IETF Logo Mail Archive

[DNSOP] Re: A question regarding DNSSEC validation

Shumon Huque <shuque@gmail.com> Tue, 21 April 2026 19:42 UTC

Return-Path: <shuque@gmail.com>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 8E4E8E04D03E for <dnsop@mail2.ietf.org>; Tue, 21 Apr 2026 12:42:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1776800561; bh=Ra7185RTe0sKRdamDCVB35cjJMu+guKq6gtwdMGQCCs=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=JL+ZDkUFLhhje+efPKbSUWExARBWP5WrDorycSrOYl2ummMe9raiGlF5bQ/+zFP4R 8UnDzqvWg5gx3SskuKe5inXO6IJo+oelhvI2koHqmsoEvC2QXsfX5zQQ8/x7AvZNZx 8sKyf08mLMi3aaBhigMYJblSjCVB/DywiXJ253c8=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mkSScsc-eYjk for <dnsop@mail2.ietf.org>; Tue, 21 Apr 2026 12:42:40 -0700 (PDT)
Received: from mail-ot1-x32d.google.com (mail-ot1-x32d.google.com [IPv6:2607:f8b0:4864:20::32d]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 431DAE04CE9F for <dnsop@ietf.org>; Tue, 21 Apr 2026 12:41:17 -0700 (PDT)
Received: by mail-ot1-x32d.google.com with SMTP id 46e09a7af769-7dbd23bc684so2706925a34.2 for <dnsop@ietf.org>; Tue, 21 Apr 2026 12:41:17 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1776800476; cv=none; d=google.com; s=arc-20240605; b=I0yZYxvFZjzQZZsTkaCyndGa6kbDeTaew4Una0ZtHzg+CAMYPN7Tf2T+H4coIE9Lho hvUcCB3EfAn+KQZuXNHpSR8Y2WqMYQHZRdM7naOpRSL1qyKmkoW350gI8g9LCdLpZH+O VfPrZjMKGh10VLWsT3X4/ddu04zVcCJo4d6J/j+mUiG3JBnx6Sy0BPBl1KT9LZjXN2Co aD64j66/rS4qX+kBj31SSt+MQaQqDVdk+s3OLQozdS0+dPEOeV0BI0XugM1FRzirPgL0 MEnx42CLI9t3BLUWpPw9N504Wz7rCqJrLRD0l4SFqkjuY9XrD9Nv9aGa42Gx4vNCqXnz Bzug==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=Z0hGglqaS951mxxa5ICaCcTfOUEzEK+KdrMZGEA6jMc=; fh=Cvd261dTu1U5yQHWIKHEZ2KG/qgKGsjfsnwEZDeVU9k=; b=G/1XYFlygimVkKpJRwSuSrGp1w5pxSvvIHhC53q6XT1jUkeon2TNlJw2c9tXHVK8f3 ZMIoYldniAnrNJuW84Jg/QyiAIX++DkDvWMrKfxn+Vt9nfyX6nV+Wa/pUE9tSTHiCVIV R9FOqfFFgXxPIlaoJu3daQjrKCxZ5VtCoSgY42UT48BAkb5nQX5+1OAW6KrE359FuUWs p79m9jDlSQxKQs/DYTLbKuCFHs2GvOY26r9upO0EAYDgc6DGeUzc0iRvwG0FbJg7nsfG jv257VppdZMDqWQzJ//BpU17TV8HlqsrpTUbhikFsgzTebIM3hZFRjN+shaB4bvou7SW FqfQ==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776800476; x=1777405276; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=Z0hGglqaS951mxxa5ICaCcTfOUEzEK+KdrMZGEA6jMc=; b=jy7QX9HvAQo8r88isKgX4Y8hs2Zo76vCFZLMEW7pxKV5vfJ4NPYDAgSheaqQsO86yo AflqgoErDxrWMkrypoyv6Nwm56XyJQe/L+f7w2pvlIdtEtDUsDHyzpx38eJYjmaUq5EO CBKUeEsGoo+VugcCsRPLLNp5HRYKst9Wag6nM+4ELhw0eYvuILp0ZDXJKc1rh4KlAU1C 0JdFkhFXX9rnkFe5QrEcnttx/UzlIYWkXNTFONARPGuLyrAHYyeUDkSpC54drZ0nfAXS 2xa6h/cdnbHBfAAMbYPkFQ2s1u7KW/G4ojGEs7uDuDvxi9dcPcibBjxboZ4KUB58ax1/ s8Qw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776800476; x=1777405276; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Z0hGglqaS951mxxa5ICaCcTfOUEzEK+KdrMZGEA6jMc=; b=nvOXVnuZrMgKm5ZF8juTgGDhMyuWWIK0VdVmeaI8MAXGUIOsiFCr2d6Tv94xxcVfg1 GEdXJ7GpEuZ+EJTioMCUluF87P247GbZ1q6CCqoWFFjmDaOXWnKSZ0MjWIX6OKBs9RX0 /NRngfCcqeZGFVKk930BtGLgkYAOxYvxRW/sCjnI/GrNzPBI1T/zrhcNvSCe1xqIJrpL oSUHp5qp7oySqLNUeUvhaa8YvPIm6uVWvosWi1fo3BxovCGZqr6EuHweD9prTyP5rSTP xE2GOiGG0Y3kGKWqzi0ENHH2jFfm6nwZl5APsOjSp0/bqsHhBFOINDAXtzoEn+1MWhQ5 eZWg==
X-Forwarded-Encrypted: i=1; AFNElJ+3FPUg1Ygg1bTcGn3tcXRxpqe+Y5Uj1kGZhwHK1QPLZqi7/mBToLfGKax9iNloVBBy3a7LDQ==@ietf.org
X-Gm-Message-State: AOJu0Yzq18labjLuMqdSZSgv6vdT6F56/Ze25RE7O+4T3DXW5ZO1irpr coPls0aUprQtwsc6nWVqvZwarBSGZcg8ztsaX9rApaXhpCSs9T/0x7NTv20qOSj4F8LxEPfBCIX i46qJPegI+fgmx7OPVoOeVnLSEYNQlzM=
X-Gm-Gg: AeBDiesZRFPBn8PFX0ywlQrESoPu8qO23l7aPdIxoHgiY4hTAs6Lz3VbFHWAehMmIYH act9KcDRw1+5xVB7eId++uOx8pqCSr8nFOb5suI5yyscTQTzxrL7ISYiYNh3HLs57r/+BCu7tjO Sj2/m+XTTRK/0QeeDY8xJ9dZbLkZDsENcTvlE9KeWEo8FlsDsCq5stEVhlhCf4lSyDDJZpMA8ik L8LCdInfGUeLSbJg5vIFpsyiLNebCZ1PpbfA6bIz1wfQ+Meg1IjTyEyCoyNpAhdvznTZ+o5fIuV ncFWV6DpegeQ/EndQw==
X-Received: by 2002:a05:6830:81cb:b0:7dc:3d7e:40c2 with SMTP id 46e09a7af769-7dc9529d220mr11502469a34.27.1776800476459; Tue, 21 Apr 2026 12:41:16 -0700 (PDT)
MIME-Version: 1.0
References: <749d198c.101a.19d93e2675d.Coremail.scooct@163.com> <CAOdQrVMv+PhzCc1_=uAqb=qWeF53um5VwnkhPFsSgK40XSt=yw@mail.gmail.com> <907eeced-4878-4d55-b3cb-48ecd6b9a780@nic.cz> <CAHPuVdWog2kHVG_zYDfo_JJjoHaMbyLjf0_j_6iEZ=d5UvReFg@mail.gmail.com> <BEFAB35F-B622-4395-88CD-F3B616C62254@gmail.com>
In-Reply-To: <BEFAB35F-B622-4395-88CD-F3B616C62254@gmail.com>
From: Shumon Huque <shuque@gmail.com>
Date: Tue, 21 Apr 2026 15:41:04 -0400
X-Gm-Features: AQROBzCI4_AIap02TW4SEbBVALsYTblpU6mDymfQQLhQLX-A1LNlz5i9IJNJQTs
Message-ID: <CAHPuVdUjoYz7P1-eZBC+-wci5W_6fK5UaJ-trPxMe4Jv8w9xbA@mail.gmail.com>
To: Edward Lewis <eppdnsprotocols@gmail.com>
Content-Type: multipart/alternative; boundary="0000000000003c76ef064ffd9962"
Message-ID-Hash: Z43V4Z3G4ZIFNGHBWW3RXOQJGBJVSZZL
X-Message-ID-Hash: Z43V4Z3G4ZIFNGHBWW3RXOQJGBJVSZZL
X-MailFrom: shuque@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Libor Peltan <libor.peltan=40nic.cz@dmarc.ietf.org>, dnsop <dnsop@ietf.org>, Ben Schwartz <bemasc=40meta.com@dmarc.ietf.org>, Cathy Zhang <scooct@163.com>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: A question regarding DNSSEC validation
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/KyWCzeo0E3qQELIYSymujwkdr1k>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

On Tue, Apr 21, 2026 at 2:35 PM Edward Lewis <eppdnsprotocols@gmail.com>
wrote:

> On Apr 20, 2026, at 4:17 PM, Shumon Huque <shuque@gmail.com> wrote:
> >
> > It would be nice if I could concretely point people to a specification
> document that says how to do this correctly.
>
> That might be over-specifying.  The IETF documents target
> interoperability, historically not conformance.
>
> Leaving implementers wiggle room in handling anomalies is a good thing as
> the nature of root causes is ever evolving.
>

Hi Ed, I'm not proposing to over-specify anything or to go into
implementation details.

I'm proposing to clearly state some general principles for robust resolver
behavior. For example, that resolvers should re-query other name servers
for the zone when they get erroneous responses, such as unvalidatable
answers (invalid/missing/expired signatures, erroneous response codes,
etc). Is this a controversial position? Unless I've missed it, this does
not seem to be clearly addressed today anywhere in the DNS specs.

Shumon.

v2.46.0 | Report a Bug | By Email | System Status