search

wkumari / draft-livingood-dnsop-negative-trust-anchors

This document discusses Trust Anchors for DNSSEC and defines a Negative Trust Anchor
3 stars 3 forks source link

Return a non-validatable RRSIG? #15

Closed wkumari closed 9 years ago

wkumari commented 9 years ago

Olafur Gudmundsson has suggested that we may want to consider whether a non validatable RRSIG should be returned or not when a NTA is in place. This was raised in the context of NLnet Labs' DNSSEC-Trigger, which apparently acts like forwarding stub-validator. He said, "The reason for this is if NTA strips signatures the stub-validator thinks it is under attack and may a) go into recursive mode to try to resolve the domain, getting to the right answer the long way. b) Give the wrong error "Missing signatures" instead of the real error. If all the validator does is not to set the AD bit for RRsets at and below the NTA, stub-resolvers (and cascading resolvers) should be happy."

wkumari commented 9 years ago

This was discussed earlier -- NTA's only make the local recursive not set AD, and return an answer. They do not strip signatures. Folk who do their own validation are in charge of their own destiny - it is not our place to override their view.