Subject: [DNSOP] special use names and unsecured delegation from the root

From: Suzanne Woolf <[email-masked]>
Date: Thu, 17 Nov 2016 03:00:40 -0500

Hi all,

For those of you who were in the HOMENET WG meeting yesterday, you probably noticed a controversy that’s developed around the proposed .homenet special use name as the default for homenet naming: the working group is considering, among other things, whether its special use name needs an unsecure delegation in the parent zone in order to prevent DNSSEC failures.

If HOMENET is attempting to standardize a single-label special use name (a “TLD”), which is their current plan, this would mean asking IANA for such an unsecure delegation in the root, which may pose process problems. If they want a special use name further down the tree, such as one under .arpa, the unsecure delegation from the parent may still be required, but shouldn’t raise the same process questions.

I’m hereby asking the editors of the DNSOP special use names problem statement document to review that discussion and determine whether it needs to be added to the problem statement. 

It seems to me that it would be very helpful if the problem statement could describe how DNSSEC is relevant to handling of special use names (including those that use DNS resolution protocol but don’t have global scope, or those that aren’t intended to resolve with DNS at all) and under what conditions it can be a problem.

thanks,
Suzanne

---

From: Ted Lemon <[email-masked]>
Date: Thu, 17 Nov 2016 17:43:45 +0900

It's pretty clear that it needs to be added.   I will do so.

On Thu, Nov 17, 2016 at 5:00 PM, Suzanne Woolf <[email-masked]> wrote:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Edward Lewis <[email-masked]>
Date: Thu, 17 Nov 2016 08:55:46 +0000

A clarifying question:

Given that there are 1518 delegations from the root zone, 1369 to zones owning a DNSKEY set, 1358 having a DS record (in the root zone), is DNSSEC a distinguishing factor in this regard?

That is, no other name in the Special-Use Domain Name registry currently is directly delegated from the root zone.  I understand how any delegation would be precedent-setting.

---

From: Ralph Droms <[email-masked]>
Date: Thu, 17 Nov 2016 08:10:08 -0500

Ted, Suzanne - it might be helpful if the text can stand by itself, to post the text to the homenet and snoop WG mailing lists, in addition to adding i too the problem statement.

- Ralph

> On Nov 17, 2016, at 3:43 AM, Ted Lemon <[email-masked]> wrote:
>

---

From: George Michaelson <[email-masked]>
Date: Thu, 17 Nov 2016 23:01:46 +0900

I'm going to tick people off again,

but noting there is a reason you want to do this, and you think its a
justified reason, and you can argue a good case for putting it in a
problem statement, it would be (IMH, Very H opinion) a really bad idea
(tm) to give anyone a sense that .homenet is "just going to happen"
especially if you make people think "because we like them"

Please, if you put references to an emerging PROBLEM (my emphasis) in
homenet calling for a .homenet (or some suitable nonce: really, who
picks these strings? thats part of the problem statement, right?) It
has to be just that: a problem statement, not any statement pleading
the cause, or assuming delegation is going to happen.

I'm not a lawyer. I just think we should observe the kinds of process
we expect people outside the tent to see, if they look inside.

-G