[DNSOP] Re: Disclosure of Negative Trust Anchors in DNS Resp onses (draft-farrokhi-dnsop-ede-nta-00)

On Wed, Jun 17, 2026 at 6:48 AM, Joe Abley <
[email protected]> wrote:

> Hi all,
>
> Babak, Sebastiaan and I put pen to paper and came up with the following:
>
> https://datatracker.ietf.org/doc/draft-farrokhi-dnsop-ede-nta/
>
> https://github.com/farrokhi/id-ede-nta (working copy)
>
> The goal is to provide guidance about using a specific Extended DNS Error
> as an in-band signal that a Negative Trust Anchor is in effect in a
> resolver.
>

My initial response when reading this was somewhere between "Ugh, waste of
space" and outrage… but after thinking abut this for a bit it's possible
that it might actually be one of the best ideas ever.

I suspect that my initial irritation was actually driven by the fact that I
didn't think of it first :-)
W


It was inspired by the somewhat recent events with DE and the reaction to
> those events in 9.9.9.9 and 1.1.1.1.
>
> We now have a code-point assigned for the EDE (33), and implementation is
> planned in 1.1.1.1.
>
> This document is at most an informational document to act as a reference
> for the code-point assignment. It could be an individual submission; we
> don't necessarily see a need to engage the working group bureaucracy.
> However, the people on this list have a keen eye for detail and we would
> love to get some more review. If you have a chance to take a look, we'd
> appreciate it.
>
> Thanks,
>
> Joe
> _______________________________________________
> DNSOP mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
>

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]