Subject: Re: [homenet] WGLC on draft-ietf-homenet-dot-09

From: Mark Andrews <[email-masked]>
Date: Mon, 10 Jul 2017 12:48:27 +1000

You can have signed delegations (in signed zones) and unsigned
delegations (in unsigned zones).

Signed delegations come in 2 flavours.
* Secure (NS and DS record present with matching NSEC/NSEC3 record + RRSIGs
  for DS and NSEC/NSEC3 record).

home.arpa.	IN	NSEC	as112.arpa. NS DS RRSIG NSEC

* INSecure (NS records, DS record NOT present, NSEC/NSEC3(optout=0/1)
  or covering NSEC3 record (outout=1) with RRSIGs for NSEC/NSEC3 record).

home.arpa.	IN	NSEC	as112.arpa. NS RRSIG NSEC

Unsigned delegations
* NS records present.  DS records shouldn't be present.  NSEC/NSEC3 should
not be present. RRSIGs should not be present.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]