Subject: DNAME [4.5]: DNSSEC

From: Wouter Wijngaards <[email-masked]>
Date: Thu, 12 Oct 2006 12:13:14 +0200

Issue [4.5]:
   For a name error response, the resolver has to check the closest
   encloser NSEC to make sure it has no DNAME bit set.  If a DNAME had
   been present, that DNAME redirection should have been followed.

The original RFC is written before DNSSEC was written, and this security
consideration needs to be incorporated.

Best regards,
   Wouter

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>