Re: [dnsext] Why are we re-opening this topic? Was: Suggested update to RFC 4035 section 4.9.2 Handling of the CD Bit

[Andrew Sullivan <[e-mail]>]

No hat

On Tue, Oct 18, 2011 at 12:46:50AM +1100, Mark Andrews wrote:
> 
> And when the stub retries there is no state to prevent the recursive
> server asking the same broken upstream again and again and again

This is true of any breakage.  If the authoritative servers are under
DoS, you have the same problem, no?  DoS on authoritative servers is
at least as common as DNSSEC misconfiguration.

The plain fact is that DNSSEC makes the DNS more fragile.  Why is this
news, and why do you think that your recommendation is the only
sensible response to this?  I still don't understand that.
 
> There is no requirement for a recursive server to attempt to validate
> a response to a CD=1 query from downstream or if it attempts to
> validate the response to retry a different upstream if the validation
> fails.

Of course not. 

Best,

A

-- 
Andrew Sullivan
[e-mail]

_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext