Re: [Dnsmasq-discuss] Insecure DS reply received, do upstream DNS servers support DNSSEC?

2019-08-29 Thread Tore Anderson
Hi Simon, > Now, it's certainly possible to verify that the DS record doesn't exist > without relying on the data in the SOA record. BUT there is a problem: > having determined securely that the DS record doesn't exist, dnsmasq > caches that information, and it uses data from the SOA record to > d

Re: [Dnsmasq-discuss] Insecure DS reply received, do upstream DNS servers support DNSSEC?

2019-08-29 Thread Simon Kelley
On 29/08/2019 17:53, Tore Anderson wrote: > Hi Simon, > >> Now, it's certainly possible to verify that the DS record doesn't exist >> without relying on the data in the SOA record. BUT there is a problem: >> having determined securely that the DS record doesn't exist, dnsmasq >> caches that inform