Subject: [dnsext] DNSSEC OK bit in responses

From: "Roy Arends" <[email-masked]>
Date: Mon, 23 Nov 2009 16:38:22 +0100

RFC 3225: The DO bit of the query MUST be copied in the response.
RFC 4035: [RFC2671] introduced EDNS, and [RFC3225] reserved the DNSSEC OK 
bit and defined its use.  The use is restated but not altered in this 
document.

draft-ietf-dnsext-dnssec-bis-updates-09:

4.6. Setting the DO Bit on Replies
[RFC4035] does not provide any instructions to servers as to how to set 
the DO bit.  Some authoritative server implementations have chosen to copy 
the DO bit settings from the incoming query to the outgoing response. 
Others have chosen to never set the DO bit in responses.  Either behavior 
is permitted.  To be clear, in replies to queries with the DO-bit set 
servers may or may not set the DO bit.

Could we remove this section? Two reasons. The first is that the statement 
about instructions to servers is not correct. The second reason is that I 
think it is unwise to standardize by implementation bug. Clearly, both 
3225/4035 do not permit that behavior.

Kind regards,

Roy Arends
Sr. Researcher
Nominet UK