Re: Example of stupid inconsistencies between registries

Frederico A C Neves <[email protected]> Thu, 8 Mar 2012 21:52:38 -0300

Newsgroups	gmane.ietf.provreg
Message-ID	<[email protected]>

On Thu, Mar 08, 2012 at 09:16:04AM +0100, Peter Koch wrote:
...
> In your scenario any DNSKEY that would end up in the registry db
> would have to be present at the apex at the time of registration,
> which prohibits pre-publication of a DS RR for a DNSKEY not yet
> present at the apex DNSKEY RRSet.

Which basically proofs that the DNSKEY interface is not suitable for
pre-publications too. Remember the purpose of this is to not
pre-expose the public-key, so why show it to your registry.

So plain DS, without DNSKEY fetch and check, is the only suitable
interface for this corner case scenario.

...
> -Peter

Fred
_______________________________________________
provreg mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/provreg