Private Space Names
Roy Arends IEPG106

Problem Statement• There are no private names in the DNS.
• Such as “X-headers” MIME types (RFC2045)• Such as Address Allocation for Private Internets (RFC1918)• Such as “x-” subtag in private use language tags (RFC5646)• Such as private use ASNs (RFC6996)• Such as private use DNS RRTypes and DNS RCODES(RFC6895)

Observed Solution Space• ”Register your own name” (not really private)• “Don’t do it” (often heard, doesn’t work)• .INTERNAL (draft-wkumari-dnsop-internal)• .LOCAL (Microsoft Technet Article) RFC6762[...] it is strongly recommended that you use the .local label for theextension. [...]• .ALT (draft-ietf-dnsop-alt-tld)• .HOME (RFC7788)• HOME.ARPA

ITHI dataProposed Solution Space Constraints• Simple and concise BCP• Choose a label WITHOUT a semantic meaninginternal ≠ private ≠ alt ≠ local ≠ home
Too Anglophonic• Choose a label that will never be delegated• Choose a label that may not require RFC6761• Maybe a two character ASCII domain

RFC1591 Domain Name SystemStructure and Delegation
4. Rights to Names
2) Country Codes
The IANA is not in the business of deciding what
is and what is not a country.
The selection of the ISO 3166 list as a basis forcountry code top-level domain names was made withthe knowledge that ISO has a procedure fordetermining which entities should be and should
not be on that list.

ZZ User Assigned
AB Un-assigned
UK Exceptionally reserved
AD Assigned
AN Transitionally reserved
EW Indeterminately reserved

User Assigned
AAQM .. QZ
XA .. XZZZWhat does ISO3166 say about this range?
5.2Construction of the alpha-2 code
The ISO 3166 standard uses combinations in the range AB to QL,
RA to WZ, and YA to ZY.
In addition exactly 42 alpha-2 code elements are not used in theISO 3166, AA, QM to QZ, XA to XZ, ZZ.
8.1
Special Provisions
Users sometimes need to extend or alter the use of country code
elements for special purposes. The following provisions give
guidance for meeting such needs within the framework of thispart of ISO 3166.
8.1.2 User assigned code element
If users need code elements to represent country names notincluded in this part of ISO 3166, the series of letters AA, QM toQZ, XA to XZ, and ZZ are available.

How are User Assigned Codes used elsewhere?
ISO 3901 International Standard Recording CodeReserves “ZZ” for direct registrants independent of anycountry.
ISO 4217 Codes for the representation of currencies
Reserves the “XA” .. “XZ” range for transactions andprecious metals, as they are country independent.
ISO 6166 International securities identification numbering system
Reserves "XS" for securities cleared throughEuroclear/Clearstream.

How are User Assigned Codes used elsewhere?
ICAO International Civil Aviation Organization
Reserves “ZZ” for UN travel documents.
WIPO World Intellectual Property Organization
Reserves 5 User Assigned code elements to identify regional
agencies and patent offices, and allocated "XX" for "Unknown
states, other entities or organizations”.
CA/BForum Certificate Authority and Browser Forum
Reserves "XX" to signify a location not covered by ISO3166-1.
RFC5646 Tags for Identifying Languages
contains a section and examples dedicated to Private UseSub-tags

How are User Assigned Codes used elsewhere?
RFC5646 BCP47: Tags for Identifying Languages
contains a section and examples dedicated to Private Use
Sub-tags.
“For example, the region subtags 'AA', 'ZZ', and those in
the ranges 'QM'-'QZ' and 'XA'-'XZ' (derived from the ISO
3166-1 private use codes) can be used to form a language
tag. A tag such as "zh-Hans-XQ” conveys a great deal ofpublic, interchangeable information about the language
material”

In Conclusion
ISO3166-1 Alpha 2 UA codes are used as intended in various standards
Therefore
ISO3166-1 Alpha 2 UA codes will never be ISO assigned or reserved
Therefore
ISO3166-1 Alpha 2 UA codes will never be delegated
Therefore
ISO3166-1 Alpha 2 UA codes may not need to be RFC6761 reserved
And
ISO3166-1 Alpha 2 UA codes have no semantic meaning

.ZZ

Painting the bike shed*, I suggest*Parkinson's law of triviality

What about DNSSEC? Doesn’t this need anunsigned delegation in the root?
• A validator will validate that .ZZ does not exist.
• This will negate any inserted private space ZZ domain data.
• This is A Good Thing!

• We don’t want to be lied to, without approval.
• A validating (stub) resolver needs a negative trust anchor for .ZZ.
• This is an explicit approval.

• A validating (stub) resolver can have a trust anchor for a signed .ZZ.
• This is even better.
• You’d only trust your own private name space.