Subject: [dnsext] Unsigned Synthesized CNAME issues in dname-bis draft

From: "YAO Jiankang" <[email-masked]>
Date: Thu, 15 Apr 2010 17:18:42 +0800

in section  5.3.1.  Signed DNAME, Unsigned Synthesized CNAME of draft draft-ietf-dnsext-rfc2672bis-dname-18:

  In any response, a signed DNAME RR indicates a non-terminal
   redirection of the query.  There might or might not be a server
   synthesized CNAME in the answer section; if there is, the CNAME will
   never be signed.

could I suggest to 

change "if there is, the CNAME will never be signed."

to the follow "if there is, the CNAME may (should) be signed if the online signing is supported on the server." ?

we can do it or not?

Jiankang Yao

---

From: Mark Andrews <[email-masked]>
Date: Fri, 16 Apr 2010 00:28:12 +1000

In message <[email-masked]> <451D7DB04B81453799CB4C53265F13FA@LENOVO4
> to the follow "if there is, the CNAME may (should) be signed if the online signing is supported on the server." ?

You don't need to do it.  The client will most probably ignore it.
named does.  The CNAME is just there to make the non DNAME aware
clients happy.

Mark

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "YAO Jiankang" <[email-masked]>
Date: Fri, 16 Apr 2010 09:08:17 +0800

----- Original Message ----- 
From: "Mark Andrews" <[email-masked]>
To: "YAO Jiankang" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, April 15, 2010 10:28 PM
Subject: Re: [dnsext] Unsigned Synthesized CNAME issues in dname-bis draft 

> named does.

are there some clients which don't ignore it?

>  The CNAME is just there to make the non DNAME aware
> clients happy.

+1.

if there are signed CNAME, it may bring more happy to those clients which  don't ignore signed CNAME.

:)

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 16 Apr 2010 14:10:44 -0400

No hat.

> if there are signed CNAME, it may bring more happy to those clients which  don't ignore signed CNAME.

Why wouldn't they ignore the signed CNAME, since they can deal with
the DNAME?  5.3.4 of the draft points out that "DNSSEC validators MUST
understand DNAME."  The assumption that validators would understand
DNAME is an old one, and I think that it would be a bad idea to try to
change that now.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.