Re: [dnsext] Re: need new flag bit in EDNS, "do me no favours" (DMNF)

[Paul Vixie <[e-mail]>]

> Date: Mon, 25 Oct 2010 23:57:14 -0300
> From: Brian Dickson <[e-mail]>
> 
> +1 for the approach and review volunteer

groovy, thanks.

> At the risk of rat-holing here, I think some attention to the DO bit
> might be warranted.
> 
> Specifically, this is an opportunity to encourage "good" behavior even
> for unsigned zones, when DO is set.  If a stub resolver is security
> aware, it should expect whatever resolver it uses (trusts?) to be benign.

DO doesn't signal security-aware, rather it signals security-format-aware.

> So, while this would definitely add complexity, even in the instance of
> DMNF not being set, any favors should also include "proof" that they are
> only favors.
> 
> I.e. if web error detection/redirection occurs, where an NXDOMAIN would
> otherwise have been returned, the recursive resolver SHOULD also include
> the kind of DNSSEC stuff that would accompany an NXDOMAIN (NSEC/NSEC3
> proof).
> 
> Thoughts?

i think that if the nxdomain is secure from the authoritative and if the
client sets DO then unsigned results will be treated as bogus by the RD=1
initiator, who will know by that time that the zone is signed.  so, this
is nonsequitur.

moreover, i'd like to open-and-shut this case.  please let's not innovate
beyond the small desire i began with, which is to add opt-out.  this WG has
a long history of multiyear drafts with 15 to 20 revisions.  let's please
not do that in this case.