[DNSOP] Re: Is DELEXT too restrictive?

[Philip Homburg <[e-mail]>]

> >The DE flag really was introduced as a capability negotiation mechanism. Lat
> er, it turned out that sending both NS
> >and DELEG in the referral didnt actually cause interoperability problems (I 
> believe Shumon and I were the ones who
> >tested this).
> 
> In the other direction, if you have a delegation point with only
> DELEG, and you sent a response to an old non-aware resolver with
> an authority section that has DELEG and maybe DS and maybe some
> RRSIGs, will resolvers ignore the useless (to them) stuff and treat
> it as NODATA, or barf because the authority section has garbage?
> 
> I have no idea, perhaps people have tried it out.
> 
> If the answer is NODATA the case for the DE bit is a lot weaker.

There is a problem with DELEG validation. I don't remember all corner cases,
but DELEG-unaware validating resolvers may conclude bogus if they receive
DELEG records (which they believe is a child-side type) with a parent-side
signature.