Subject: [DNSOP] What does a NTA validator return in an answer under the NTA?

From: Olafur Gudmundsson <[email-masked]>
Date: Tue, 17 Apr 2012 12:29:06 -0400

When resolving with DNSSEC-trigger on Comcast's network DNSSEC-Trigger 
acts like forwarding stub-validator.
For it to be happy when there is a NTA in place, the upstream resolvers 
MUST return to it the non validatable RRSIG (if they exist).

The current draft is silent on the behavior of the validating resolver 
as if it returns the answers with RRSIG's or without.

The reason for this is if NTA strips signatures  the stub-validator 
thinks it is under attack and may
a) go into recursive mode to try to resolve the domain, getting to the 
right answer the long way.
b) Give the wrong error "Missing signatures" instead of the real error.

If all the validator does is not to set the AD bit for RRsets at and 
below the NTA, stub-resolvers (and cascading resolvers) should be happy.

	Olafur

---

From: Ralf Weber <[email-masked]>
Date: Tue, 17 Apr 2012 16:39:51 +0000

Moin!

On 17.04.2012, at 09:29, Olafur Gudmundsson wrote:
> When resolving with DNSSEC-trigger on Comcast's network DNSSEC-Trigger acts like forwarding stub-validator.
> For it to be happy when there is a NTA in place, the upstream resolvers MUST return to it the non validatable RRSIG (if they exist).
> 
> The current draft is silent on the behavior of the validating resolver as if it returns the answers with RRSIG's or without.
> 
> The reason for this is if NTA strips signatures  the stub-validator thinks it is under attack and may
> a) go into recursive mode to try to resolve the domain, getting to the right answer the long way.
> If all the validator does is not to set the AD bit for RRsets at and below the NTA, stub-resolvers (and cascading resolvers) should be happy.

That's exactly what at least our implementation (Nominum Vantio) that Comcast uses does and I agree that this behavior should be specified in the draft.

So long
-Ralf
---
Ralf Weber
Senior Infrastructure Architect
Nominum Inc.
2000 Seaport Blvd. Suite 400 
Redwood City, California 94063
[email-masked]

---

From: Tony Finch <[email-masked]>
Date: Wed, 18 Apr 2012 12:26:23 +0100

I would expect the validator to treat queries for names under a negative
trust anchor as if the CD bit had been set.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Hebrides, Bailey: Northerly or northeasterly 5 to 7, but mainly 4 in south and
east Hebrides. Rough or very rough, becoming moderate in east Hebrides.
Squally showers. Moderate or good.