Re: [DNSOP] Priming query transport selection

[Jaap Akkerhuis <[e-mail]>]

    
    Well having TCP used for all priming queries would make me feel better
    as TCP traffic is harder to forge.

So let's forget about dnssec an do everything over TCP?
    
    But seriously DNSSEC signed and validated data should protect the
    the resolver from going to the forged addresses.

So you wasn't serious? 

    Yes someone can forge the answer and DoS the resolver into believing that
    nothing works.
    The situation is "." and root-servers.net. zones are hosted on the
    root servers, thus the same servers will get all follow-up questions
    about signed address sets as the priming query.
    Resolvers like to ask the "close" servers for information thus it
    is almost certain that over time the resolver will send a question
    to all root servers.
    
    Based on this I think one TCP connection is better than 14-27
    UDP ones. (Resolver that only supports one transport should never
    ask for the address records it will not use).
    We can even take this one step further and ask both priming questions
    over the same TCP connection that is NS and DNSKEY.
    
    Ed in my mind this is straight forward engineering question,
    which approach is better as in cheaper/faster/safer.
    
But then I expect some decent answers and not some handwaving and flip-flopping
between being serious and not.

	jaap