Re: [dane] Behavior in the face of no answer?

[Nicholas Weaver <[e-mail]>]

On May 15, 2012, at 12:32 PM, Warren Kumari wrote:
> This may be my fault -- a long time back (in this thread) I proposed having implmentations  default to not-strict and then, in a few years (once there is less DNSSEC breakage by CPE, etc), vendors would turn the knob to strict mode. Educated / security concious users would also be able to turn the knob if they so  desired.
> 
> This was just an idea, and perhaps a bad one!

CPE bugs should be regarded as "Forever Day".

Instead, any client-side DNSSEC application must take pains to both map the brokenness and be prepared to work around it, including: bypassing the configured recursive resolver to use a DNSSEC passing external resolver or just fetching directly, switching to TCP, and even connecting to DNSSEC passing resolvers which are configured to use a non-standard port.