IETF Logo Mail Archive

Re: [DNSOP] Priming query transport selection

Jim Reid <jim@rfc1035.com> Fri, 15 January 2010 14:05 UTC

Return-Path: <jim@rfc1035.com>
X-Original-To: dnsop@core3.amsl.com
Delivered-To: dnsop@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D98C3A6936 for <dnsop@core3.amsl.com>; Fri, 15 Jan 2010 06:05:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.112
X-Spam-Level:
X-Spam-Status: No, score=-3.112 tagged_above=-999 required=5 tests=[AWL=-0.513, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uPQ6RRX9YrWG for <dnsop@core3.amsl.com>; Fri, 15 Jan 2010 06:05:09 -0800 (PST)
Received: from hutch.rfc1035.com (hutch.rfc1035.com [195.54.233.70]) by core3.amsl.com (Postfix) with ESMTP id DF2D13A635F for <dnsop@ietf.org>; Fri, 15 Jan 2010 06:05:08 -0800 (PST)
Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jim) by hutch.rfc1035.com (Postfix) with ESMTPSA id 45AAC154283B; Fri, 15 Jan 2010 14:05:03 +0000 (GMT)
Message-Id: <8B0DBD24-B956-4689-92B9-A388D0618059@rfc1035.com>
From: Jim Reid <jim@rfc1035.com>
To: Florian Weimer <fweimer@bfk.de>
In-Reply-To: <82ockvfqsi.fsf@mid.bfk.de>
Content-Type: text/plain; charset="US-ASCII"; format="flowed"; delsp="yes"
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v936)
Date: Fri, 15 Jan 2010 14:05:02 +0000
References: <201001131823.o0DINxYv068180@stora.ogud.com> <555CFB98-BB21-4AD4-9D4A-3AF3BD98E4B2@rfc1035.com> <D9CCEA0D18D9D5B457A90853@Ximines.local> <631E7931-47D4-4AAF-B2C6-62DA6DA5A4CA@rfc1035.com> <CDE7E0414BC50C42E4FCC54F@Ximines.local> <E87EE584-97B5-4FE8-B47D-21048A702B51@rfc1035.com> <82ockvfqsi.fsf@mid.bfk.de>
X-Mailer: Apple Mail (2.936)
Cc: dnsop@ietf.org, Alex Bligh <alex@alex.org.uk>
Subject: Re: [DNSOP] Priming query transport selection
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 15 Jan 2010 14:05:10 -0000

On 15 Jan 2010, at 13:20, Florian Weimer wrote:

> DO is rather pointless because the priming response cannot be
> validated anyway (even if ROOT-SERVERS.NET were secure, which is
> currently not planned).

It's not pointless. Validating the priming response requires two  
operations. The first of these is checking the signature over the root  
zone's NS RRset. Which won't be returned unless the DO bit is set.  
[Let's avoid the rat-hole of a DNSSEC-aware resolver iteratively  
querying for DNSKEYs, RRSIGs and so on.] The second operation involves  
validating the address records in root-servers.net. Which will also be  
most efficiently done by setting the DO bit on those queries.

v2.23.0 | Report a Bug | By Email