Hello DNSOP-WG, While implementing DELEXT and DELEG, I was somewhat surprised by the per-DELEG record restrictions on DelegInfos.
>From draft-ietf-deleg-11, section 3.4: ======= For interoperability with the resolver algorithm defined in Section 5.1.2, a DELEG or DELEGPARAM record that has a non-empty DelegInfos MUST have one, and only one, set of server information keys, chosen from the following: * one server-ipv4 key * one server-ipv6 key * a pair consisting of one server-ipv4 key and one server-ipv6 key * one server-name key * one include-delegparam key ======= The fact that names and addresses can't be mixed in a single DELEG record felt like an arbitrary limitation. Especially since a DELEG RRSet can contain a combination of names and addresses (and includes), that will all be used to modify the SLIST on the resolver-side, according to the algorithm in Section 5.1.2. For instance (even if this is not allowed in the current draft), when parsing the RRSet record-by-record, the resulting SLIST from these two RRSets would be the same: ======= test. DELEG server-name=foo.example.com. server-ipv6=2001:db8::53 example. DELEG server-name=foo.example.com. example. DELEG server-ipv6=2001:db8::53 ======= New DelegInfo documents would then need to update the DELEG document or at least create a similar list of DelegInfos allowed with the newly specified DelegInfo. I had a discussion with one of the authors I realized that the draft does not describe the semantics of a single DELEG record, which I see as "A set of named and/or numbered nameservers with the same properties (apart from serving the delegated zone)". When thinking about future DelegInfos, I believe this is the correct interpretation. In the future, when e.g. port is standardized, the following would make sense: ====== test. DELEG server-name=foo.example. server-ipv6=2001:db8::53 port=5400 test. DELEG server-ipv4=192.0.2.1 server-ipv6=2001:db8::5 port=5401 ====== This specifies 4 nameservers for test. at foo.example., 2001:db8::53, 192.0.2.1, 2001:db8::5. Where the first two are reachable on port 5400 and the latter two on 5401. So my suggestion is the following: * A DELEG record is a set of nameservers with the same properties * All DelegInfos, except for include-delegparam are allowed in a single DELEG record * include-delegparam MUST be the only DelegInfo in a DELEG record Note that a "set of nameservers" can be of size 1, where each DELEG record describes a single nameserver (i.e. one address/name, plus other DelegInfos like port or tls-fingerprint). This would make those DELEGs analogous to a mash-up between NS and SVCB. DELEGPARAM will have the same semantics. If the working group and authors agree, I could contribute text to this effect. If the working group and authors have a different idea of the semantics of DELEG records and RRSets, let's discuss. Cheers, Pieter _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
