Re: [dnsext] caches, validating resolvers, CD and DO

[Michael Richardson <[e-mail]>]

Paul Vixie <vixie <at> isc.org> writes:
> the wire change i would like is wholly different.  since clients should
> not need to add caches when they add validation, i'd like the chain of
> rrsig and dnskey to be sent from the recursive server to the stub,
> everything it takes to validate the answer.  to do this, a new EDNS
> option would allow the client to express its closest trust point.  so if
> the client already knows (in a current-transaction cache that is not
> shared with other applications or transactions on the client host) it
> has a valid dnskey for google.com and it's asking for www.google.com
> then the only RRSIGs or DS/DNSKEY's it needs are for www.google.com
> and www.l.google.com.

I'd like to see this too.
A place where I think this is super useful with is lldns/bonjour, for the 
adhoc disconnected case.  I claim to be bob.exaqmple.com on the wire, and 
when I do that I include the chain of rrsig/dnskey from . (or whatever anchor 
point you say you already have).