Subject: Re: [DNSOP] draft-zhang-dnsop-weak-trust-anchor.txt

From: "张海阔" <[email-masked]>
Date: Sun, 01 Jun 2014 23:13:29 +0800

If the resolver got the tampered DNS package and the DNSSEC verification failed, the resolver should give a bogus answers to the end-user.
If the DNSSEC package has been lost or dropped, the resolver which configured with weak trust anchor would give an insecure answer.

------------------ original email------------------
>From: Evan Hunt <[email-masked]>
>Reply-To: 
>To: haikuo<[email-masked]>
>Cc: [email-masked], [email-masked]
>Subject: Re: [DNSOP] draft-zhang-dnsop-weak-trust-anchor.txt
>Date: Sat, 31 May 2014 16:09:59 +0000
>

> If the verification is failed, it should response "Bogus"
> If the resolver do not get enough data to do the verification, then the
> resolver which weak trust anchor should be response with "insecure" DNS
> package. it is up to end-user or netizens to decide what to do next.

If the resolver didn't get enough data, but should have, then the
validation failed and the answer is bogus.  Your proposal effectively
promotes all bogus answers to insecure.

-- 
Evan Hunt -- [email-masked]
Internet Systems Consortium, Inc.