[dnsext] caches, validating resolvers, CD and DO

[Mark Andrews <[e-mail]>]

I don't think we have the sematics of these bits quite right
yet.  In normal operations a validating resolver taking to
a cache should just set DO.  This will result in DNSSEC records
being returned and in most cases these will validate.  This
also permits caches to do their jobs correctly.

When these do not validate or SERVFAIL is returned, the validating
resolver should then re-issue the query with CD set and a EDNS
option indicating which upstream servers have been tried.  This
option is initially empty.  The cache will then behave as a proxy
for this query (excluding the EDNS option) adding the responding
server's address to the EDNS option.  If there are no more addresses
to try, SERVFAIL (new rcode?) is returned along with the EDNS option
from the query.

If the cache is using another cache the entire query/response is
proxied.  The intent is for the validating client to talk through
intermediate caches to the cache talk directly to the authoritative
servers.  The EDNS option maintains a list of authoritative server
addresses for the zone that have been tried.  This list is passed
back and forth between the validating resolver and the cache talking
to the authoritative server.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE:	[phone]		         INTERNET: [e-mail]