On Mon, Feb 27, 2017 at 10:19:52AM +0100, Jeremie Courreges-Anglas wrote: > > Thanks for considering my patch. OpenBSD tremendously improves with this > > work of yours, I'm all for it! However to make use of this DNSSEC mode, > > the channel to the recursive DNS server has to be absolutely secure (for DO > > or AD in a response). > > Yes, the assumption is that the resolver listed in /etc/resolv.conf is > trusted, including the network in between. > > The easiest method is to run unbound on 127.0.0.1 with > "auto-trust-anchor-file".
I had a patch somewhere for TSIG as well somewhere, give me some time to find it. TSIG can secure the channel as well, but my implementation wasn't all that pretty. > > My looming question that noone wants to ask because it's a bit (a lot) > > of work for the programmer(s) is: can we work toward the goal of a > > validating > > dnssec resolver? > > Please clarify: do you mean "stub resolver" here, ie the code that runs > in libc? Yes, that is what I mean. That way the recursive dns server doesn't have to be on the same box and answers are validated locally. Regards, -peter
