[dns-wg] DNSSEC Provisioning for ERX Space Held with APNIC

Hi Shane,

> Does the update check that a given DOMAIN object is actually secure
> before accepting a "ds-rdata:" field? Or is there any warning or other
> indication on the reply from the RIPE database?
There are two things. One is that we only accept the ds-rdata once we have the
OK from the RIR receiving that space that they can support it. This is what this
announcement was about. So if you would try to submit ERX domain objects for
space with for instance AfriNIC the database would refuse the ds-rdata there
because AfriNIC does not yet support it.

The other thing is that the delegation checker like for any other delegation
checks if the ds-rdata (at least one of them) corresponds to a DNSKEY in that zone.

Cheers,
W