>>>>> "DT" == Dave Taht <[email protected]> writes:
DT> As one example of a registrar not with the program, name.com DT> (registrar for bufferbloat.net) does not allow for ds records to DT> come from it, so that domain can't be fully signed. DT> So it sounds to me as if negative proofs are not possible with DT> registrars that lack this support? No. Signed parent zones (like com, net, org) always provide either a signed DS record if it exists or proof of non-existance. Try doing: dig @i.gtld-servers.net. bufferbloat.net ds +dnssec The two nsec3 records (each signed by an rrsig record) prove that there is no DS record in net. with the name bufferbloat.net. Compare that with what you get asking for ns records: That replies with the two ns records, as well as the proof that the DS records do not exist. Now, try with a zone which is signed: dig @i.gtld-servers.net. jhcloos.net ns +dnssec dig @i.gtld-servers.net. jhcloos.net ds +dnssec The first returns both the ns and ds records, with an rrsig over the ds records (returned in the authority section); the latter returns the signed ds records in the answer section and net's own signed ns set in the authority section. Given that some zones have nameservers which fail to respond if they do not like or understand the query, it seems that only root-down verifi- cation can work. Unless I'm missing something.... -JimC -- James Cloos <[email protected]> OpenPGP: 0x997A9F17ED7DAEA6 _______________________________________________ Cerowrt-devel mailing list [email protected] https://lists.bufferbloat.net/listinfo/cerowrt-devel
