Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

["Roy Arends" <roy@nominet.org.uk>]

When a validator has a trust anchor configured for root, it _expects_ 
signatures for root. 

No signatures -> no validation -> data marked bogus -> client/stub gets 
servfail (*).

When a validator has a trust anchor configured for root, it expects 
signatures for root and _everything_ below until it hits a proof of 
absence of DS. This proof is given by NSEC/NSEC3 records and its 
signatures.

If something mucks in the middle, is either removing a sig or does fondles 
the data even one single teeny bit, ->

failed validation -> data marked bogus -> client/stub gets a servfail (*).

DNSSEC is perfect that way, in Berts terms.

Roy Arends
Nominet UK

(*) The client/stub has the option to query the validating resolver with 
the CD bit set, in which case the resolver may return bad/bogus data.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>