Subject: Re: [dnssec-deployment] [dnsext] Blog posts on DNSSEC

From: Ben Laurie <[email-masked]>
Date: Mon, 23 Feb 2009 10:09:45 +0000

Mark Andrews wrote:
> In message <[email-masked]>, Ben Laurie writes:
>> Ben Laurie wrote:
>>> Denizens might be interested in three posts I wrote in quick succession:
>>>
>>> http://www.links.org/?p=542 (Using DNSSEC Today)
>>> http://www.links.org/?p=553 (What Is DNSSEC Good For?)
>>> http://www.links.org/?p=562 (DNSSEC With DLV)
>> On which note, BIND's dnssec-must-be-secure did not operate as I
>> expected - subdomains that don't have keys fail with it turned on.
> 
> 	Which is the point of the option.

I guess I'm hampered by lack of documentation (that I can find) and lack
of a badly signed zone - does anyone operate one of those?

The effect I'm after is that if a resolver doesn't understand DNSSEC and
asks a caching BIND with DNSSEC enabled for a record that doesn't
validate in some way, then it gets an error of some kind - is that what
happens?

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Florian Weimer <[email-masked]>
Date: Mon, 23 Feb 2009 12:09:20 +0100

> validate in some way, then it gets an error of some kind - is that what

In a typical configuration, if the record set is expected to be
signed, you receive a SERVFAIL response.

If the record set is not expected to be signed (due to lack of trust
anchors, or because it is under an unsigned delegation), you get the
data as-is.  This is necessary for incremental deployment.

(At least this is what I've seen in some tests.)

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

---

From: Mark Andrews <[email-masked]>
Date: Tue, 24 Feb 2009 08:29:05 +1100

> validate in some way, then it gets an error of some kind - is that what

	If the record doesn't validate then you get SERVFAIL after
	trying all the servers.  If the record is provably insecure
	then it is returned unless dnssec-must-be-secure is in
	effect in which case SERVFAIL is returned.

	The only way to get a record that does not validate is to
	set CD in the query.

	Mark
 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]