Hi, I agree with Ondřej's point regarding the architecture here. NTAs are inherently local operational overrides specific to a resolver's policy, rather than a global state that belongs in dedicated feed zones.
If the core objective is visibility and discovery into active NTAs rather than building new zone-transfer infrastructure, leveraging *RFC 9606 (RESINFO)* might be a cleaner alternative. Since NTAs are scoped to the resolver and are meant to be temporary, resolvers could self-announce their currently active NTAs via RESINFO key-value pairs (for instance, an nta-uri attribute pointing to the resolver's active NTA dataset). This keeps the policy discovery explicitly local to the resolver enforcement point and reuses an existing mechanism, avoiding the need to construct and maintain new feed-zone distribution logic. Best regards, Aditya Ghosh (he/him) Research Intern India Internet Foundation [email protected]
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
