<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello,<br>
<br>
The one difference that comes to mind is that NSEC3 doesn't make a
lot sense in the reverse space, as anyone can walk the zones anyway,
so we (LACNIC) will be using NSEC for signed negative responses.<br>
<br>
Other than that, it's pretty much the same. <br>
<br>
regards<br>
<br>
Carlos<br>
<pre class="moz-signature" cols="72">--
Carlos Martinez-Cagnazzo
R+D Engineer
<a class="moz-txt-link-freetext" href="http://www.labs.lacnic.net">http://www.labs.lacnic.net</a>
</pre>
<br>
On 3/6/12 9:34 AM, Olaf Kolkman wrote:
<blockquote
cite="mid:C8B3E996-A9B9-4F69-B778-A456F6DBCDC7@NLnetLabs.nl"
type="cite">
<pre wrap="">
On Mar 6, 2012, at 9:32 AM, Dick Visser wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">Any ideas/policies/bestpratice/rumours about signing reverse DNS zones?
</pre>
</blockquote>
<pre wrap="">
I sign all my reverse zones just as my forward zones - are there any differences?
</pre>
</blockquote>
<pre wrap="">
No, but I since I don't see too much information about it I thought
I'd ask around.
I guess I'm looking for a Best Practices document ;-)
</pre>
</blockquote>
<pre wrap="">
You might want to have a quick look at: <a class="moz-txt-link-freetext" href="http://www.ripe.net/data-tools/dns/dnssec/procedure-for-requesting-dnssec-delegations">http://www.ripe.net/data-tools/dns/dnssec/procedure-for-requesting-dnssec-delegations</a>
But that is more a hook for provisioning than best practices. For operational practices there is not much difference between forward and reverse (as said), except perhaps issues of key-maintenance and administrative exposure, all those tradeoffs are described in <a class="moz-txt-link-freetext" href="http://tools.ietf.org/html/draft-ietf-dnsop-rfc4641bis">http://tools.ietf.org/html/draft-ietf-dnsop-rfc4641bis</a>
--Olaf
________________________________________________________
Olaf M. Kolkman NLnet Labs
<a class="moz-txt-link-freetext" href="http://www.nlnetlabs.nl/">http://www.nlnetlabs.nl/</a>
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Opendnssec-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</a>
<a class="moz-txt-link-freetext" href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user">https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</a>
</pre>
</blockquote>
</body>
</html>