Re: [dane] Behavior in the face of no answer?

[Paul Wouters <[e-mail]>]

On Fri, 4 May 2012, Andrew Sullivan wrote:

> I believe it is possible to get a useful response that has nothing in
> the Answer, Authority, and Additional sections only if you trust your
> upstream, you trust the connection somehow, you set CD=0, and you get
> AD=1 on the response.  In that case, I believe it is a legitimate
> NODATA response (though I don't know of any implementation that works
> this way), and it is validated.

How many months until Rogers (or OpenDNS, or...) starts spitting out AD=1
on their DNS rewriting schemes?

>From RFC3655:

    The AD bit SHOULD be used by the local resolver if and only if it has
    been explicitly configured to trust the remote resolver.  The AD bit
    SHOULD be ignored when the recursive name server is not trusted.

So your scenario really only happens when you bring up a VPN and connect
back to a trusted network. At that point, you can trust the AD bit, but
you also no longer have DNS breakage/filtering happening, so the point
is moot.

The other scenario is an application talking to the local resolver that
returns the AD bit, which just moves the DNS connectivity problem from the
application to the local resolver, but runs into the same hard/soft
fail issue, except the browser knows even less about the reasons for
the failure or success, and can give less feedback to the user to make
an educated guess as to the severity of the failure to be hard or soft.

Regardless, all of this is not DANE specific, and IMHO does not belong
in the DANE document.

Paul