Subject: [dnsext] Questions about RRSIG queries

From: "George Barwood" <[email-masked]>
Date: Sun, 28 Feb 2010 07:34:41 -0000

Could anyone clarify how explicit queries for RRSIG are supposed to work?

Specifically, if a cache has some, but not necessarily all, of the RRSIG records for a domain,
does it just return those, or should it obtain the full list?

In other words, is it like ANY? ( where a recursive query is just a debug tool, given
that the result is unpredictable ).

After a quick test, I think this is what current implementations do, and probably
is a reasonable interpretation of the standard.

I haven't tried very hard to look for a statement in the standard, but suspect
it is silent on this. Whether it is worth clarifying, I don't know.

Another question : is should AD be set or not ( by a validating resolver )?
Again, probably doesn't matter, I'm just not sure.

George

---

From: Jim Reid <[email-masked]>
Date: Sun, 28 Feb 2010 11:11:14 +0000

> Could anyone clarify how explicit queries for RRSIG are supposed to  

The same way as queries for any other RRtype.

> Another question : is should AD be set or not ( by a validating  

Only when the validating resolver has authenticated all the data in  
the Answer and Authority Sections of the responses it returns to the  
client. If you think the language in RFC4035 isn't clear enough on how  
the AD bit gets used, suggest how the text could be improved.

---

From: Mark Andrews <[email-masked]>
Date: Mon, 01 Mar 2010 14:28:29 +1100

In message <8540AFD8C8DD470DA74F5992C49F2168@localhost>, "George Barwood" write
s:
> Could anyone clarify how explicit queries for RRSIG are supposed to =
> work?

Does it matter?  No sane validator will ask for RRSIG records.
RRSIG records are useless without the records that they sign.
 
Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: [email-masked]
Date: Mon, 1 Mar 2010 04:52:33 +0000

On Mon, Mar 01, 2010 at 02:28:29PM +1100, Mark Andrews wrote:
>  A

	of course it matters. a sane resolver should be able to
	ask for RRSIG records independently of the records 
	the sigs belong to.

	resolver != validator.

	I can certainly think of at least two reasons for 
	making explicit queries.

--bill