the DO bit Re: [dnsext] Reminder: two WGLC closing in one week

[Edward Lewis <[e-mail]>]

At 10:38 +0200 10/2/08, Florian Weimer wrote:
>* Mark Andrews:
>
>>>  DO necessarily implies UD because the synthesized CNAME is not signed
>>>  and thus not visible to a DNSSEC client (section 3.1).
>>
>>  	DO indicates that you want the DNSSEC records.
>
>DO was originally conceived as "intent to validate".  It's not used
>this way, though.

No, "DO indicates that you want the DNSSEC records" is accurate.

We (= the group that cobbled DNSSEC into BIND 8) stood up a name 
server before the DO bit was invented.  After not hearing from the 
government agency that was funding the work on DNSSEC for a few days 
we realized that something was amiss.  It turned out that we were 
responding to A record requests with responses enlarged by the DNSSEC 
records and the funding agency's firewalls were rejecting all traffic 
to port 53 over a certain size.  This "eating our own dogfood" 
experience led to the DO bit.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                [phone]
NeuStar

Never confuse activity with progress.  Activity pays more.

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>