Re: CNAME/DNAME - Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

[Michael StJohns <[e-mail]>]

At 12:44 PM 10/13/2008, Edward Lewis wrote:
>At 12:30 -0400 10/13/08, Michael StJohns wrote:
>>Hi Ed -
>>
>>I agree that you can determine the security state of X and the security
>>state of Y by examining trust anchors, dlv etc.  But that's not the question.
>>The question is "What is the security state of the compound answer XY?"
>
>The security state - in the eyes of DNS that is easy.  If the X passes the DNSSEC test, Y passes the test as being unsigned, and Z passes the DNSSEC test, the answer is "AD."  IOW, there's nothing suspicious about the result as far as the DNS is concerned.

You sure about that answer?  Pretend all you're doing is looking up Y.  Since Y is UNSECURE,  shouldn't you get an answer with the AD bit cleared? So shouldn't the compound answer also clear the AD bit?

Let's go a bit further.  Let's say that the validating intermediate resolver queried without the CD bit set gets SECURE, UNSECURE and BOGUS for the three legs of the triad.  Should it return the SECURE and UNSECURE parts and also do a SERVFAIL?  RFC 4035 - 5.5 is unclear on this:


>5.5.  Resolver Behavior When Signatures Do Not Validate
>
>   If for whatever reason none of the RRSIGs can be validated, the
>   response SHOULD be considered BAD.  If the validation was being done
>   to service a recursive query, the name server MUST return RCODE 2 to
>   the originating client. 

*SOME* of the RRSIGs can be validated... *sigh*  Does the response still return an RCODE 2?




>It's fair to ask though "what's the value" of piecemeal checking.  My answer is that "it's out of scope" for DNS.