Managing DS records from parent via CDS/CDNSKEY
draft-ogud-dnsop-maintain-ds-00
| Document | Type | Replaced Internet-Draft (dnsop WG) | |
|---|---|---|---|
| Authors | Ólafur Guðmundsson , Paul Wouters | ||
| Last updated | 2015-12-13 (Latest revision 2015-10-15) | ||
| Replaces | draft-ogud-dnsop-ds-remove | ||
| Replaced by | RFC 8078 | ||
| Stream | Internet Engineering Task Force (IETF) | ||
| Intended RFC status | Informational | ||
| Formats |
Expired & archived
plain text
xml
htmlized
pdfized
bibtex
|
||
| Stream | WG state | Adopted by a WG | |
| Document shepherd | Tim Wicinski | ||
| IESG | IESG state | Replaced by draft-ietf-dnsop-maintain-ds | |
| Consensus boilerplate | Unknown | ||
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | "Tim Wicinski" <tjw.ietf@gmail.com> |
https://www.ietf.org/archive/id/draft-ogud-dnsop-maintain-ds-00.txt
Abstract
RFC7344 specifies how DNS trust can be maintained in-band between parent and child. There are two features missing in that specification: initial trust setup and removal of trust anchor. This document addresses both these omissions. Changing a domain's DNSSEC status can be a complicated matter involving many parties. Some of these parties, such as the DNS operator, might not even be known by all organisations involved. The inability to enable or disable DNSSEC via in-band signalling is seen as a problem or liability that prevents DNSSEC adoption at large scale. This document adds a method for in-band signalling of DNSSEC status changes. Initial trust is considered a much harder problem, this document will seek to clarify and simplify the initial acceptance policy.
Authors
Ólafur Guðmundsson
Paul Wouters
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)