Re: [dane] Behavior in the face of no answer?

[Warren Kumari <[e-mail]>]

On May 15, 2012, at 3:57 PM, Nicholas Weaver wrote:

> 
> On May 15, 2012, at 12:32 PM, Warren Kumari wrote:
>> This may be my fault -- a long time back (in this thread) I proposed having implmentations  default to not-strict and then, in a few years (once there is less DNSSEC breakage by CPE, etc), vendors would turn the knob to strict mode. Educated / security concious users would also be able to turn the knob if they so  desired.
>> 
>> This was just an idea, and perhaps a bad one!
> 
> CPE bugs should be regarded as "Forever Day".

Yes, there are likely to be broken CPE for a really long time, but a: the percentage should be dropping over time (years) and b: other brokenness should also be decreasing over time.

> 
> Instead, any client-side DNSSEC application must take pains to both map the brokenness and be prepared to work around it, including: bypassing the configured recursive resolver to use a DNSSEC passing external resolver or just fetching directly, switching to TCP, and even connecting to DNSSEC passing resolvers which are configured to use a non-standard port.

These are all options, but way outside of what we can (or should) describe in this document…

W