Subject: Opt-in for insecure delegations only

From: Greg Hudson <[email-masked]>
Date: Mon, 14 Jan 2002 14:00:13 -0500

So, let's say we accept Olaf's proposal to allow opt-in only at
insecure delegation points.  That is, you MUST have NXT records for
all data you are authoritative for, and you MAY have NXT records for
insecure delegations.  The lack of the opt-in bit indicates that
you're using NXT records for insecure delegations, and thus protects
against insertion of insecure delegations in most domains.

Verisign should be happy because they can incrementally sign .com.
Even if the .com servers could accept a four- to six-fold increase in
the size of the zone, it seems technically superior to allow the
largest zones to expand smoothly.

The rest of us should all be happy because authoritative data gets
signed on zone cuts.  The only data which you can opt out of signing
is an insecure delegation, which kicks you out of the protected world
anyway.

So what's left to argue about?

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.