Subject: [dnsext] extending the EDNS Algorithm Understood (AU) option

From: William Allen Simpson <[email-masked]>
Date: Tue, 11 Aug 2009 13:36:42 -0400

The current draft already has the language:

2.  Signaling Algorithm Understood (AU) Using EDNS

    ... This document seeks
    to define a new EDNS0 option for a client to signal which algorithms
    the client prefers, /and the server to advertise which algorithms are
    used to sign a particular zone./

The latter doesn't seem to be included, yet!

===

Therefore, the following friendly amendment is proposed:

4.  Server Considerations

    If the AU option is present but the DNSSEC-OK bit is not set, then
    the authoritative server does not include any additional DNSSEC RRs
    in the response.  However, the AU option is included in the response,  |
    listing all available algorithms in order of server preference.  If    |
    the DNSSEC-OK bit is set, [....]

    If the zone containing the QNAME is not signed, the authoritative
    server sends a traditional non-DNSSEC response without an AU option.   |

    If the zone containing the QNAME is signed only with algorithm(s)      |
    that are not present in the client query, [...] generate them.         |
    Unless the response is truncated, no AU option is included, as all     |
    algorithms are known.

    When the response is truncated, the server must ensure that there is   |
    sufficient space to include the EDNS0 OPT RRType.  The AU option is    |
    included in the response, listing all available algorithms in order    |
    of server preference.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>