On 4.4.2018 07:12, Geoff Huston wrote:
>>>
>>>
>>> All of the following conditions must be met to trigger special
>>> processing inside resolver code:
>>>
>>> o  The DNS response is DNSSEC validated
>>>
>>> o  The result of validation is “Secure”.
>>>
>>> o  The Checking Disabled (CD) bit in the query is not set.
>>>
>>> o  The QTYPE is either A or AAAA (Query Type value 1 or 28).
>>>
>>> o  The OPCODE is QUERY.
>>>
>>> o  The leftmost label of the original QNAME (the name sent in the
>>>   Question Section in the original query) is either "root-key-
>>>   sentinel-is-ta-<key-tag>" or "root-key-sentinel-not-ta-<key-tag>”.
>>>
>>>
>>> Geoff
>>
>> I think that is the way to go.
>>
> 
> Mark, thanks for your patience with my evident cluelessness!

The list of preconditions above is exactly what I meant but did not
manage to explain why it is necessary. Thank you very much for hashing
it out.

My apologies to dnsop and especially Geoff and Paul, I started this
avalanche and then did not follow up. Mea culpa!

-- 
Petr Špaček  @  CZ.NIC

_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop

Reply via email to