>Resolvers check signatures on records they're going to ignore? >That seems odd, >although I suppose it's been a corner case that's not well tested.
There are two aspects here: - A resolver may receive a DELEG record in the answer section. For example as a result of query for the DELEG type. - DNSSEC validation resolvers can cache DNSSEC valid RRsets. For example, the resolver may not need a DS RRset right now. But it can update it's cache when it gets one and use it during validation. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
