Subject: DNSSECbis Q-15: Security-aware stub resolver setting the CD bit: SHOULD NOT or MUST NOT?

From: Matt Larson <[email-masked]>
Date: Fri, 1 Aug 2003 15:35:28 -0400

This question corresponds to editor's note #14 from
draft-ietf-dnsext-dnssec-protocol-01.
 
Q-15: Should a security-aware stub resolver be allowed to set the CD
bit on queries or should this behavior be prohibited?
 
Background: Here is the text in question from Section 4.2 (page 24) of
draft-ietf-dnsext-dnssec-protocol-01:

   A security-aware stub resolver SHOULD NOT set the CD bit when sending
   queries, since, by definition, a security-aware stub resolver does
   not validate signatures and thus depends on the security-aware
   recursive name server to perform validation on its behalf.

      Editors' note: Should this SHOULD NOT be a MUST NOT?

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>