On Fri, Aug 14, 2026 at 10:17 AM Philip Homburg <[email protected]> wrote:
> > This message starts a > > dnsop WG Call for Adoption of: draft-huque-dnsop-multi-alg-rules-08 > > > > This Working Group Call for Adoption ends on 2026-08-31 > > > > Abstract: > > This document restates the requirements on DNSSEC signing and > > validation and makes small adjustments in order to allow for > > more flexible handling of configurations that advertise multiple > > Secure Entry Points (SEP) with different signing algorithms via > > their DS record or trust anchor set. The adjusted rules allow > > both for multi- signer operation and for the transfer of signed > > DNS zones between providers, where the providers support disjoint > > DNSSEC algorithm sets. In addition, the proposal enables > > pre-publication of a trust anchor in preparation for an algorithm > > rollover, such as of the root zone. > > > > This document updates RFCs 4035 and 6840. > > > > Please reply to this message and indicate whether or not you support > > adoption of this Internet-Draft by the dnsop WG. Comments to explain > > your preference are greatly appreciated. Please reply to all > > recipients of this message and include this message in your response. > > I support adoption. As the abstract outlines, this is important to simplify > DNSSEC operation in quite a few cases. > > An issue that may need to be addressed is the desire to strictly prefer > PQC algorithms over traditional ones. That may conflict with the concepts > used in this draft. It would be nice to deal with that in this draft > though it could be addressed later when we create standards for PQC. > I support adoption, not only as an author but primarily because I've had to work through some operational hoops in order to deal with the current status of multi-algorithm setups. PQ DNSSEC deployments need to be discussed further as part of this process but I also agree that resolving PQC downgrade attacks can be postponed. / Christian
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
