Re: [DNSOP] I-D Action: draft-vixie-dns-rpz-04.txt

[Tony Finch <[e-mail]>]

Scott Schmit <[e-mail]> wrote:

>

> This doesn't magically make it possible for this DNS firewall to forge
> DNSSEC-signed data, so if a validating end-system is going to have its
> behavior modified, it would need to opt in.  



That's not entirely true. An RPZ setup can lie regardless of whether a
client appears to be validating or not. If the admin's goal is to block
access to malicious sites, then a validating client will get a bogus
result or SERVFAIL, and the site will be blocked as intended.


> But it looks like the contents of this zone are intended to be kept

> secret from end-users. 



That depends entirely on the zone maintainer's policy. The admin can
easily allow clients to query or transfer an RPZ, and/or provide out of
band information about the zone on its web site.


> So this, if implemented, is ultimately a DNSSEC-killer.



I don't think so.



DNSSEC is not able to improve the availability of the DNS. The point of
DNSSEC is to ensure that if you get an answer, you can be sure it is
authentic. If your local network wants to prevent you from accessing a
malicious site, DNSSEC can't stop them.


Tony.

--

f.anthony.n.finch  <[e-mail]>  http://dotat.at/  -  I xn--
  zr8h punycode