Re: [dbound] [art] Related Domains By DNS (RDBD) Draft

[Stephen Farrell <[e-mail]>]

On 26/02/2019 15:54, John R Levine wrote:
>>
> 
> Once again, if you have the record pointing at the secondary, what does
> the signature get you?  If you can hack the pointer record, you can hack
> the signature verification key, so they're equivalent.

Not quite equivalent in all cases, no. It could be that
an application has a copy of the public key from earlier
and so can verify the signature without needing to fetch
the public key. Or, perhaps the primary has DNSSEC but
the 2ndary doesn't.

So there are cases where a signature can add some value
I think. That said, I wouldn't try oversell the value of
such signatures - as you say, if neither has DNSSEC and
the application is retrieving values at run-time with no
other way of verifying the public key, then there is very
little additional benefit in the signature.

Cheers,
S.