Well having TCP used for all priming queries would make me feel better
as TCP traffic is harder to forge.
So let's forget about dnssec an do everything over TCP?
But seriously DNSSEC signed and validated data should protect the
the resolver from going to the forged addresses.
So you wasn't serious?
Yes someone can forge the answer and DoS the resolver into believing that
nothing works.
The situation is "." and root-servers.net. zones are hosted on the
root servers, thus the same servers will get all follow-up questions
about signed address sets as the priming query.
Resolvers like to ask the "close" servers for information thus it
is almost certain that over time the resolver will send a question
to all root servers.
Based on this I think one TCP connection is better than 14-27
UDP ones. (Resolver that only supports one transport should never
ask for the address records it will not use).
We can even take this one step further and ask both priming questions
over the same TCP connection that is NS and DNSKEY.
Ed in my mind this is straight forward engineering question,
which approach is better as in cheaper/faster/safer.
But then I expect some decent answers and not some handwaving and flip-flopping
between being serious and not.
jaap
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop
