Skip to content

Added Objectives Section #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
edwardlewisicann wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Added Objectives Section #21

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions draft-dnsop-deleg.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,6 +178,16 @@ The primary goal of the DELEG records is to provide zone owners a way to signal

The DELEG record is authoritative in the parent zone and if signed has to be signed with the key of the parent zone. The target of an alias record is an SVCB record that exists and can be signed in the zone it is pointed at, including the child zone.

## Success factors

Objectives of the DELEG design are listed in this section. The list may change over time as the mission may expand or contract.

Objective 1 : Replace the functionality of the NS and DS resource record sets and enhance by including full transport service address information (e.g., TCP's port number), including glue records, and other information related to consulting a different DNS server. The purpose of this objective is to support seamless modification of the DNS protocol.

Objective 2 : Expose the role of DNS operations, enabling a zone administrator to make use of multiple DNS providers who may have different operational policies. This supports having multiple providers for resoliency and stability in steady state and the ability to transition from one provider to another during a transitional state. The purpose of the objective to identify DNS operators enables the use of security credentials to automatically update delegation information, such as new name servers, new DNSSEC keys, etc.

Objective 3 : Denote when the delegation is an administrative boundary, that is, a delegation to a different zone administration. The purpose of this objective is to support applications that need to know whether to extend security policies to a subzone, such as web cookies.
Copy link
Contributor

@bemasc bemasc Dec 7, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the first I've heard of this objective for DELEG. I also haven't heard of a plan to meet this need.

For "web cookie" use cases, the essential problem is that the ultimate client doesn't perform its own iterative resolution, so any metadata about zone cuts within the name is ordinarily lost before DNS resolution results reach the browser. We could potentially develop a way for an iterative resolver to enrich its response with metadata about the zone cuts, but we haven't done that yet.

This seems like something that might be enabled by DELEG but does not need to be part of the core specification, and can be added later using SvcParams.


# DELEG Record Type

The SVCB record allows for two types of records, the AliasMode and the ServiceMode. The DELEG record takes advantage of both and each will be described below in depth. The wire format of and the registry for the DELEG record is the same as SVCB record defined in {{?RFC9460}}
Expand Down