Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Jelte Jansen <jelte@NLnetLabs.nl>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Joe Abley wrote:
> 
>> DNSSEC makes this impossible.
> 
> Surely, DNSSEC making that impossible relies on the validator on Joe's
> laptop insisting that the TLD and MYBANK.TLD zones are signed, and that
> a trust anchor exists to verify the signatures.
> 
> If the validator on Joe's laptop has an empty cache, and no
> configuration which will make it insist particularly that those zones
> are signed, surely the middleware which is replying to queries could
> just return as if the root, TLD and MYBANK.TLD zones are unsigned. At
> that point there will be no signatures to verify, and it will be as if
> DNSSEC was never deployed.
> 

how would you verify anything without a trust anchor?

I don't think anyone here implies that DNSSEC works when you do not
actually turn it on on the resolver you are using.

> 
> I keep seeing people insist that query-intercepting middleware will be
> defeated with DNSSEC, but I can't see why. Perhaps I'm missing something.
> 

It doesn't (in this scenario), but only because it actually does, and
Joe cannot resolve anything. Then he will probably turn it off.

Jelte
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIiP7S4nZCKsdOncURArXIAKC5Q14tEiQkLIdvwKTbRseiIERrtgCgs6Pp
qYsygSLxB8xXtG82dptkwLg=
=zk6V
-----END PGP SIGNATURE-----

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>