Re: [DNSOP] NSEC/NSEC3 for unsigned zones and aggressive use

Mukund Sivaraman <> Tue, 18 July 2017 11:57 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 2262F1288B8 for <>; Tue, 18 Jul 2017 04:57:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 0.265
X-Spam-Status: No, score=0.265 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_SORBS_WEB=1.5, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Vx3aFfERLevf for <>; Tue, 18 Jul 2017 04:57:45 -0700 (PDT)
Received: from ( [IPv6:2a01:4f8:140:644b::225]) by (Postfix) with ESMTP id E914512785F for <>; Tue, 18 Jul 2017 04:57:44 -0700 (PDT)
Received: from jurassic (unknown []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id 9E0B056A04AF; Tue, 18 Jul 2017 11:57:42 +0000 (GMT)
Date: Tue, 18 Jul 2017 17:27:39 +0530
From: Mukund Sivaraman <>
To: Francis Dupont <>
Message-ID: <20170718115739.GA32524@jurassic>
References: <20170718094654.GA31988@jurassic> <>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <>
User-Agent: Mutt/1.8.3 (2017-05-23)
Archived-At: <>
Subject: Re: [DNSOP] NSEC/NSEC3 for unsigned zones and aggressive use
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 18 Jul 2017 11:57:46 -0000

Hi Francis

On Tue, Jul 18, 2017 at 01:17:58PM +0200, Francis Dupont wrote:
>  In your previous mail you wrote:
> >  There are still many popular unsigned zones, many of which don't look
> >  like they will be signed soon due to operational and other reasons.
> >  
> >  Will you give some thought and reply with your opinion on NSEC/NSEC3 for
> >  unsigned zones requiring the DNS COOKIE option in transmission, that can
> >  be used with draft-ietf-dnsop-nsec-aggressiveuse?
> => I can't parse your message:
>  - unsigned zones have no zone keys

NSEC needs no keys, only their RRSIGs would which wouldn't exist in
unsigned zones. In this case the unsigned NSEC would also not be part of
the zone (it would have to be synthesized and maintained outside the

>  - DNS cookie was designed to give a return routability proof for the client,
>   not the server
>  - there is no NSEC/NSEC3 in an unsigned zone
> Perhaps you mean to return a synthesized NSEC/NSEC3 and the DNS COOKIE is
> as usual required to avoid amplification DoS.

This was discussed during the ISC 2017 all-hands; I don't remember if
you were in the meeting when we discussed it (I think the meeting topic
was about DoS mitigation measures).

Because an unsigned/unauthenticated NSEC/NSEC3 has the potential to nix
entire zones, when it was discussed, Mark Andrews suggested that
requiring DNS COOKIE to further reduce the chance of cache poisoning
(more than source port randomization and random message ID) could be a
reasonable idea to think about.

> But what will be the signing key (including on the client side) and
> what to put in the NSEC/NSEC3? Perhaps this applies only to authoritative
> servers of the (unsigned) zone?
> It seems easier to remember that DNSSEC offers proofs for denial of existence.