> If anyone > is aware of tests demonstrating DNSSEC validation failures > without DE, I'd be interested to see them.
I tried this a long time ago with a server that would always return DELEG records independent of the DE flag. > As for DELEG records with a parent-side signature: In absence > of an NS RRset (and corresponding proof of absence), the legacy > validating resolver is not aware that it is looking at a delegation > point. As a result, it does not apply any special delegation > semantics to the DELEG RRset. Instead, it treats DELEG as an > unknown authoritative RR type in the responding zone and validates > its RRSIG in the usual way for an unknown RR type. > > I'm happy to be proven otherwise. However, it is independent of > the discussion about DELEXT being too restrictive. Assume a nameserver ns.example.com, it serves two zones, example.com and child.example.com. Example.com has delegations to child.example.com with both NS and DELEG. Both example.com and child.example.com are DNSSEC signed. A legacy DNSSEC validating resolver is asked to resolve child.example.com/DELEG. Because it is a legacy resolver it expects to find the DELEG record at the apex of child.example.com. It send a query to ns.example.com because that server is authoritative for child.example.com. ns.example.com is DELEG-aware and responds to the query with the child.example.com/DELEG RRset as well as the (parent side) signatures. The resolver expects signatures from child.example.com and not the parent-side signatures that it got and concludes bogus. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
