Subject: Re: NIC-SE statement regarding NSEC zone walking

From: Johan Ihren <[email-masked]>
Date: Wed, 02 Jun 2004 00:30:44 +0200

Stephane Bortzmeyer <[email-masked]> writes:

>>     NIC-SE does not consider NXT zone-walking a problem for DNSSEC
>>     deployment within the .se-zone.  We consider all data in the
>>     DNS to be public information, both as single records and as a
>>     collection.
> ...
>> Just in case that it wasn't clear from my earlier mai. This is the
>> position of SIDN as well for the nl-zone.
>
> Just by curiosity: why all name servers for ".se" or ".nl" prevent
> AXFR, then?

Not speaking for either TLD in any way my guess would be that they
consider the DNSSEC advantages outweighing the disadvantages. I.e. if
they easily and to zero cost can prevent zone transfers (by
disallowing AXFR) they'll do it, but they're not willing to pay the
percieved higher price of not doing DNSSEC to achive that limited
effect.

And, in the end, that has to be the sort of justification that every
single zone has to make for themselves. I think it would be naïve to
assume that DNSSEC will be the right answer for everyone. 

For some zones the key management will be considered too expensive,
for others it will not.

For some zones (clearly) zone walking is percieved to be a
showstopper, for others it is not.

For some zones the increased child-parent interaction will be a major
problem, for some it's worth it.

Etc. Etc.

The DNSSEC design will cater to this (more or less), although I'd be
the first to admit the importance of having as many TLDs as possible
"on board". But I do not think it is realistic to assume, or even hope
for, participation by every TLD on the Internet. 

Some TLDs will decide not to do DNSSEC regardless of any new rounds of
protocol work. So the question is more one of "who" rather than "if".

Johan Ihrén
Autonomica

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>