Re: [dnsext] Reminder: two WGLC closing in one week

[Olafur Gudmundsson <[e-mail]>]

<DNSSEC-historian-hat=on>
At 04:38 02/10/2008, Florian Weimer wrote:
>* Mark Andrews:
>
> >> DO necessarily implies UD because the synthesized CNAME is not signed
> >> and thus not visible to a DNSSEC client (section 3.1).
> >
> >       DO indicates that you want the DNSSEC records.
>
>DO was originally conceived as "intent to validate".  It's not used
>this way, though.

DO was designed to address two issues:
- Protect DNSSEC-ignorant resolvers that failed when they saw 
"unknown" RR types.
- Keep answers smaller for DNSSEC ignorant queriers.

When DO was proposed, someone observed  "DNSSEC is only for consenting adults"


> >       UD indicates that you don't want the synthesised CNAME.
> >
> >       There are cases where you don't want DO to imply UD.
> >       Think humans reading the output.
>
>If UD is debugging-only, I don't think it's worth the effort.

UD is an exit plan from "synthesize CNAME forever" as the old exit plan
"new version of EDNS" is not on the horizon.
There are actively maintained non-DNSSEC DNAME-aware resolvers
out there and these resolvers can send queries with DO=0 and UD=1.
One of the objections from for placing DNAME records
in the root zone was the "CNAME synthesis overhead".

         Olafur 


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>