Re: [DNSOP] ALT-TLD and (insecure) delgations.

[Robert Edmonds <[e-mail]>]

Warren Kumari wrote:
> The largest outstanding issue is what to do about DNSSEC -- this is
> (potentially) a problem for any / all 6761 type names.
> The root is signed, so if a query leaks into the DNS (as they will),
> an (unaware) validating resolver will try resolve it, and will expect
> either a signed answer, or proof of an insecure delegation; without
> this things will look bogus, and so resolvers will SERVFAIL.
> 
> Clearly, a signed answer isn't feasible, so that leaves 2 options - 1:
> simply note that validation will fail, and that SERVFAIL will be
> returned in many case (to me this seems "correct"), or 2: request that
> the IANA insert an insecure delegation in the root, pointing to a:
> AS112 or b: an empty zone on the root or c" something similar.

Hi, Warren:

I'm kind of confused. If a .ALT query leaks into the DNS, and there's
neither a secure or insecure delegation in the root, isn't the result a
signed NXDOMAIN, not a SERVFAIL?

    ; <<>> DiG 9.11.0-P1 <<>> +dnssec foo.alt
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36917
    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 1

-- 
Robert Edmonds