Re: [dnsext] Possible DNSSECbis clarifications

[Joe Abley <[e-mail]>]

On 2011-03-28, at 16:19, Marc Lampo wrote:

> But then, how to link a RRSIG(SOA) with *its* SOA ?

If there are multiple, different SOAs found in an AXFR response then you throw that response away. RFC 1034 seems fairly clear on that.

  When the poll shows that the zone has changed, then the secondary server
  must request a zone transfer via an AXFR request for the zone.  The AXFR
  may cause an error, such as refused, but normally is answered by a
  sequence of response messages.  The first and last messages must contain
  the data for the top authoritative node of the zone.  Intermediate
  messages carry all of the other RRs from the zone, including both
  authoritative and non-authoritative RRs.  The stream of messages allows
  the secondary to construct a copy of the zone.  Because accuracy is
  essential, TCP or some other reliable protocol must be used for AXFR
  requests.

> Or simply : "try" all available RRSIG(SOA)'s, if at least one validates
> the SOA being looked at, then accept it.

Zero or one RRSIG RRSets over the SOA, one SOA RR and one identical copy of the same SOA record. I don't see a validation problem.


Joe