Subject: [regext] Transfer of signed domain to registrar that does not support DNSSEC

From: Martin Casanova <[email-masked]>
Date: Thu, 2 Sep 2021 11:39:04 +0200

Hi

Since we have programs in place to push DNSSEC our number of signed
domains is increasing rapidly.

This brings up a old question that we were wondering about how other
registries handle it.

Lets assume a singed domain is being transferred but the new registrar
(still...) does not support DNSSEC and is therefore not able to delete
or modify the DS/KeyData at the registry. In that case the domain can
not be resolved anymore by validating resolvers until the DS/KeyData is
deleted at the registry somehow.

What is your policy/solution for this case? Here I outlined some
possibilities:

- Keeping track (based on login <svcExtension> at login?) which
registrars do DNSSEC and prohibit transfers of singed domains in case
secDNS-1.1 is missing?
  This unnecessarily limits transfers of singed domains to DNSSSEC
unable registrars if the domain was signed via CDS where the domain was
singed by the name-server owner. (no registrar involved)

- Deleting the DS/KeyData when the nameservers changes? (This would
raise further questions..)
- Support ticket of registrar and manual deletion by the registry ?
- ...

Your feedback is appreciated. Thanks!

Martin

-- 
SWITCH 
Martin Casanova, Domain Applications
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland 
phone +41 44 268 15 55, direct +41 44 268 16 25
[email-masked], www.switch.ch

---

From: Kristian Ørmen <[email-masked]>
Date: Thu, 2 Sep 2021 11:00:57 +0100

Hi Martin

Other registries just requires to handle DNSSEC if we still wants to be a registrar in that TLD.

Usually I’m not a fan of more requirements for registrars but DNSSEC has been around for so long.
They don’t need to offer DNSSEC on their own nameservers, they just need to be able to add and delete DS records at the registry own the request of the registrant.

Kind regards
Kristian Ørmen

> On 2 Sep 2021, at 10.39, Martin Casanova <[email-masked]> wrote:
> 
> Hi
> 
> Since we have programs in place to push DNSSEC our number of signed domains is increasing rapidly. 
> 
> This brings up a old question that we were wondering about how other registries handle it. 
> 
> Lets assume a singed domain is being transferred but the new registrar (still...) does not support DNSSEC and is therefore not able to delete or modify the DS/KeyData at the registry. In that case the domain can not be resolved anymore by validating resolvers until the DS/KeyData is deleted at the registry somehow.
> 
> What is your policy/solution for this case? Here I outlined some possibilities:
> 
> - Keeping track (based on login <svcExtension> at login?) which registrars do DNSSEC and prohibit transfers of singed domains in case secDNS-1.1 is missing?
>   This unnecessarily limits transfers of singed domains to DNSSSEC unable registrars if the domain was signed via CDS where the domain was singed by the name-server owner. (no registrar involved)
> 
> - Deleting the DS/KeyData when the nameservers changes? (This would raise further questions..)
> [email-masked] <mailto:[email-masked]>, www.switch.ch <http://www.switch.ch/>_______________________________________________
> regext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/regext

---

From: Tobias Sattler <[email-masked]>
Date: Thu, 2 Sep 2021 12:23:34 +0200

+1

As registrar you should be able to deal with EPP regardless if you offer the services. A support ticket to delete this records is nice-to-have.

> On 2. Sep 2021, at 12:00, Kristian Ørmen <[email-masked] <mailto:[email-masked]>> wrote:
> 
> Hi Martin
> 
>> On 2 Sep 2021, at 10.39, Martin Casanova <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi
>> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/regext <https://www.ietf.org/mailman/listinfo/regext>
> 
> _______________________________________________
> regext mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/regext <https://www.ietf.org/mailman/listinfo/regext>

---

From: Mario Loffredo <[email-masked]>
Date: Thu, 2 Sep 2021 12:36:09 +0200

Hi Martin,

at .it we don't prohibit the transfer of signed domains to registrars 
that dont' provide support for DNSSEC.

The DS records are removed when the nameservers change.

Best,

Mario

Il 02/09/2021 11:39, Martin Casanova ha scritto:
> not be resolved anymore by validating resolvers until the DS/KeyData 
> is deleted at the registry somehow.
>
> unable registrars if the domain was signed via CDS where the domain 
> was singed by the name-server owner. (no registrar involved)
>
> [email-masked],www.switch.ch
>

-- 
Dr. Mario Loffredo
Technological Unit “Digital Innovation”
Institute of Informatics and Telematics (IIT)
National Research Council (CNR)
via G. Moruzzi 1, I-56124 PISA, Italy
Phone: +39.0503153497
Web: http://www.iit.cnr.it/mario.loffredo

---

From: Michael Bauland <[email-masked]>
Date: Thu, 2 Sep 2021 13:40:18 +0200

Hi Martin,

our registry system TANGO does not automatically remove DNSSEC records
in its default setting.

Even when changing name servers I find it a dangerous heuristic to
remove the DNSSEC records. It might just be that the registrar changed
some name servers while keeping DNSSEC active. If the records are
removed automatically, the domain could unexpectedly be unsigned.

If a registrar wants to deactivate DNSSEC, they have to explicitly do
this, either via EPP or by logging into the web interface and manually
removing the DNSSEC records.

Best regards,

Michael

-- 
____________________________________________________________________
     |       |
     | knipp |            Knipp  Medien und Kommunikation GmbH
      -------                    Technologiepark
                                 Martin-Schmeisser-Weg 9
                                 44227 Dortmund
                                 Germany

     Dipl.-Informatiker          Fon:    +49 231 9703-0
                                 Fax:    +49 231 9703-200
     Dr. Michael Bauland         SIP:    [email-masked]
     Software Development        E-mail: [email-masked]

                                 Register Court:
                                 Amtsgericht Dortmund, HRB 13728

                                 Chief Executive Officers:
                                 Dietmar Knipp, Elmar Knipp

---

From: Iliya Bazlyankov <[email-masked]>
Date: Thu, 02 Sep 2021 14:59:04 +0300

Hi Martin,In case of transfer to a registrar that does not support DNSSEC, our REGISTRIO platform does remove DNSSEC records from the domain. In case of just changed nameservers, we keep the records.Kind regards,Iliya Bazlyankov | Domain ExpertEDOMS+359899991690 Bulgaria+380636908345 [email-masked] | [email-masked]
-------- Оригинално съобщение --------От: Martin Casanova <[email-masked]> Дата: 2.09.21 г.  12:39  (GMT+02:00) До: [email-masked] Тема: [regext] Transfer of signed domain to registrar that does not support DNSSEC 
    Hi
    
    Since we have programs in place to push DNSSEC our number of
      signed domains is increasing rapidly. 
    
    This brings up a old question that we were wondering about how
      other registries handle it. 
    
    Lets assume a singed domain is being transferred but the new
      registrar (still...) does not support DNSSEC and is therefore not
      able to delete or modify the DS/KeyData at the registry. In that
      case the domain can not be resolved anymore by validating
      resolvers until the DS/KeyData is deleted at the registry somehow.
    What is your policy/solution for this case? Here I outlined some
      possibilities:
    
    - Keeping track (based on login <svcExtension> at login?)
      which registrars do DNSSEC and prohibit transfers of singed
      domains in case secDNS-1.1 is missing?
        This unnecessarily limits transfers of singed domains to DNSSSEC
      unable registrars if the domain was signed via CDS where the
      domain was singed by the name-server owner. (no registrar
      involved)
    
    - Deleting the DS/KeyData when the nameservers changes? (This
      would raise further questions..)
      - Support ticket of registrar and manual deletion by the registry
      ?
      - ...

    
    Martin

---

From: "Patrick Mevzek" <[email-masked]>
Date: Thu, 02 Sep 2021 10:11:29 -0500

> deleted at the registry somehow.

More precisely, things will continue to work as long as the nameservers
continue to publish the relevant DNSKEY. By itself a change of registrar
does not change anything, except
- if the registrar was also the DNS provider then it will stop provide
DNS resolution (typically), hence customer has to change providers, and then
its domain will start to fail DNSSEC validation as the current keys won't
be at new provider
- the customer won't be able to manage its KSK rotations if it can't
provide new ones through registrar to push to registry.

Note also RFC 8063 "Key Relay Mapping for the Extensible Provisioning Protocol" that
touches these subjects. AFAIK only "nl" registry implemented it.

> - Support ticket of registrar and manual deletion by the registry ?

All these cases exist in the wild indeed, which may show that there
is no one size fits all situation here.

Plus at least:

- registrars need to be specifically "accredited" for DNSSEC in advance, through 
a separate test; hence the registry knows which ones are DNSSEC-"enabled"
and which one aren't, and hence at time of transfer the registry can deny
the transfer from DNSSEC enabled to NON DNSSEC enabled
- the transfer command has an extension with an attribute "keepDS" for example
to tell the registry if it should keep or drop the current DS records once
the transfer is finished (note also that for some other registries,
the transfer command is extended so that the registrar has to provide the
new nameservers at that moment, and hence it can provoke immediate side effects
regarding DNS resolution and DNSSEC validation)
- and also, not at the technical level, the agreement signed by registrar
may force it to support DNSSEC... it is like that in gTLD world, see https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en : "Registrar must allow its customers to use DNSSEC upon request by relaying orders to add, remove or change public key material (e.g., DNSKEY or DS resource records) on behalf of customers to the Registries that support DNSSEC."

-- 
  Patrick Mevzek
  [email-masked]

---

From: Antoin Verschuren <[email-masked]>
Date: Thu, 2 Sep 2021 22:41:01 +0200

Policy wise, I would keep the DS intact in a transfer or NS change, so that all non-DNSSEC-capable registrars would soon disappear. ;-)
Since a transfer does not change NS records nor DNSKEY records, it’s not the transfer that breaks the domain, but a subsequent NS change to a new dns-provider..

A minimal requirement for a registrar is that he is capable of administratively removing the old DS record at the registry before changing the NS, just as he is obliged to maintain the other data on behalf of the registrant. What would you do with a registrar that “does not support contact address changes”?
If the new registrar cannot handle that, he is not worthy. Let him swim ;-)

- -- 
Antoin Verschuren
no-hats

> Op 2 sep. 2021, om 11:39 heeft Martin Casanova <[email-masked]> het volgende geschreven:
> 
> Hi
>