Hi Roy, On Tue, 2026-07-28 at 11:59 +0100, Roy Arends wrote:
> [...] Moving the requirement to specify NS and DelExt Record interaction to the specifications of those records makes a lot of sense to me. Leaving the usage of NS vs. DelExt Records decision to the resolver and allowing the auths to serve DelExt Records alongside NS records in delegations makes introducing new DelExt Records easier. As namservers supporting DelExt, but not those new records, can just serve them without extra processing. > Finally, including the NS RRset in a DE=1 referral does not introduce > a new attack. An on-path attacker capable of modifying referrals can > already inject an NS RRset. The security property comes from what a > resolver is specified to do with that NS RRset, not from whether the > server includes it. > > I am acutely aware that this requirement is new, late in the > development of the protocol, and requires additional specification > and implementation work. This is not intended as an argument against > supporting this requirement, just an acknowledgement that it has > schedule and implementation costs. As the drafts have been sent back to the WG, this is the right time to think about this. Implementations are easy to update now, before any real-world deployment. It might even make authoritative implementations easier as NS and DelExt records no longer require code to exclude NS. Best regards, Pieter _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
