Post #2328933
2026-05-09 13:37 UTC
@jpmens@mastodon.social proactive mitigation idea: permanent NTAs for zones that you are sure are not, and will not be, signed. But I'm not sure if the (signed) referrals (NS RRs) of the parent would work once they have expired
Replies (2)
-
@winfried@fosstodon.org 2026-05-09 14:25
@jpmens@mastodon.social but I read that it's not common practice to sign referrals. https://datatracker.ietf.org/doc/html/rfc4035#appendix-B.5
-
@jpmens@mastodon.social 2026-05-09 15:40
@winfried@fosstodon.org it sounds to me like you are repurposing NTA to re-invent a DS. ;-) I don’t think that’s terribly productive, particularly as signed NS RRsets are rare, iirc, at least until DELEG is done.