%% You should probably cite rfc8078 instead of this I-D. @techreport{ietf-dnsop-maintain-ds-02, number = {draft-ietf-dnsop-maintain-ds-02}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-ietf-dnsop-maintain-ds/02/}, author = {Ólafur Guðmundsson and Paul Wouters}, title = {{Managing DS records from parent via CDS/CDNSKEY}}, pagetotal = 8, year = 2016, month = apr, day = 4, abstract = {RFC7344 specifies how DNS trust can be partially maintained in-band between parent and child. There are two features missing in that specification: initial trust setup and removal of trust anchor. This document addresses both these omissions. Changing a domain's DNSSEC status can be a complicated matter involving multiple unrelated parties. Some of these parties, such as the DNS operator, might not even be known by all organizations involved. The inability to disable DNSSEC via in-band signalling is seen as a problem or liability that prevents some DNSSEC adoption at large scale. This document adds a method for in-band signalling of this DNSSEC status changes. Initial trust is considered a much harder problem, this document will seek to clarify and simplify the initial acceptance policy.}, }