IETF Logo Mail Archive

Re: [dane] Behavior in the face of no answer?

Paul Wouters <paul@nohats.ca> Thu, 03 May 2012 23:25 UTC

Return-Path: <paul@nohats.ca>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5764221F8711 for <dane@ietfa.amsl.com>; Thu, 3 May 2012 16:25:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.527
X-Spam-Level:
X-Spam-Status: No, score=-0.527 tagged_above=-999 required=5 tests=[AWL=0.008, BAYES_00=-2.599, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, HOST_MISMATCH_COM=0.311, RDNS_DYNAMIC=0.1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IBiW-neIyHNk for <dane@ietfa.amsl.com>; Thu, 3 May 2012 16:25:38 -0700 (PDT)
Received: from letoams.cypherpunks.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) by ietfa.amsl.com (Postfix) with ESMTP id C408E21F870F for <dane@ietf.org>; Thu, 3 May 2012 16:25:38 -0700 (PDT)
Received: by letoams.cypherpunks.ca (Postfix, from userid 500) id A8DC7855F6; Thu, 3 May 2012 19:25:37 -0400 (EDT)
Received: from localhost (localhost [127.0.0.1]) by letoams.cypherpunks.ca (Postfix) with ESMTP id 9EBF7803A3; Thu, 3 May 2012 19:25:37 -0400 (EDT)
Date: Thu, 3 May 2012 19:25:37 -0400 (EDT)
From: Paul Wouters <paul@nohats.ca>
To: Martin Rex <mrex@sap.com>
In-Reply-To: <201205032303.q43N3ZB7009975@fs4113.wdf.sap.corp>
Message-ID: <alpine.LFD.2.02.1205031921240.31092@bofh.nohats.ca>
References: <201205032303.q43N3ZB7009975@fs4113.wdf.sap.corp>
User-Agent: Alpine 2.02 (LFD 1266 2009-07-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: dane@ietf.org
Subject: Re: [dane] Behavior in the face of no answer?
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 May 2012 23:25:39 -0000

On Fri, 4 May 2012, Martin Rex wrote:

> Is there any reliable data on the availability of 100% correctness
> of DNSSEC records from places with full&transparent internet
> connectivity to DNSSEC-capable recursive DNS resolvers?

I've been running my laptop with dnssec-trigger+unbound for a long
time now, and it is pretty good. There are some networks where DNS is
too broken, but the port 80 or tls443 fallback via unbound to trusted
fedoraproject.org resolvers is working remarkably well to even getadnssec
data on those networks - though at times the dns over tls is too slow
and the website gives an error.

However, some more automation and userfriendliness on the hotspot
handling is needed.

Paul

v2.8.7 | Report a Bug | By Email