Johan Ihrén <johani at johani.org> wrote: > On 18 Jan 2015, at 19:15 , Viktor Dukhovni <ietf-dane at dukhovni.org> wrote: > > On Sun, Jan 18, 2015 at 12:28:55AM +0100, Florian Weimer wrote: > >> > >> There are very few strictly-delegation-only zones, and zones change > >> there status over time, so this feature seems fairly risky. The ISC > >> recommendations for BIND make recursors subject to denial-of-service > >> attacks that prevent name resolution for entire TLDs. I don't think turning on root-delegation-only has been recommended by the ISC for years. > > On Sat, Jan 17, 2015 at 10:08:48PM +0000, Viktor Dukhovni wrote: > > > >> Also, how would one configure unbound to use an auto-trust-anchor-file > >> via RFC 5011 for a given gTLD or ccTLD? > > > > Any comment on my second question? If one enables RFC 5011 tracking > > for all the trust anchors one cares about, it is no longer necessary > > to worry about delegation-only above those trust anchors. I don't know of any zones other than the root which promise to follow the RFC 5011 key rollover timing requirements. (And even the root zone does it wrong by not having a standby KSK.) If you want to use RFC 5011 on a TLD you will have to inspect their DNSSEC Practice Statement with care. Tony. -- f.anthony.n.finch <dot at dotat.at> http://dotat.at/ Faeroes, Southeast Iceland: Variable 4 at first except in the west of Southeast Iceland, otherwise southeasterly veering southerly 5 to 7, increasing gale 8 for a time, occasionally severe gale 9 until later in Southeast Iceland. Moderate or rough, becoming very rough or high. Rain or wintry showers. Moderate or good, occasionally poor.