When performing secure dynamic update, all zone data modified in a signed zone MUST be signed by a relevant zone key. This completely disassociates authentication of an update request from authentication of the data itself. This proposal leaves this field undefined. This allows the server to verifiably determine the originator of a message. MAY be included in an update message, but MUST NOT be used to authenticate the update request.
All policy is configured by the zone administrator and enforced by the zone's primary name server.
Policy dictates the authorized actions that an authenticated principal can take. Policy checks are based on the principal and the desired action, where the principal is derived from the message signing key and applied to dynamic update messages signed with that key. The server's policy defines criteria which determine if the key used to sign the update is permitted to perform the requested updates. The policy is fully implemented in the primary zone server's configuration for several reasons. Policy is only relevant in the server applying it, so there is no reason to expose it.