Getting Nameservers in the New Delegation Protocol

Introduction The DELEG Working Group is choosing a base protocol for "a new DNS signaling mechanism that allows parents to return additional DNS delegation information about their children". This document specifies how that information will appear in the new resource records from the base protocol, and what resolvers that receive those records will do with them. According to the working group charter, after it has chosen the base protocol, it will specify "new DNS authoritative signaling mechanisms for alternative DNS transports". of this document gives some ideas for what those extensions might include, and how they related to the mechanisms in this document.

Assumptions about the Eventual Base Protocol The WG is making a choice between (called "W" here) and (called "H" here). W and H are quite different in their requirements for operation of the new delegation mechanism. W and H agree on using the same display and wire format as SVCB for records returned to the resolver in delegation responses. In SVCB, the first field in the RR is called the "SvcPriority", and different values cause the resolver to go into "AliasMode" or "ServiceMode". The result of using this field in resolution is a set of "alternative endpoints". The second field is called "TargetName". The third field is optional, and is called "SvcParams"; it has a lot of sub-fields, some of which are useful for the DNS delegation use cases. In order to not confuse this with specifics that W (DELEG) and H (IDELEG) gave beyond the base protocol, the new record type returned in delegation responses is called "DD" here. (Of course, the name can be whatever the WG chooses in the eventual base protocol.) DD has different semantics from SVCB because SCVB assumed a base protocol of HTTPS. W gives different names to values for the first field in the RR, and for sub-fields in the optional third field. Other names from W and H and SVCB are renamed here for clarity; the eventual names might be completely different. The base protocol will allow for later extensions in the third field. Those extensions might reuse entries in the IANA SVCB registry, they might add new extensions to that registry, or there might be a new registry for the DD record.

BCP 14 Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Getting Nameserver Names for a Zone The goal of the DELEG Working Group effort is to give resolvers a better way create a set of nameservers for a zone when making DNS queries to authoritative servers. For both W and H, when a resolver makes a query that gets a delegation response, the resolver may get back one or more DD records and NS records that it can further process to create the set of nameservers for the zone. This eventual set of nameservers can be called the "DDN"; this is quite different from the set of DD records it received). In DD, the first field can be thought of as indicating the action to find names for the DDN other than the NS records that might be at the apex, using the second field as a domain name where to look. The first field can be called "DDA" and the second "DDW". THe third fied, which holds metadata about the DDW, can be called "DDM" Both W and H agree that a DDA of value 0 means an action like "find the DDN elsewhere based on the value in the DDW", and a value of 1 means something like "the name in DDW is an entry in DDN". Thus, when a resolver receives one or more DD records with a DDA of 0, it needs to do more processing. When it receives one or more DD records with a DDA of 1, it takes the DDW from those records and puts them into the DDN (possibly with additional information from the DDM, such as from ).

How a Resolver Processes the DD Record What action does a resolver take when it gets a DDA of 0? When talking about the DELEG Working Group work beyond the base protocol, W and H have similar but different actions for finding eventual additions to the DDN. W and H follow chains of CNAME, DNAME, and SVCB records, with some limits to prevent loops or excessive processing. %% The previous sentence might be wrong; it's the best I could determine from the drafts. %% Is the addition to the DDN different if following a DDA of 0 leads to signed vs. unsigned responses? Asked another way, if the DDN contains some results that were signed and some that were unsigned, does the DDN become an ordered list or are the unsigned results discarded? The resolver [[ MAY / SHOULD / SHOULD NOT / MUST / MUST NOT ]] use the NS records that were returned with the query to expand the DDN. (If SHOULD or SHOULD NOT is chosen by the WG, the exceptions need to be listed.) Can the DD RRset contain records with different values for DDA? SVCB says no, but W and H say yes (but differently).

Addresses and Transports According to the working group charter, after it has chosen the base protocol, it will specify "new DNS authoritative signaling mechanisms for alternative DNS transports". This section has some brief ideas about what those might entail and what questions might need to be answered.

Addresses The third field in the DD record will have a subfield to indicate the IPv4 and IPv6 address(es) associated with the DDW. The subfield can be called "DDI". Can a DD with a DDA of 0 have a DDI in the record? In SVCB they cannot, but the SVCB spec allows other specs to allow them. Is the value for the DDI a single address or potentially a list? If the former, how are multiple DDs with the same DDA and DDW combined? What happens if some of the discovered name/address pairs have different addresses? Does that disagreement in the DDN cause the removal of something from the DDN?

Transports The third field in the DD record will have a subfield to indicate the transport(s) associated with the DDW. The subfield can be called "DDT". Can a DD with a DDA of 0 have a DDT in the record? In SVCB they cannot, but the SVCB spec allows other specs to allow them. Some specific DNS transports will be allowed or required with DDT. Which secure transport(s), if any, will be mandory to implement? Does supporting both TLS and QUIC make operational or security sense? Does supporting DOH make operational or security sense if other secure transport is allowed? If either or both TLS and DoH are allowed, which versions of TLS are allowed? Does Do53 need to be specified every time it is available?

Authentication of Secure Transports How will clients deal with authenticating TLS? Should they just use the web PKI pile of CAs, or will something else be specified? Should certificates with IP addresses be supported? Should clients ignore PKIX Extended Key Usage settings? Should clients fall back to unauthenticated encrypted transport, all the way to Do53, or fail to resolve?

IANA Considerations %% There may be IANA considerations when the working group finishes this work. %%

Security Considerations %% There will certainly be security considerations when the working group finishes this work. %%