<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br>
<div><br><div>On Dec 29, 2022, at 16:34, Timothe Litt <litt@acm.org> wrote:</div><br><div><snip></div><br>Yup, Eric's case was a classic example. He tried to do the right
thing, put in the wrong record, and the system didn't produce the
expected results. To his credit, he persisted. Most people
don't. A while ago there was a study (<a moz-do-not-send="true" href="https://blog.cloudflare.com/automatically-provision-and-maintain-dnssec/">cloudflare/APNIC</a>)
that showed that about only about 40% of people who enabled DNSSEC
for their accounts successfully served DS records in their
registry.<br></div><div><br></div><div></snip></div><div><br></div><div>The really annoying part is it isn’t obvious that they want the public key and not the result of dnssec-dsfromkey; they do it themselves. The annoying part is they throw an error if the key isn’t valid Base64 (think spaces or newlines), but gladly accept the DS output from dnssec-dsfromkey. Somehow or another they are getting the key tag from the incorrect DS record, because they encode again the already encoded string.</div><div><br></div><div>I looked in the docs for boto3 (the official API for AWS) and there appears no way to add a public key so you can’t do it programmatically.</div><div><br></div><div>I’ll have to pass that on to my AWS contacts. Doubt they’ll do anything but it is worth throwing it over the fence.</div><div><br></div><div>Again, thanks for all the help!</div><div><br></div><div>Eric</div><div><br></div></body></html>