIG secret key is a sufficient internal mechanism within codebases to easily determine the intent of the message. I will leave that up to the implementers to comment on, as I'm not sure. Otherwise, a different signal may be needed, such as an EDNS0 attribute, bit, etc or something that is more in the processing section of the code base (but again, I'll leave it to others who know better). -- Wes Hardaker Google _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
