Re: [dnsext] caches, validating resolvers, CD and DO

[Derek Atkins <[e-mail]>]

Nicholas Weaver <[e-mail]> writes:

> On Mar 30, 2011, at 8:22 AM, Mark Andrews wrote:
>>> OH GOD NO!
>>> 
>>> The problem is that the forwarding or caching nameservers are a security =
>>> disaster.  They lie, cheat, and manipulate results with reckless =
>>> abandon. =20
>> 
>> And w/ dnssec you detect this.
>
> Until they strip DNSSEC information.  You MUST validate locally....

I disagree.  I run a local network in my house and run local caching
recursive resolvers.  I have all my hosts on my network resolve through
my local caches.  I run all my machines, therefore I trust my cache.  I
see no reason to *require* all my machines to bypass the local cache.
Moreover, in my case I see no reason to require all my machines to
perform local validation.  I trust myself.

Therefore, calling it a MUST is wrong.

> You want the end client to have its own policy on what to do on DNSSEC
> failure, not be dependent on the resolver's policy, and thus
> validating clients really should use CD with every request.

I agree in principle, however that policy can also be "trust the caching
recursive resolver."  Saying that the client MUST validate does not
allow for this trusting policy.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [e-mail]                        PGP key available