It appears that Philip Homburg <[email protected]> said: >> In the other direction, if you have a delegation point with only >> DELEG, and you sent a response to an old non-aware resolver with >> an authority section that has DELEG and maybe DS and maybe some >> RRSIGs, will resolvers ignore the useless (to them) stuff and treat >> it as NODATA, or barf because the authority section has garbage? >> >> I have no idea, perhaps people have tried it out. >> >> If the answer is NODATA the case for the DE bit is a lot weaker. > >There is a problem with DELEG validation. I don't remember all corner cases, >but DELEG-unaware validating resolvers may conclude bogus if they receive >DELEG records (which they believe is a child-side type) with a parent-side >signature.
If someone knows concretely what the problem is, I'd be interested to hear about it. Resolvers check signatures on records they're going to ignore? That seems odd, although I suppose it's been a corner case that's not well tested. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
