Perhaps clear use of the verbs MUST, SHOULD, MAY, COULD… Simon > On 28 Jul 2026, at 10:19, Bill Woodcock <[email protected]> wrote: > > > >>> On Jul 28, 2026, at 14:38, Ondřej Surý <[email protected]> wrote: >>> >>>> On 27. 7. 2026, at 07:54, Bill Woodcock <[email protected]> wrote: >>> >>> >>> >>>> On Jul 20, 2026, at 17:55, Stephane Bortzmeyer >>>> <[email protected]> wrote: >>>> https://datatracker.ietf.org/doc/draft-bortzmeyer-dnsop-poisonlicious/ >>> >>> I strongly support the effort, but would prefer DoT to be mandatory, and >>> DANE authentication to be preferred over TSIG, when available. >> >> I strongly believe the security mechanism should be a matter of local policy >> (and implementation defaults) rather than something enforced by the Internet >> Standard. >> >> So far, the DNS does not even enforce a secure transport and/or >> authentication >> for XFRs, so enforcing DoT/DANE/whatever for something that is going to be >> mostly used on internal networks feels over the top. > > Sorry, I should have said DoQ/DoT; force of habit. > > I hear you, but I think that as long as we make security optional, a lot of > people won’t bother, and then a lot of people writing code won’t prioritize > it, and then it won’t work when it’s needed. Whereas if everything is as > secure as our current standards facilitate, all the time, we only have a > single build target and test case and the most-sensitive traffic doesn’t have > a target painted on its back. > > Why should HTTP be secure-by-default, but DNS not? > > -Bill > > _______________________________________________ > DNSOP mailing list -- [email protected] > To unsubscribe send an email to [email protected] > <signature.asc>
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
