Re: [dnsext] Practical question about backwards compatibility and new proposals

[Andreas Gustafsson <[e-mail]>]

Florian Weimer wrote:
> > RFC 3597 deals with unknown types, but I don't think the treatment
> > of unexpected RRs is currently specified anywhere.  Existing
> > implementations tend to ignore them when they occur in the answer
> > section of a response, and may or may not cache them when they occur
> > in the additional section depending on spoofing defense strategy.
> 
> Quite apparently, implementations which do not implement DNSSECbis and
> still set the DO bit in queries (because they implement DNSSEC) ignore
> the RRSIG records in the answer, authority, and additional sections of
> responses.  I don't think other RRs would receive different treatment,
> provided that the DO bit is set in the query.

If I'm reading your message correctly, you seem to be agreeing with my
statement "implementations tend to ignore them when they occur in the
answer section" and with the "may not cache" part of "may or may not
cache them when they occur in the additional section".

To demonstrate that both the "may cache" and "may not cache" case
occurs in the wild, I have temporarily delegated the domain
unsolicited.additional.test.araneus.fi to an authoritative server that
responds to a type A query with an unexpected TXT record in the
additional section.

For example, when using the BIND 9 resolver in the OARC DNSSEC
testbed:

  dig unsolicited.additional.test.araneus.fi. A @149.20.64.20

the response does not contain this TXT record, but when using the
Unbound resolver in the same testbed:

  dig unsolicited.additional.test.araneus.fi. A @149.20.64.21

it does, and a second identical query will return a cached copy.
-- 
Andreas Gustafsson, [e-mail]