Thanks for the explanation, Philip! > On 4 Aug 2026, at 13:29, Philip Homburg <[email protected]> wrote: > >> If anyone >> is aware of tests demonstrating DNSSEC validation failures >> without DE, I'd be interested to see them. > > I tried this a long time ago with a server that would always return DELEG > records independent of the DE flag. > >> As for DELEG records with a parent-side signature: In absence >> of an NS RRset (and corresponding proof of absence), the legacy >> validating resolver is not aware that it is looking at a delegation >> point. As a result, it does not apply any special delegation >> semantics to the DELEG RRset. Instead, it treats DELEG as an >> unknown authoritative RR type in the responding zone and validates >> its RRSIG in the usual way for an unknown RR type. >> >> I'm happy to be proven otherwise. However, it is independent of >> the discussion about DELEXT being too restrictive. > > Assume a nameserver ns.example.com, it serves two zones, example.com and > child.example.com. Example.com has delegations to child.example.com with > both NS and DELEG. Both example.com and child.example.com are DNSSEC signed. > > A legacy DNSSEC validating resolver is asked to resolve > child.example.com/DELEG. Because it is a legacy resolver it expects to find > the DELEG record at the apex of child.example.com. It send a query to > ns.example.com because that server is authoritative for child.example.com. > > ns.example.com is DELEG-aware and responds to the query with the > child.example.com/DELEG RRset as well as the (parent side) signatures. > > The resolver expects signatures from child.example.com and not the > parent-side signatures that it got and concludes bogus.
Yes! Thank you for enlightening me, and I stand corrected. You’ve provided a genuine scenario where the DE flag prevents a validating resolver from declaring a response bogus. Roy
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
