Re: Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2013-02-06 Thread Mark Andrews
In message 201302062107.r16l7f9b066...@calcite.rhyolite.com, Vernon Schryver All of that gets back to honesty being the best policy and letting other people fix their own stuff in their own time. And the more people that validate the bigger the peer presure will be to fix dnssec problems

Re: Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2013-02-06 Thread Mark Andrews
In message 201302070048.r170mosg004...@calcite.rhyolite.com, Vernon Schryver writes: My view is that if an outfit has so few other users that it doesn't hear when things breaks and doesn't care enough to monitor, then it's not worth my time to be a pest. By time I notice a problem with a

Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2013-02-05 Thread Augie Schwer
Is there a way to exclude a domain from DNSSEC validation, like Unbound's domain-insecure? For example if a popular site ( say nasa.gov ) updates their keys incorrectly so that their domain fails validation, you contact their admins. and with a high level of confidence you determine

Re: Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2013-02-05 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, 2013-02-05 at 17:01 -0800, Augie Schwer wrote: Is there a way to exclude a domain from DNSSEC validation, like Unbound's domain-insecure? I have not tested this, but if you use RPZ to block the DS record for nasa.gov, that should turn

Re: Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2012-04-30 Thread Chris Thompson
On Apr 30 2012, Warren Kumari wrote: On Apr 26, 2012, at 2:51 PM, Jan-Piet Mens wrote: [...] From a Comcast talk at SATIN 2012 I believe they called that a negative trust anchor, and IIRC, the author wanted to publish a draft of its operation. Haven't seen it yet though, and it's probably off

Re: Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2012-04-30 Thread Gilles Massen
On 30/4/12 13:56 , Chris Thompson wrote: http://tools.ietf.org/html/draft-livingood-negative-trust-anchors-01 Being actively discussed on DNSOP list It *was* being actively discussed there, up until about 10 days ago. Since then the participants seem to have stopped, maybe from sheer

Re: Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2012-04-29 Thread Warren Kumari
On Apr 26, 2012, at 2:51 PM, Jan-Piet Mens wrote: Augie, Is there a way to exclude a domain from DNSSEC validation, like Unbound's domain-insecure? That is regrettably not possible at the moment, at least not in BIND 9.9.0. The only (quite impracticable) workaround would be to define

Re: Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2012-04-27 Thread Tony Finch
Jan-Piet Mens jpmens@gmail.com wrote: From a Comcast talk at SATIN 2012 I believe they called that a negative trust anchor, and IIRC, the author wanted to publish a draft of its operation. http://tools.ietf.org/html/draft-livingood-negative-trust-anchors There has been a lot of

Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2012-04-26 Thread Augie Schwer
Is there a way to exclude a domain from DNSSEC validation, like Unbound's domain-insecure? For example if a popular site ( say nasa.gov ) updates their keys incorrectly so that their domain fails validation, you contact their admins. and with a high level of confidence you determine

Re: Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2012-04-26 Thread Jan-Piet Mens
Augie, Is there a way to exclude a domain from DNSSEC validation, like Unbound's domain-insecure? That is regrettably not possible at the moment, at least not in BIND 9.9.0. The only (quite impracticable) workaround would be to define the zone authoritatively yourself and populate it somehow

Re: Exclude a domain from DNSSEC validation, like Unbound's domain-insecure.

2012-04-26 Thread Fr34k
26, 2012 2:51 PM Subject: Re: Exclude a domain from DNSSEC validation, like Unbound's domain-insecure. Augie, Is there a way to exclude a domain from DNSSEC validation, like Unbound's domain-insecure? That is regrettably not possible at the moment, at least not in BIND 9.9.0. The only (quite