Re: Protection of unsecured delegations

[Randy Bush <randy@psg.com>]

> The strongest argument I have heard against OPT-in is that
> "OPT-in removes the protection of the innocent get with DNSSEC".

not exactly.  it has been generally phrased as

    it changes the basic security model of dnssec from a secure signed
    zone to a collection of signed and unsigned rrsets, and we do not
    _fully_ understand the implications of this from the security pov,
    but some security folk have expressed serious concern.

your message does explore some of the implications.  but i hope smb and
others will express their concerns so that i can understand them.

randy


to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.