Subject: Is there any DNS client implementation that supports DNSSEC but d oesn't support EDNS0

From: Levon Esibov <[email-masked]>
Date: Fri, 31 Mar 2000 17:24:52 -0800

Hi,

I'd like to find out whether there is any DNS client implementation that
supports DNSSEC but doesn't support EDNS0. Here is why I ask this question:

Currently majority of the deployed DNS clients do not support DNSSEC.
Introduction of the DNS servers supporting DNSSEC and deployment of the
DNSSEC will generate useless (for the DNS clients that don't support DNSSEC)
traffic. The useless traffic that I refer to is associated with a scenario
when the response to a query will be longer than 512 because response
contains the DNSSEC-specific records and the truncation bit will be set and
the client will reissue a query over tcp and will receive the tcp response
that contains the DNSSEC-specific records that are not used by the clients.
We could reduce such traffic if the DNS servers will include DNSSEC-specific
records when responding only to those queries that contain OPT RR.

The question is: can we assume that if client doesn't support EDNS0 (i.e.
its queries don't contain OPT RR), then it also doesn't support DNSSEC?

Comments?

Thanks,
Levon.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Paul A Vixie <[email-masked]>
Date: Sat, 01 Apr 2000 08:06:16 -0800

> its queries don't contain OPT RR), then it also doesn't support DNSSEC?

Yes.