Subject: DNSSECbis Q-16 suggested text

From: "Scott Rose" <[email-masked]>
Date: Tue, 2 Sep 2003 07:20:33 -0400

Looking back at the suggested text, I realize I agreed with Andreas but
misinterpreted the text based on previous discussions.

The DO and CD bit should not be able to override each other, as they have
different meanings to the resolver.  Suggested text for the last paragraph
of section 4.1:

"The name server side of a security-aware recursive name server MUST
pass the sense of the CD bit to the resolver side along with the rest
of an initiating query, so that the resolver side will know whether
whether or not it is required to verify the response data it returns
to the name server side.  The name server side is not required to pass
the sense of the DO bit to the resolver side depending on local policy.
However, if the DO bit is set, the name server side MUST strip all DNSSEC
related RRsets from the final response."

Comments welcome.

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>