It appears that Steve Atkins <[email protected]> said: >So delivering mail signed with mldsa44 requires working DNS over TCP, at >recursive resolvers and authoritative servers “everywhere”, >or at least every recursive resolver used by a mailserver. And their >associated packet filters and firewalls.
Yup. >Am I missing something? If not, do we mention this explicitly anywhere? No, you're not missing anything but we're a sideshow. Down the virtual hall in DNSOP they're having a similar discussion about PQ DNSSEC signatures. Verisign has a proposal to make a Merkle tree out of all of the signatures. That lets the record contain a moderate sized hash, but it makes signing and verifying orders of magnitude more complex compared to the current checking one signature at a time. There is considerable disagreement about how well DNS over TCP works. It mostly works but there is a long tail of ancient devices and middle boxes, and a lot of opinions about how long and how important the tail is. My guess is that they'll eventually bite the bullet and say that TCP support, which has always been nominally required is now really required, but it'll take a while. R's, John _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
