[v6ops] Re: DNS64 and DNSSEC -- Re: Re: IPv6-only Terminology Definition (coming back)

[András Gerendás <[e-mail]>]

Hi Jordi,

"Interesting. Could you or your student describe the mechanism behind this?"

As you mention as well, there are some corner cases regarding the
validation, I have created different behaviors of my program based on
these, which are captured in boolean flags in the configuration.

- enforce_dnssec (true/false) - DNSSEC validation is performed even if the
program didn’t receive an OPT record from the client with a DO bit set in
it (to ensure validation happens for non-DNSSEC aware clients)
- remove_dnssec_rrs (true/false)- DNSSEC related RRs are removed from
responses containing synthetised records even if the client has the DO bit
set (to avoid clients, which validate the response even if the CD bit is
not active)
- validate_dnssec (true/false)- DNSSEC validation takes place (without this
setting the other two flags are ignored and the program behaves as if it
didn’t know about DNSSEC)

Out of these "remove_dnssec_rrs" was created for the scenario when the
validation would fail as the client would think that it's a forged record
(DNSSEC-validating, but DNS64-oblivious client).
The program behaves as if the domain wouldn't have DNSSEC support at all,
the behavior in this case of the observed clients is to allow the domain,
naturally this doesn't work if only DNSSEC aware domains are allowed, in
that case a DNS64 aware client, which is aware of the used prefix is needed.

- Having only the enforcement can be used in an environment with non-DNSSEC
aware clients.
- Having only the removal can be used in environments where the clients are
agressively validating DNSSEC.
- Having the first two options enabled caters for an environment with both
types of clients.

The removal case needs a secure channel and a trusted relationship between
the client and the server.

With Regards,
András