>Again, the question is whether unexpected DELEG in the answer is likely to >break delegation processing in existing resolver code. From other >messages it sounds like the answer is no, which makes me wonder what the >value of the DE bit is.
I think the following statements are all true: - validating resolvers are allowed to validate records in the authority section of a reply (I think it is stronger than that, but may is enough). - validation of a DELEG RRset by a legacy resolver may lead to DNSSEC bogus (see my reply to Roy's question). - there is no requirement for validating resolvers to scrub the authority section before validation. My conclusion is that without the DE bit we have a protocol that may lead to DNSSEC bogus for perfectly valid replies. I think that is bad protocol design that should be avoided. It is possible that no validator in the world would do this. But I think it is important to have a consistent DNSSEC protocol that does not lead to failures if you just follow what is allowed by the protocol. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
