Subject: [dnsext] draft:draft-crocker-dnssec-algo-signal-06

From: "Jiankang YAO" <[email-masked]>
Date: Fri, 3 Sep 2010 16:36:06 +0800

Dear Steve and Scott,

   just looking throug your draft draft-crocker-dnssec-algo-signal-06,

since the resolvers signal the servers which algorithm the resovers support,

could the servers only return the RRSIGs that the resolvers support?

for example,
the server has:
          a.example A 192.168.1.1
          a.example rrsig  the-signature-with-A-algorithm
          a.example rrsig  the-signature-with-B-algorithm
          a.example rrsig  the-signature-with-C-algorithm
          a.example rrsig  the-signature-with-D-algorithm

now the resolver signal to tell the server that it support C algorithm.

so the server will return the following only:

          a.example A 192.168.1.1
          a.example rrsig  the-signature-with-C-algorithm

instead of:

          a.example A 192.168.1.1
          a.example rrsig  the-signature-with-A-algorithm
          a.example rrsig  the-signature-with-B-algorithm
          a.example rrsig  the-signature-with-C-algorithm
          a.example rrsig  the-signature-with-D-algorithm

if this funtion is not the current feature, it will be bonus to your draft since it will reduce the dns response package.

Jiankang Yao