Re: [dnsext] CNAME check Re: [WGLC: draft-ietf-dnsext-dnssec-bis-updates-16]

Hi,

No hat.

On Wed, Feb 01, 2012 at 11:40:23PM +0800, Yao Jiankang wrote:

> >Now, imagine a FOO-unaware validating resolver that follows the advice
> >you suggest.  It queries a signed zone with a FOO record.  The
> >resolver doesn't know about FOO.  Therefore, it doesn't know that
> >there could be a synthetic CNAME at that name, resulting from the FOO
> >record.  Therefore, it will treat the unsigned CNAME as bogus, and the
> >backwards compatibility doesn't happen.
> 
> My suggested word is that "this CNAME should be neglected". It means
> that the FOO-unaware validating resolver(when doing DNSSEC checking)
> will see this unsigned CNAME as nothing, not accept it, and also not
> report it as bogus. When a unsigned CNAME appears,  the FOO-unaware
> validating resolver(when doing DNSSEC checking)  just sees nothing
> and negelcts this CNAME. So I do not think that it will cause any
> hole in DNSSEC.

Ok, so the resolver ignores the unsigned CNAME (i.e. it's as though it
wasn't received), and returns what to the initiator of the query
(i.e. the originating resolver or the application or whatever)?
NOERROR with an empty answer?  I don't understand how this is any
better than treating the result as bogus; the originator of the query
still can't get to the destination it was querying for, right?

Best,

A

-- 
Andrew Sullivan
ajs@anvilwalrusden.com
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext