<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>body{font-family:Helvetica,Arial;font-size:13px}</style>
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
Erwin,</div>
<div id="bloop_sign_1515114766742752000" class="bloop_sign"><br>
</div>
<div id="bloop_sign_1515114766742752000" class="bloop_sign">On January 4, 2018 at 2:33:17 PM, Erwin Lansing (<a href="mailto:erwin@dk-hostmaster.dk">erwin@dk-hostmaster.dk</a>) wrote:</div>
<div>
<blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">
<span>
<div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space;">
<div></div>
<div>
<div>I’ll add to that corporate culture: when DNS fails, the message from higher up will be “Make it work”, not “Make it work The Right Way”. </div>
</div>
</div>
</span></blockquote>
</div>
<p>Agreed. </p>
<div>
<div>
<blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">
<span>
<div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space;">
<div>
<div>On a side note, my biggest fear has been those people/SMBs that buy a black box for some reason, which also does DNS, and has DNSSEC turned on by default, plug in into their network and forget about it, rather than, say, people that know DNS, but not really
about DNSSEC. In all your outreach, have you noticed that to be the case, or is it more e.g. service providers, where someone flipped the switch and promptly forgot about it, or something else?</div>
</div>
</div>
</span></blockquote>
</div>
<p>I share this concern, but TBH, from my experience in the outreach I was involved with personally, the response was bimodal, either:</p>
<p>A) boredom, having to listen to yet another talk on stuff they’d already dealt with (e.g., NANOGs, RIPE meetings, etc)</p>
<p>- or -</p>
<p>B) incomprehension, not even knowing what the letters DNS stand for. (e.g., CIO/CTO forums, non-technical venues)</p>
<p>The reality is that finding the right people to speak to to ensure resolvers are properly configured for the KSK rollover turns out to be quite hard.</p>
<div>
<div>
<div>
<blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">
<span>
<div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space;">
<div>I have not heard anyone question the security DNSSEC provides or that postponing a rollover is reducing its security. </div>
</div>
</span></blockquote>
</div>
<p>I’ve heard the former. I’ve yet to hear the latter except from a handful of people directly involved in DNSSEC deployment efforts.</p>
<div>
<blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">
<span>
<div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space;">
<div>Both postponing the rollover and doing a rollover with significant fallout, will add more fuel to the fire for those who feel DNSSEC is not a viable solution from an operational viewpoint. All that to say, and I’m playing devils advocate here, at some
point we do need to bite the bullet and do the rollover, because to keep postponing it is yet another signal that DNSSEC is not production ready.</div>
</div>
</span></blockquote>
</div>
</div>
<div>
<p>To be very clear, we don’t want to continue postponing. What we’re looking for is for the community to tell us in the ICANN Org how to move forward. We were surprised with the 8145 data (i.e., that we were actually getting data and the number of misconfigurations
we were seeing were as high as they were). We’ve done a bit of analysis and from what little we’ve been able to ascertain, there doesn’t appear to be anything fundamentally broken with the architecture or implementations, rather misconfiguration happens. This
isn’t surprising. However, now that we know concretely there will be brokenness, how much is the community willing to tolerate (and what metrics can we use to ensure we’re below that threshold).</p>
<p>Regards,</p>
<p>-drc</p>
<p><br>
</p>
</div>
</div>
</div>
</body>
</html>