> On 27. 7. 2026, at 07:54, Bill Woodcock <[email protected]> wrote: > > > >> On Jul 20, 2026, at 17:55, Stephane Bortzmeyer >> <[email protected]> wrote: >> https://datatracker.ietf.org/doc/draft-bortzmeyer-dnsop-poisonlicious/ > > I strongly support the effort, but would prefer DoT to be mandatory, and DANE > authentication to be preferred over TSIG, when available.
I strongly believe the security mechanism should be a matter of local policy (and implementation defaults) rather than something enforced by the Internet Standard. So far, the DNS does not even enforce a secure transport and/or authentication for XFRs, so enforcing DoT/DANE/whatever for something that is going to be mostly used on internal networks feels over the top. Ondrej -- Ondřej Surý (He/Him) [email protected] A gentle nudge is always appreciated if I take a little longer to reply. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
