Re: [dnsext] Design team report on dnssec-bis-updates and CD bit

[Michael Graff <[e-mail]>]

On 7/9/10 9:21 AM, Andrew Su
> Please offer your thoughts on these models and state which of them you
> think should be in the draft as the way to handle the CD bit.  We will
> devote some time in the Monday Maastricht session to this issue.  We
> want to bring it to a close at that meeting.

I may make some sense to list the behaviors of the common resolvers, and
define what problems we're trying to fix by selectively setting the CD=1
flag.  There was mention that there was lack of agreement, but no
reasons (pros, cons) for the various choices really.

Please also note that you might not know that you have a covering TA for
the name in question in all cases, specifically DLV or when learning
about the existence of DNSSEC does not start from the parent and move
into the child, but moves the other way.  Which some resolvers implement.

Also, just because a query did not have CD set, it does not mean the
next one won't, and I believe it's against the RFCs to query for RRSIG
or NXT records.  This would mean more queries, and to be safe, probably
two caches in the resolver, one for CD=1 and one for CD=0.


--Michael