On Sun, Jul 26, 2026 at 10:42:28PM +0200, Paul Wouters <[email protected]> wrote a message of 43 lines which said:
> I have an outstanding request for unbound to do cache replication > but only for DNSSEC entries that validate. This allows you to sync > from untrusted sources à la pool.ntp.org and we can create a huge > volunteer pool. > > Cache sharing on poisonable data seems wrong and too risky. The use case of the draft was more a group of mutually trusting peers (for instance the instances of a big anycasted public resolver). I don't see what DNSSEC would bring here: if each peer has to validate, this would defeat the goal of saving resources and and if they don't validate, they would have to trust the originating peer, anyway. Regarding the distribution of only DNSSEC-validated data, the draft already allows it "The resolver must send only data that it is sure of (for instance by DNSSEC validation or because it came with the AA bit from the queried server)." We could add more clearly that the originating resolver has criteria (which are local-policy) to choose the data it will share. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
