Re: Example of stupid inconsistencies between registries
Peter Koch <[email protected]>
| Newsgroups | gmane.ietf.provreg |
|---|---|
| Message-ID | <[email protected]> |
Patrik,
> According to RFC 5910, section 4, there are two alternative interfaces for managing DNSSEC key data when interfacing with a registry. The RFC does not explicitly say whether a registry must implement one or the other.
exactly, this is an improvement over its predecessor RFC 4310 that mandated DS.
> I just encountered a registry that "want to set a limit on what digest algorithms to use" and to do that, they have decided to not implement the DS interface and only support the KEY interface.
Some registries have decided to operate on DNSKEY rather than DS. It appears
reasonable to me to reflect this in the provisioning protocol.
This is exactly not an EPP inconsistency, because EPP is policy neutral here
and can thus well be used for either way.
-Peter
PS: for "full disclosure": DENIC does not use EPP and we do DNSSEC provisioning
based on the DNSKEY RRSet only
_______________________________________________
provreg mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/provreg