Subject: Re: [dnsext] draft-barwood-dnsext-dns-transport-signal-00 to WG work item

From: Shane Kerr <[email-masked]>
Date: Thu, 01 Oct 2009 09:41:18 +0200

All,

On Wed, 2009-09-30 at 11:06 -0700, Matthew Dempsky wrote:
> On Wed, Sep 30, 2009 at 10:53 AM, Paul Vixie <[email-masked]> wrote:
> >> Date: Wed, 30 Sep 2009 10:31:57 -0700
> >> From: Matthew Dempsky <[email-masked]>
> >>
> >> Is your concern that these newly suggested records shouldn't be stored
> >> under example.com but instead under ns{1,2,3,...}.example.com, or that
> >> parent servers should not need to know about or serve these new records?
> >
> > both, though i'd say that if we have a new NSCAP RR located adjacent to
> > the A/AAAA RRs, then this should be returned as glue in delegations, so
> > as to prevent anybody from having to look up these new RRsets.  in that
> > sense, there is a change in behaviour at the parent, even though it's in
> > the nameserver behaviour and not in the zone content itself.
> 
> Okay, I concur with this then.

Me too. I didn't intend that any additional records "live" in the
parent, like DS records.

I still think it would be nice to have a way for glue (or DS records) to
be automatically updated somehow.

--
Shane

---

From: Olaf Kolkman <[email-masked]>
Date: Thu, 1 Oct 2009 09:45:16 +0200

> the nameserver behaviour and not in the zone content itself.

Hmm,  If you follow this path the provisioner of the zone would need  
to obtain up-to-date data from the name server operator's environment  
and keep it consistent. I haven't been talking to some of my secondary  
server operators for years and I am sure they upgraded the nameserver  
software, nameservers's OS, firewalls and other network components.

--Olaf

________________________________________________________

Olaf M. Kolkman                        NLnet Labs
                                        Science Park 140,
http://www.nlnetlabs.nl/               1098 XG Amsterdam

---

From: "George Barwood" <[email-masked]>
Date: Thu, 1 Oct 2009 11:36:09 +0100

----- Original Message ----- 
From: "Olaf Kolkman" <[email-masked]>
To: "Paul Vixie" <[email-masked]>
Cc: "namedroppers" <[email-masked]>
Sent: Thursday, October 01, 2009 8:45 AM
Subject: Re: [dnsext] draft-barwood-dnsext-dns-transport-signal-00 to WG work item 

> software, nameservers's OS, firewalls and other network components.

The normal situation where you are using a name server not under
your direct control is for the name server to be out-of-zone, and therefore
glue A, AAAA and TPORT records do not apply. The parent zone has

example.com. NS ns1.example.net.

If the name server is in-zone, then it should be under your control,
and you are responsible for supplying and maintaining correct glue
in the parent zone. The parent zone has

example.com. NS ns1.example.com.
example.com. A    192.0.2.5
example.com. TPORT UDP TCP QRP SCTP

Only name server operators have to be concerned with this stuff.
So I don't think there is a problem here, unless I have mis-understood you.
HTH,
George

---

From: Jim Reid <[email-masked]>
Date: Thu, 1 Oct 2009 12:07:17 +0100

On 1 Oct 2009, at 11:36, George Barwood wrote:

> your direct control is for the name server to be out-of-zone, and  
> therefore glue A, AAAA and TPORT records do not apply.

Rubbish! It is very common to have in-bailwick names for a zone's name  
servers, even when few or any of them are under the direct control of  
the zone owner.

> The parent zone has

This suggested use of TPORT is a bad idea because it further  
complicates zone cut semantics.