Hi Philip, > On 4 May 2026, at 12:48, Philip Homburg <[email protected]> wrote: > >> Dear dnsop WG, >> >> the authors of the document said the document is ready for the WGLC >> and the dnsop WG chairs have considered the discussions on the >> mailing list and the state the document and we consider the document >> to be ready for the WGLC. Hence this message starts a WG Last Call >> for: draft-ietf-dnsop-delext-02 > > In my opinion this draft is not ready. > > As far as I can tell, this draft can lead to DNSSEC failures. > > For example, a DNSSEC validator that is not a resursive resolver could > implement this draft. The validator will notice the ADT bit in a DNSKEY > and for a query type in this range expects either a RRset or a denial > that the type does not exist in the parent zone.
That is correct. > However, if the validator forwards to a recursive resolver that does not > implement this draft then the recursive resolver will return a proof that > the record does not exist in the child zone. This wil lead to a DNSSEC > failure. That is correct. I will add the following text: XX. Operational Considerations A Validating Stub Resolver that is Delegation Extension aware MUST only use security-aware resolvers that are Delegation Extension aware. A Delegation Extension aware Validating Resolver that uses forwarders MUST only use Delegation Extension aware and security-aware forwarders. Otherwise DNSSEC-secure zones might fail to validate and DNSSEC-insecure zones might observe inconsistent answers. Thanks for the feedback! Warmly, Roy _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
