Hi Keith,
Your solution makes more sense.
Thanks.
On Tue, Oct 8, 2019 at 2:20 AM Keith Moore
<moore(_at_)network-heretics(_dot_)com>
wrote:
On 10/7/19 4:37 PM, Viruthagiri Thirumavalavan wrote:
If you can figure out a backward compatible way for authoritative DNS
servers to signal that they support DoT without a lot of performance loss
(e.g., a failed probe to port 853 on every query to a non-DoT server), a
lot of people over in dnsop would like to hear about it.
How about adding a prefix or label just like our solution for the
authoritative DNS servers that support DoT?
ns1.example.com => dot-ns1.example.com OR _dot.ns1.example.com
I was thinking more in terms of a new DNS RR type:
example.com DOTNS ns1.example.com
And change DNS servers to return DOTNS records as additional information
in the same circumstances as they return NS records.
That way the DOTNS records get automatically discovered in exactly the
same way that NS records do.
Of course you want the DOTNS records to be signed with DNSSEC but this is
less of a problem for RRs in TLD and SLD zones than it is for DNS zones in
general.
Keith
--
Best Regards,
Viruthagiri Thirumavalavan
Dombox, Inc.
_______________________________________________
ietf-smtp mailing list
ietf-smtp(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf-smtp