On Mon, 24 Aug 2026, Philip Homburg wrote:
A problem with DELEG is that if a nameserver that is not DELEG-aware serves
a DNSSEC signed zone with DELEG records then this will cause failures.
So DELEXT is supposed to provide a solution to this problem for future
types (after DELEG), we cannot fix the current situation.
We could decide DELEG is not the solution we were looking for, and look
at a better redesign of DNS transport and child-parent information
authentication and fold in native encryption and packet/signature sizes
for PQ etc.
It feels to me DELEG / DELEXT is adding a lot of complexity for what is
ultimately a small use case (let DNS hosters update DNSSEC KSKs) to the
point where perhaps a DNS v2.0 from scratch would be better.
To me if feels the DELEG path is becoming more and more a stack of nifty
hacks.
Paul
_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]
