trouble with .gov dns?

Tue May 3 16:53:21 UTC 2011

* David Conrad:

> On May 2, 2011, at 10:19 PM, Florian Weimer wrote:
>> I would go even further---the DO bit is not about DNSSEC at all.
>
> Err, yes it is.

I know you think it is, but you're wrong if you look at the overall
protocol.

>> If DO were about DNSSEC, a new flag would have been
>> introduced along with DNSSECbis, where the record types changed so
>> that for resolvers implementing the older protocol, the DNSSECbis
>> records just looked like garbage.
>
> You're suggesting RFC 3225 should have predicted DNSSECbis?

Not quite.  If DO was about DNSSEC in the strictest possible sense,
then it would not have been possible to reuse the flag for DNSSECbis,
which hasn't got anything in common with DNSSEC as far as the wire
types are concerned.  For a original-DNSSEC-supporting resolver, they
look like garbage, just as the original DNSSEC records for some of the
resolvers back then.  So if DO referred to a specific set of record
types (the original DNSSEC ones), you'd need a new flag for DNSSECbis.
But this wasn't done, so DO does not cover a specific set of record
types, and it is therefore not tied to a particular DNS protocol
extension, including DNSSEC.