On Wed, 1 Jul 2009, Mark Andrews wrote:
Validators shouldn't have to refetch DS records to work
around a broken key rollover.
[ process where everyone co-operates and lives happilly and forever after ]
This is just not going to happen, and any modifications to the validators
should take the real world into account.
records have changed once validation fails. Search for a changed =20
chain of trust.
Agree is this good.
Can you say DoS attack?
It needs to be implemented properly and safely, yes.
Can we stop giving up before we have tried to make this work properly?
We can, but DNS operators in general won't, and so we have to accomodate
that scenario anyway. losing DNS operators can't even run secondary on
gaining DNS operators. And what you're proposing is at least a 4 message
exchange between two entities. It's not going to happen.
Publish a BCP on how to do this. Seller and buyers alike can
offer/request BCP compliance. Failure to follow BCP is not likely
to a seller if they end up in court for deliberately damaging the
property they are selling.
When domains move, there is usually already enough trouble between
Registrant and DNS operator. Not timely cooperating because of "business
priorities" will be impossible to attack in court. So yes, its fairly
easy for the losing DNS operator to give that last kick.
It's like you trashing a house as you move out if you fail to follow the BCP.
It's more like trashing the house you lost in a forclosure. Either way,
you're not seeing the money. You might as well cause some damage.
Paul
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop
