Subject: Re: [keyassure] Asserting DANE exclusivity for an entire domain

From: Olafur Gudmundsson <[email-masked]>
Date: Mon, 28 Mar 2011 08:56:48 -0400

On 03/02/2011 11:45 AM, James Cloos wrote:
>>>>>> "MM" == Matt McCutchen<[email-masked]>  writes:
>
>>> Since we rely on DNSSEC anyway, DS records are the ideal way to
>>> determine zone cut points.  They are grabbed anyway as a matter
>>> of course and provide all the clue required.
>
> MM>  Right... but do DNSSEC client libraries make it easy to access this
> MM>  information without doing a separate query for the DS record?
>
> Even if they do not, the resolver had to grab the DS as part of the
> validation, so the round trip for an extra DS lookup by the end client
> is by definition local, often even same-process.
>
> -JimC

Actually the RRSIG(DTLS) is an even better indicator the zone name ==
signer name, there is no need to look up the DS record from the client.

	Olafur