Re: [dnsext] caches, validating resolvers, CD and DO

[Edward Lewis <[e-mail]>]

For those only reading the mail list (i.e., not attending the 
in-person meeting), can you give some context to this?  I suspect 
this is a follow on to a meeting discussion.

At 17:23 +1100 3/30/11, Mark Andrews wrote:
>I don't think we have the sematics of these bits quite right
>yet.  In normal operations a validating resolver taking to
>a cache should just set DO.  This will result in DNSSEC records
>being returned and in most cases these will validate.  This
>also permits caches to do their jobs correctly.
>
>When these do not validate or SERVFAIL is returned, the validating
>resolver should then re-issue the query with CD set and a EDNS
>option indicating which upstream servers have been tried.  This
>option is initially empty.  The cache will then behave as a proxy
>for this query (excluding the EDNS option) adding the responding
>server's address to the EDNS option.  If there are no more addresses
>to try, SERVFAIL (new rcode?) is returned along with the EDNS option
>from the query.
>
>If the cache is using another cache the entire query/response is
>proxied.  The intent is for the validating client to talk through
>intermediate caches to the cache talk directly to the authoritative
>servers.  The EDNS option maintains a list of authoritative server
>addresses for the zone that have been tried.  This list is passed
>back and forth between the validating resolver and the cache talking
>to the authoritative server.
>
>Mark
>--
>Mark Andrews, ISC
>1 Seymour St., Dundas Valley, NSW 2117, Australia
>PHONE:	[phone]		         INTERNET: [e-mail]
>_______________________________________________
>dnsext mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/dnsext

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"