[Chapter-delegates] DNSSEC-validating resolvers Re: dnssec as a solution to dns poisoning the national dns infrastructure (.ro)

[Dan York]

On Nov 29, 2012, at 1:20 PM, Patrick Vande Walle <patrick at vande-walle.eu> wrote:

> Hello Ed,
> 
> There is nothing that prevents ISPs to deploy DNSSEC-aware resolvers right away, without waiting for Rotld. They would already be able to use DNSSEC for other TLDs than .ro. 
> This is fairly independent from the signing of the TLD.

Indeed this is VERY true! Once the ISPs deploy DNSSEC-validating DNS resolvers, their users will be able to gain the benefit of validating DNSSEC-signed domains from around the world.

In fact, if you can get a number of the ISPs there to deploy DNSSEC-validating resolvers, it may perhaps bring some pressure on the folks behind .ro.  (ex. "Why is it that Romanian users can have a DNSSEC-secured domain in .COM, .ORG, .<whatever>, but they can't have a DNSSEC-signed .RO domain?")

By the way, the folks over at SURFnet put together a great whitepaper about deploying DNSSEC-validating resolvers, including step-by-step instructions for 3 of the common resolvers:

Direct link: http://www.surfnet.nl/Documents/rapport_Deploying_DNSSEC_v20.pdf

My comments: http://www.internetsociety.org/deploy360/resources/deploying-dnssec-validation-on-recursive-caching-name-servers/

Dan

> 
> Regards,
> Patrick
> 
> 
> On 28/11/12 20:40, Eduard Tric wrote:
>> Dan, Peter,
>> Thank you for your feedback.
>> As it has already happened in june with ipv6, Romanian isp's are keen to implement dnssec-aware resolvers ,but cannot do it without Rotld (.ro manager ) cooperation .
>> Regards,
>> Ed


--
Dan York
Senior Content Strategist, Internet Society
york at isoc.org   +1-802-735-1624 
Jabber: york at jabber.isoc.org 
Skype: danyork   http://twitter.com/danyork

http://www.internetsociety.org/deploy360/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://elists.isoc.org/mailman/private/chapter-delegates/attachments/20121129/f58c0471/attachment.htm>