The DNSSEC Negative Trust Anchor (RFC 7646) + EDE 33 (RFC 8914 / draft-farrokhi-dnsop-ede-nta)

[zbalkan]

Any plans or intention to support the DNSSEC Negative Trust Anchor (RFC 7646) + EDE 33 (RFC 8914 / draft-farrokhi-dnsop-ede-nta)? I saw a Quad9 post and thought I may work on it, if it's considered.

[ShreyasZare]

Thanks for asking. NTA is already supported and it is done by creating a Conditional Forwarder zone where the FWD record has "Enable DNSSEC Validation" option unchecked.

The draft-farrokhi-dnsop-ede-nta is still very new so not planning to add it just yet.

[zbalkan]

Thanks for the information.

[zbalkan]

Hi @ShreyasZare,

Sorry to disturb. I found out that some already implemented this change. It is nothing urgent or crucial but it may be worth keeping in the backlog.

• Cloudflare
• BIND
• PowerDNS
• Knot

[ShreyasZare]

Thanks for the response. I usually delay such implementations for new drafts since in the past it had happened a couple of times that the draft got changed which then required working on the same task again. So the delay helps to see if things are stable and wont change later.