Re: DNSSEC - Signature Only vs the MX/A issue.

[Mike StJohns <[e-mail]>]

At 03:47 PM 11/28/2006, Stephane Bortzmeyer wrote:
>On Tue, Nov 28, 2006 at 03:13:50PM -0500,
>  Mike StJohns <[e-mail]> wrote
>  a message of 25 lines which said:
>
> > Not exactly.  See my previous note to Mark.  SO still protects the
> > atomicity of an RRSet - you can delete ALL of the SRV records or
> > none of them.  If you delete all of them at a label, the lookup
> > fails and you can't proceed.
>
>See Peter Koch's reply :-) Many protocols define a fallback outside of
>the RRset. For instance, in
>http://mirrors.isc.org/pub/www.watersprings.org/pub/id/draft-andrews-http-srv-01.txt,
>there is a fallback from SRV to A.

Couldn't find a copy - the link you provided is bad.

But that brings up a question.  Just what atomicity guarantees do you 
expect DNSSEC to provide for DNS lookups?

For example - an SRV  or NAPTR record at one name can point to a 
record at another name - do you expect that the entire group of 
related records MUST be signed?  If so how do you enforce it, 
especially if the references point outside the zone?

If you're talking about A record fall back (e.g. asking for a 
SRV/NAPTR/pick one record at www.example.com and falling back to the 
A records at www.example.com), what atomicity guarantee do you need 
in the temporal dimension?  E.g. if I try and retrieve the SRV record 
and am told it doesn't exist - securely - but the zone operator is in 
the process of installing it and does so before I can retrieve 
(perhaps manually) the A record - is that OK even though by the time 
I retrieved the A record the SRV record actually did exist?  Or worse 
yet, the operator was in the process of deleting the A record and 
adding the SRV record - I was able to prove when I went to get the 
SRV record it didn't exist - when I went to get the A record it also 
didn't exist.  Both things were true when I asked, but the result is 
that for some period of time I will believe that no service exists.

PNE makes the entire zone atomic for some measure of atomicity - what 
statement would you make to an application developer about reliance 
on that atomicity? 


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>