On 8/5/2014 6:27 PM, Viktor Dukhovni wrote: > It is when authentication is then used *only* with peers that > publish TLSA RRs and not with peers that don't. My point was/is that reliance on DNSSec means that there is an INDEPENDENT authentication hierarchy. Taking a look at the entire 'system' that DANE is part of, the authentication is NOT only between peers. Use DANE without DNSSec, and calling it opportunistic probably makes sense. Using it with DNSSec and it doesn't. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net