DNSSEC and SSL
Tony Finch
dot at dotat.at
Mon Aug 23 14:49:52 UTC 2010
On Sun, 22 Aug 2010, Mans Nilsson wrote:
>
> OTOH: A thicker stub resolver does indeed exist; lwresd in the BIND
> suite. Calling it from applications does however mean using new API
> calls; since the traditional resolver API is oblivious to DNSSEC.
lwresd is in fact a full service resolver, though it is designed for
forward-only usage. Although its man page says it is "stripped-down", it
is in fact just the normal named binary running in a mode with a simple
canned configuration that gets its forwarders from /etc/resolv.conf.
AIUI, lwresd was originally conceived to deal with the original IPv6 DNS
support (A6 records and binary labels). It would need quite a lot of
re-working in the lwres client library (and possibly also the lwres
protocol) to provide proper DNSSEC support.
Tony.
--
f.anthony.n.finch <dot at dotat.at> http://dotat.at/
GERMAN BIGHT: CYCLONIC, BECOMING SOUTHWEST, GALE 8 TO STORM 10, INCREASING
VIOLENT STORM 11 FOR A TIME. ROUGH OR VERY ROUGH. RAIN OR SQUALLY SHOWERS.
MODERATE OR POOR.
More information about the NANOG
mailing list