Re: [dnsext] caches, validating resolvers, CD and DO

[Nicholas Weaver <[e-mail]>]

>> Until they strip DNSSEC information.  You MUST validate locally....
> 
> I disagree.  I run a local network in my house and run local caching
> recursive resolvers.  I have all my hosts on my network resolve through
> my local caches.  I run all my machines, therefore I trust my cache.  I
> see no reason to *require* all my machines to bypass the local cache.
> Moreover, in my case I see no reason to require all my machines to
> perform local validation.  I trust myself.
> 
> Therefore, calling it a MUST is wrong.
> 
>> You want the end client to have its own policy on what to do on DNSSEC
>> failure, not be dependent on the resolver's policy, and thus
>> validating clients really should use CD with every request.
> 
> I agree in principle, however that policy can also be "trust the caching
> recursive resolver."  Saying that the client MUST validate does not
> allow for this trusting policy.
> 
> -derek

Good point, however, the default policy should still be a must, since your configuration is rather unusual:  DNSSEC enables DNS to not trust the recursive resolver, and the default policy should take advantage of this.

Defaults should provide maximum safety and maximum interoperability for the majority of the clients.