Subject: CD bit setting from intermediate resolvers...

From: Michael StJohns <[email-masked]>
Date: Tue, 11 Mar 2008 14:50:41 -0400

Restarting the discussion post the DNSEXT meeting in Philadelphia:

4035 Doesn't explicitly state the CD bit must be set on upstream queries from an intermediate resolver if the CD bit is set in the client query.  (The language is ambiguous, but seems to just require the resolver side of the intermediate server pass the records it has without checking).

My first suggestion was that the intermediate resolver ALWAYS set the CD bit on output but after more thought I posted the following:

The text from my last note on this topic dated 19 Nov 2007

"OK - thinking about it, I think its even more complex than this.  I think the CD bit gets set in only those upstream queries where the resolver has a configured trust anchor superior to the query.  (.e.g .COM for queries to sub1.example.com)

Let's say your local validating resolver has a trust anchor for "example.com" but not ".com"  Let's say the next upstream resolver has a trust anchor for .com.   If the local resolver sets the CD bit on queries in foo.com the client could get data in foo.com even if the data were invalid at the upstream resolver even though the upstream resolver should have protected the local resolver."

I think the final language is something like:

"Set the CD bit on output if you got the CD bit on input.
If the CD bit is NOT set on input, set it on output if and only if this intermediate resolver has a trust anchor covering this query."

AND

"An intermediate resolver MUST generate an upstream query for any received query where the query  has the CD bit set IF there is cached data  for the query (or its supporting data - e.g. NS, RRSIG, DNSKEY) and that data was not the result of a previous CD-bit set query."

There may also be some interactions with DLV and DLV anchors - but figuring out those hurts my head.

Mike