> >The DE flag really was introduced as a capability negotiation mechanism. Lat > er, it turned out that sending both NS > >and DELEG in the referral didnt actually cause interoperability problems (I > believe Shumon and I were the ones who > >tested this). > > In the other direction, if you have a delegation point with only > DELEG, and you sent a response to an old non-aware resolver with > an authority section that has DELEG and maybe DS and maybe some > RRSIGs, will resolvers ignore the useless (to them) stuff and treat > it as NODATA, or barf because the authority section has garbage? > > I have no idea, perhaps people have tried it out. > > If the answer is NODATA the case for the DE bit is a lot weaker.
There is a problem with DELEG validation. I don't remember all corner cases, but DELEG-unaware validating resolvers may conclude bogus if they receive DELEG records (which they believe is a child-side type) with a parent-side signature. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
