Subject: Re: [dnsext] Comments on draft-ietf-dnsext-dnssec-bis-updates-09

From: Samuel Weiler <[email-masked]>
Date: Mon, 8 Mar 2010 04:16:00 -0500 (EST)

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

On Wed, 9 Sep 2009, Mark Andrews wrote:

> You still need to make upstream queries to populate either the
> normal cache or a BAD cache (assuming you have one).  Anything in
> a BAD cache would have had CD=1 on the upstream query because to
> enter the BAD cache it had to fail validation and to validate you
> make CD=1 queries.

Not necessarily: if the upstream is an authoritative server (rather 
than another validator), then the CD bit setting won't matter.

I think the logic we're looking for goes like this: so long as you're 
returning a "real" answer (something with RR's and not just a 
SERVFAIL), it doesn't matter whether you set the CD bit upstream or 
not.  But don't return a SERVFAIL.  If you have a SERVFAIL in your BAD 
cache, you need to go do a new CD=1 query.  So caching the state of 
the CD bit might be useful, but may not be necessary.

I'll include some new text about this in the new version of 
dnssec-bis-updates.  I'm not convinced it's perfect, but I think it's 
a step in the right direction.  Comments welcome.

-- Sam