Subject: Change to restrict KEY draft - dropping RRsets debate

From: "Scott Rose" <[email-masked]>
Date: Fri, 17 May 2002 10:53:14 -0400

Starting with Ed's question/comment on how to best deal with "illegal" RRs
in a potentially valid set, I am suggesting this change to the Restrict KEY
draft:

original:

Name servers and resolvers SHOULD reject any KEY with a Protocol
other than 3.  Assignment of any future KEY record Protocol Octet
values requires a standards action.

New:

Name servers should not load any KEY record with a protocol number other
than 3 as authoritative data for a zone.  However, to aid backward
compatibility, name servers and resolvers SHOULD accept any KEY with a
Protocol
other than 3 if received as part of a KEY RR set in a response.  Assignment
of any future KEY record Protocol Octet values requires a standards action.

. . .

Basically stating that nameservers should check the validity (format) of the
KEY before loading it into the database.  If an invalid KEY is detected,
some sort of warning/error message is generated.  If an invalid KEY RR comes
to a caching server, it should accept it as normal.  This seems (to me) to
be the best "be conservative in what you give out, be liberal with what you
accept" solution.

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>