On Tue, 4 Aug 2026, Philip Homburg wrote:
There are two aspects here: - A resolver may receive a DELEG record in the answer section. For example as a result of query for the DELEG type.
Sure, and the DE bit shouldn't make any difference.
- DNSSEC validation resolvers can cache DNSSEC valid RRsets. For example, the resolver may not need a DS RRset right now. But it can update it's cache when it gets one and use it during validation.
Again, the question is whether unexpected DELEG in the answer is likely to break delegation processing in existing resolver code. From other messages it sounds like the answer is no, which makes me wonder what the value of the DE bit is.
Regards, John Levine, [email protected], Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. https://jl.ly _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
