Re: [dnsext] WGLC: draft-ietf-dnsext-dnssec-bis-updates-16

[Mohan Parthasarathy <[e-mail]>]

On Sat, Jan 28, 2012 at 5:43 AM, Mark Andrews <[e-mail]> wrote:
>
> In message <CACU5sD=P-agE2oOqvAiCs=bcX3Off6cCubW-f=[e-mail]>
> , Mohan Parthasarathy writes:
>> On Fri, Jan 27, 2012 at 9:20 PM, Mark Andrews <[e-mail]> wrote:
>> >
>> > In message <[e-mail]=
>> l.com>
>> > , Mohan Parthasarathy writes:
>> >
>> >> - Section 5.7 setting the AD bit on queries. Is CD=0,DO=0 in the que=
>> ry
>> >> same as AD=1,DO=0 ?
>> >
>> > The question doesn't make sense.
>> >
>> > AD=0,DO=1 and AD=1,DO=1 produce the same result.
>> > AD=0,DO=0 and AD=1,DO=0 produce different results.
>> > AD=0,DO=0 and AD=0,DO=1 produce different results.
>> > AD=1,DO=0 and AD=0,DO=1 produce different results.
>> >
>> Thanks for the clarification. I realized after I posted that not
>> setting CD and DO is pre-DNSSEC.
>>
>> >> missed the discussion on this earlier. If there is a valid reason,
>> >> that needs to be stated explicitly as to why we are introducing this
>> >> new option.
>> >
>> > Section 5.7 explains why this option exists.
>> >
>> >                This allows a requestor to indicate that i=
>> t understands
>> >   the AD bit without also requesting DNSSEC data via the DO bit.
>> >
>> >
>> So, "understands" here means "Please do the validation for me " ?
>> Then, is  CD=1, AD=1 a invalid option ?
>
> No.  AD will be 1 if the answer + authority sections come from
> cached data that has validated as secure.  That said I don't think
> there is much use unless you are trying to check if a lookup failure
> was due to DNSSEC errors.
>
Okay.

>> So, there are implementations out there that want to know whether
>> validation was successful or not but just not want to handle any
>> DNSSEC records?
>
> I will put it this way.  I doubt if there is a application that
> cares about AD that *wants* the DNSSEC records.  At the moment they
> have no choice unless they are using the draft.
>
Agreed that those DNSSEC records are not of much use. For
non-validating resolvers, there is now a choice of setting the DO bit
or AD bit and setting both does not make sense. Perhaps, this should
be explained.

>> My question was more on what prompted the addition of this new feature ?
>
> 1. It reduces the response size.
> 2. You can apply DNS64, NXDOMAIN redirection, bad site filtering, etc. with
>   AD=1 which you can't with DO=1.
>
Why does the extra DNSSEC records affect DNS64 ?

If AD=1 seems better for non-validating resolvers, perhaps that should
be recommended in the draft ?

-mohan

>
> Mark
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: [phone]                 INTERNET: [e-mail]