Subject: Re: [dnsext] DNSSEC OK bit in responses

From: Samuel Weiler <[email-masked]>
Date: Mon, 8 Mar 2010 04:14:16 -0500 (EST)

On Mon, 23 Nov 2009, Roy Arends wrote:

> RFC 3225: The DO bit of the query MUST be copied in the response.
> RFC 4035: [RFC2671] introduced EDNS, and [RFC3225] reserved the DNSSEC OK
> bit and defined its use.  The use is restated but not altered in this
> document.
> 
> draft-ietf-dnsext-dnssec-bis-updates-09:
> 
> 4.6. Setting the DO Bit on Replies
> [RFC4035] does not provide any instructions to servers as to how to set the
> DO bit.  Some authoritative server implementations have chosen to copy the
> DO bit settings from the incoming query to the outgoing response.  Others
> have chosen to never set the DO bit in responses.  Either behavior is
> permitted.  To be clear, in replies to queries with the DO-bit set servers
> may or may not set the DO bit.
> 
> Could we remove this section? Two reasons. The first is that the statement
> about instructions to servers is not correct. The second reason is that I
> think it is unwise to standardize by implementation bug. Clearly, both
> 3225/4035 do not permit that behavior.

Thanks for digging this up.  Since at least once implementation has 
done it wrong, I'm going to leave the section in, but I'll change the 
instructions to "copy the setting", as 3225 says.

-- Sam (as doc editor)