Subject: DNSEXT WG LAst Call: Dnssec OK bit.

From: Olafur Gudmundsson <[email-masked]>
Date: Wed, 29 Nov 2000 14:26:15 -0500

This document defines a EDNS flag for a resolver to signal to DNS server
that it wants to receive DNSSEC records. In the absence of this flag
servers should not send DNSSEC records unless the query for that type.

This document updates RFC2535 and RFC2671.

This WG last call ends December 17'th 2000.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-okbit-01.txt

This draft is on standards track, if you disagree with that please state why
in your response.

         Olafur

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Mark Kosters <[email-masked]>
Date: Thu, 30 Nov 2000 09:41:27 -0500

Olafur

> This draft is on standards track, if you disagree with that please state why

I'm not sure I disagree but am curious for further rationale.  In the 
latest version of this draft a part of section 3 was rewritten to say:

#    More explicitly, DNSSEC-aware nameservers MUST NOT insert SIG, KEY,
#    or NXT RRs to authenticate a response as specified in [RFC2535]
#    unless the DO bit was set on the request. Security records that match
#    an explicit SIG, KEY, NXT, or ANY query, or are part of the zone data
#    for an AXFR or IXFR query, are included whether or not the DO bit was
#    set.

Why is an ANY query listed along with SIG, KEY, and NXT? SIG, KEY, and NXT
have explicit security context whereas ANY does not. To me, an ANY query
is ambiguious at best should have the OK bit set for a RFC2535 response. 

Mark

-- 

Mark Kosters             [email-masked]       Verisign Applied Research
PGP Key fingerprint =  1A 2A 92 F8 8E D3 47 F9  15 65 80 87 68 13 F6 48

---

From: Olafur Gudmundsson <[email-masked]>
Date: Thu, 30 Nov 2000 12:12:39 -0500

>latest version of this draft a part of section 3 was rewritten to say:

Because draft updates RFC2535 it must be standards track unless there is
a good reason other wise.

>is ambiguious at best should have the OK bit set for a RFC2535 response.

Answering for David, (the editor without his permission)

This is a clarification on what to do on an ANY query, sending S+N+K
records back to an ANY query is the right thing to do as they are records
stored at that name.
The thrust of the draft is to say only do RFC2535 record additions when
OK bit is set, but do not suppress the S+N+K records on explicit queries
even if the OK bit is not there.

         Olafur