[DNSOP] Re: Client authentication for encrypted DNS — interest check

On Sat, 11 Jul 2026, Bill Woodcock wrote:
>> On Jul 10, 2026, at 16:47, Shumon Huque <[email protected]> wrote:
>>  I am also fairly skeptical about solutions like this being "generally" useful for client auth, due to the very low penetration of DNSSEC deployment (though it could be one option amongst a set of solutions that cover a wider range of use cases). The spec above was designed for specific scenarios where the parties have deployed DNSSEC infrastructure available. And there is some level of interest (we just got recently pinged by some Email folks about this).
>
> Agreeing with Shumon,
>
> Everyone doesn’t need a safe at home.  But some people do.  So we have safes, and they’re allowed to be in people’s homes.
>
> Everyone doesn’t need security.  But some people need security.  So I find the oft-repeated argument that everyone doesn’t need it, so therefore no one should be allowed to have it, particularly tedious.

Agreed.  Also, related to a previous message, we have all the tools we 
need to do this.  I think that a client cert with a private CA signing the 
certs is likely to work better than TLSA (doesn't need DNSSEC, server 
check is easier, just look for its own CA) but that's a detail.

For the somewhat similar job of authenticating mail submission, I have 20 
year old patches to qmail that do the same thing, look for a client cert 
with a private CA signature.  We don't need to invent anything.

R's,
John

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]