> I will add the following text: > > XX. Operational Considerations > > A Validating Stub Resolver that is Delegation Extension aware MUST > only use security-aware resolvers that are Delegation Extension > aware. A Delegation Extension aware Validating Resolver that uses > forwarders MUST only use Delegation Extension aware and security-aware > forwarders. Otherwise DNSSEC-secure zones might fail to validate > and DNSSEC-insecure zones might observe inconsistent answers.
I don't quite understand how this would work from a software point of view. Do we have a protocol to decide if an upstream resolver or forwarder supports this draft? There is the DE bit. So validator could just return SERVFAIL if it gets a reply with the DE bit clear. The DE bit is not protected, so we have to be careful not to introduce a downgrade attack. Given that this a WG last call, did anybody implement this? _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
