Re: Question about TSIG, AD/AA, and AXFR

[Jakob Schlyter <[e-mail]>]

On Tue, 17 Jul 2001, Edward Lewis wrote:

> From you message it sounds like no one should trust data with the AA bit,
> as this means the authentication has not been checked.  This is an ironic
> conclusion, as we've been assigning more credibility to AA'd data.  (Once
> again, the credibility vs. authenticated issue arises.)

the nameserver should never set the AD bit without actually verifying the
data. some earlier version of bind did set AD if the server itself were
authorative. I belive this is wrong - data shouldn't be checked on load,
it should be checked on query.

I think the AA-bit could be trustworthy for very simple resolvers that,
for some reason, do trust their local resolver.

	jakob



to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.