Subject: dnssec-protocol ISSUE: permit DNSKEY's at all owner names

From: Simon Josefsson <[email-masked]>
Date: Tue, 22 Jun 2004 11:10:15 +0200

DNSKEY's are forbidden at delegation points, for unclear reasons.

name: Simon Josefsson
email: [email-masked]
Date: 22 June 2004
Reference: http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg01150.html
Type: T
Priority: W

Document: draft-ietf-dnsext-dnssec-protocol-06
Section: 2.1

Rationale/Explanation of issue:

DNSKEY's are disallowed at delegation points in DNSSEC-bis:

   DNSKEY RRs MUST NOT appear at delegation points.

I propose to remove this requirement, as I haven't seen a technical
motivation for it.  If there indeed is a technical motivation, I think
it should be stated in connection with the requirement.

See the URL above for more discussion.

This issue was resolved, I believe, the way I proposed, when this was
discussed for the KEY record.  It appears as if the decision was
reverted in DNSSEC-bis.  See:

http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg01158.html

Requested change:

Drop sentence from section 2.1:

  DNSKEY RRs MUST NOT appear at delegation points.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>