5 ms·

But DNSSEC in root zones isn't unique to .nz. .au, .us, .com, .net, .gov, .io, etc all have the same challenges.

alfons_foobar 3y ago
TLDs, not root zones ;) The root zone is atop the DNS hierarchy and is usually denoted by a single dot, it contains all the top-level-domains.
mcesch 3y ago
Outsourcing isn't a panacea. `.au` is outsourced to Identity Digital (formerly Afilias) and they managed to flub their configuration recently too[1]. 1. https://www.auda.org.au/statement/au-domain-name-system-update https://www.auda.org.au/statement/au-domain-name-system-upda...
throw0101c 3y ago
.ca as well: > This DNSSEC Practice Statement (“DPS”) is a statement of security practices and provisions made by the Canadian Internet Registration Authority (CIRA). These practices and provisions are applied in conjunction with DNS Security Extensions (DNSSEC) in the Canadian country-code Top Level Domain (ccTLD), .CA. > This DPS conforms to the template included in RFC 6841 . The approach described here is modelled closely on the corresponding procedures published in a corresponding DNSSEC Policy and Practice Statement published by .SE (The Internet Infrastructure Foundation) for the Swedish top-level domain, whose pioneering work in DNSSEC deployment is acknowledged. * https://www.cira.ca/en/resources/documents/domains/cira-dnssec-practice-statement-for-ca/ https://www.cira.ca/en/resources/documents/domains/cira-dnss... To provide a means for stakeholders to evaluate the strength and security of the DNSSEC chain of trust, an entity operating a DNSSEC- enabled zone may publish a DNSSEC Practice Statement (DPS), comprising statements describing critical security controls and procedures relevant for scrutinizing the trustworthiness of the system. The DPS may also identify any of the DNSSEC Policies (DPs) it supports, explaining how it meets their requirements. * https://datatracker.ietf.org/doc/html/rfc6841 https://datatracker.ietf.org/doc/html/rfc6841

TLDs, not root zones ;) The root zone is atop the DNS hierarchy and is usually denoted by a single dot, it contains all the top-level-domains.

mcesch 3y ago

Outsourcing isn't a panacea. `.au` is outsourced to Identity Digital (formerly Afilias) and they managed to flub their configuration recently too[1]. 1. https://www.auda.org.au/statement/au-domain-name-system-update https://www.auda.org.au/statement/au-domain-name-system-upda...

throw0101c 3y ago

.ca as well: > This DNSSEC Practice Statement (“DPS”) is a statement of security practices and provisions made by the Canadian Internet Registration Authority (CIRA). These practices and provisions are applied in conjunction with DNS Security Extensions (DNSSEC) in the Canadian country-code Top Level Domain (ccTLD), .CA. > This DPS conforms to the template included in RFC 6841 . The approach described here is modelled closely on the corresponding procedures published in a corresponding DNSSEC Policy and Practice Statement published by .SE (The Internet Infrastructure Foundation) for the Swedish top-level domain, whose pioneering work in DNSSEC deployment is acknowledged. * https://www.cira.ca/en/resources/documents/domains/cira-dnssec-practice-statement-for-ca/ https://www.cira.ca/en/resources/documents/domains/cira-dnss... To provide a means for stakeholders to evaluate the strength and security of the DNSSEC chain of trust, an entity operating a DNSSEC- enabled zone may publish a DNSSEC Practice Statement (DPS), comprising statements describing critical security controls and procedures relevant for scrutinizing the trustworthiness of the system. The DPS may also identify any of the DNSSEC Policies (DPs) it supports, explaining how it meets their requirements. * https://datatracker.ietf.org/doc/html/rfc6841 https://datatracker.ietf.org/doc/html/rfc6841