hat tip to .gov hostmasters

Mon Sep 22 23:32:23 UTC 2008

In article <82ljxkjjan.fsf at mid.bfk.de> you write:
>* marcus sachs:
>
>> While we wait for applications to become DNSSEC-aware,
>
>Uhm, applications shouldn't be DNSSEC-aware.  Down that road lies
>madness.  What should an end user do when the browser tells him,
>"Warning: Could not validate DNSSEC signature on www.example.com,
>signature has expired.  Continue to connect?"

	The application just rejects the answer.  Trys again a
	couple of times then reports failure.  This is no different
	to the application talking to the validating resolver a
	couple of time and then reporting failure.

	The advantage of having the application do it is that you
	don't need to secure the connection between the validating
	resolver and the application.

	Mark