Re: [Doh] DNSSEC, DOH, and DNS headers

I appreciate this. we can make the change.

On Mon, Mar 19, 2018 at 2:39 PM, Andrew Sullivan <ajs@anvilwalrusden.com>
wrote:

> Hi,
>
> Section 6 of -03 says this:
>
>    Different response media types will provide more or less information
>    from a DNS response.  For example, one response type might include
>    the information from the DNS header bytes while another might omit
>    it.
>
> But section 9 says
>
>          A DNS API client may also perform full
>    DNSSEC validation of answers received from a DNS API server or it may
>    choose to trust answers from a particular DNS API server, much as a
>    DNS client might choose to trust answers from its recursive DNS
>    resolver.
>
> It seems to me that these are in tension with one another, because the
> AD and CD bits are in the header that the response type is permitted
> to throw away.  Maybe it could be resolved thus:
>
> NEW
>
>          A DNS API client may also perform full
>    DNSSEC validation of answers received from a DNS API server or it may
>    choose to trust answers from a particular DNS API server, much as a
>    DNS client might choose to trust answers from its recursive DNS
>    resolver.  This capability might be affected by the response media
>    type a DNS API server supports.
>
> Best regards,
>
> A
>
> --
> Andrew Sullivan
> ajs@anvilwalrusden.com
>
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh
>