Re: Registry lock - setting statuses on hosts

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Well an update is and update.

And if we are talking about registry lock (in whatever form you do it) i
think that its a form of lock for any changes. And to do the unlock (and
lock), you need some sort of out of band method from EPP to protect the
domain.

And if you would allow a DNSSEC update regardless of lock status, then
this would be a prime target for disabling a domain (Inserting false
DNSSEC records and remove old ones would disable the domain).

This means that to do a key rollover you have to plan ahead, thats true
and it also means that the administration is harder but thats kind of
the point to the lockdown isn't it.

Best regards
jan

On 10/15/2013 12:49 PM, Mark Elkins wrote:
> I'd like to follow up this question with a similar question....
> 
> Should anything be allowed to block an EPP based DNSSEC update?
> 
> ie any type of registry/domain/host whatever lock... only exception
> being ServerHold - which to me is the Registrar has been locked out of
> the Registry System...
> 
> I believe it is "No" - in order to keep DNSSEC updates as simple as
> possible. (KISS).  Even if the Nameservers (and associated) records of a
> domain are no longer being published (In a Delete/Redemption or
> ClientHold) - I think the Registry should still not hinder a DNSSEC
> Update/Key Rollover.
> This could stop a Key-Rollover completing if the DNS Provider can not
> see "DS's" - because Records are not being published - but that is a
> different problem.
> 
> What do registries say/do?
> 
> 
> On Thu, 2013-10-10 at 04:27 +0200, Patrik Fältström wrote:
>> On 10 okt 2013, at 03:45, Stuart Olmstead-Wilcox <[email protected]> wrote:
>>
>>>> Do we actually know exactly what changes are no longer allowed when there is a registry lock?
>>>
>>>> For example, what about DNSSEC material?
>>>
>>> Our initial approach will be to adhere strictly to the serverUpdateProhibited definition.  If set via lock, then no domain updates will be permitted - including DNSSEC material.  
>>>
>>> If this begins to pose a problem in the future (we will be fully epp DNSSEC compliant 1st quarter 2014) we will revisit.
>>
>> Thanks!
>>
>> How do other registries handle registry lock and for example DNSSEC material updates?
>>
>> I.e. it seems to be that a registry lock make key rollover of the KSK for the zone be impossible.
>>
>>    Patrik
>>
>> _______________________________________________
>> provreg mailing list
>> [email protected]
>> https://www.ietf.org/mailman/listinfo/provreg
> 

- -- 
+-------------------------------------------------------------------
! Irial / YASK AB
! Att: Jan Saell
! Box 59, S-692 21 KUMLA, SWEDEN
! Tel: 019-58 25 15     Int +46-19 58 25 15     Fax +46-19 58 38 05
! E-mail: [email protected]
! PGP Fingerprint: E957 23C8 9F51 0958 B9AD  7F18 404A 5DA1 F944 A08B

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlJdQkEACgkQQEpdoflEoIsSkgCghoJkVEuQJXU3jamZEIlOsD0K
jeoAn2PZwBZDDk1sImuqA0KfhNOHSCzx
=cyBl
-----END PGP SIGNATURE-----
_______________________________________________
provreg mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/provreg