I want to dispute one part of this: the "DNSSEC may not scale well" part. With thanks to Ray Bellis, APNIC has been running an evldns webserver which signs on the fly, and we have achieved north of 3000 signs/second from this code on a smallish cloud node signing on demand.
Our model was unique domains (the 1x1 ad system) but Ray coded a simple ring buffer and for the repeat queries, there was a demonstrable cache benefit to keeping some amount of signed state live without having to re-sign. I think that on-the-fly DNSSEC for IPv6 is tractable. -George On Wed, Dec 23, 2015 at 5:48 AM, <internet-dra...@ietf.org> wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Domain Name System Operations Working > Group of the IETF. > > Title : Reverse DNS in IPv6 for Internet Service > Providers > Author : Lee Howard > Filename : draft-ietf-dnsop-isp-ip6rdns-01.txt > Pages : 13 > Date : 2015-12-22 > > Abstract: > In IPv4, Internet Service Providers (ISPs) commonly provide IN- > ADDR.ARPA information for their customers by prepopulating the zone > with one PTR record for every available address. This practice does > not scale in IPv6. This document analyzes different approaches and > considerations for ISPs in managing the ip6.arpa zone for IPv6 > address space assigned to many customers. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-dnsop-isp-ip6rdns/ > > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-dnsop-isp-ip6rdns-01 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-isp-ip6rdns-01 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop >
_______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
