Re: [dnsext] caches, validating resolvers, CD and DO

[Paul Vixie <[e-mail]>]

> From: Mark Andrews <[e-mail]>
> Date: Wed, 30 Mar 2011 19:10:29 +1100
> 
> DO=1 is ALL you require to do your own authentication 99.99999999%
> of the time.

as long as you're planning to ignore the AD bit, sure.  but i still think
that we should be able to ask the recursive validator for a longer chain
since the transaction-level cache will otherwise have to be built up over
many round trips.

> CD=0 DOES NOT mean you are not authenticating.

so noted.

> A validating resolver with direct access to the athoritative servers
> can work around a number of operational errors by being able to retry
> the query with different servers.

i'd like to consider the validating nonrecursive noncaching case first,
since that's the closest analogue to how dns works today.  if i'm in a
hotel room or coffee shop behind NAT and/or firewall and the only UDP/53
destination i can reach is the isp's recursive caching dnssec-aware name
server then i'd like to be able to get everything i need for trustworthiness
of an answer (www.yourbankhere.com IN AAAA) in a single round trip.

> A validating resolver behind a cache does not have this recovery
> path.  The EDNS option is designed to give it that recovery path.

i think that any state held in the validating nonrecursive noncaching
initiator that has to do with the authority servers would be a mistake.