Subject: [DNSOP] Authoritative Servers and the AD bit

From: Peter DeVries <[email-masked]>
Date: Thu, 9 Jun 2016 09:14:28 -0400

Is there updated text that matches this from RFC3655:

"The AD bit MUST only be set if DNSSEC records have been requested via
the DO bit [RFC3225] and relevant SIG records are returned."

We are observing a system that is setting the AD bit both without the
DO bit set in the query and without supplying RRSIGs but I can't find
any relevant text in the new RFCs.

Thank you,
Peter

---

From: Evan Hunt <[email-masked]>
Date: Thu, 9 Jun 2016 15:00:57 +0000

> any relevant text in the new RFCs.

If the AD bit was set in the query that's being answered, that's
legit under RFC 6840 sections 5.7 and 5.8.

-- 
Evan Hunt -- [email-masked]
Internet Systems Consortium, Inc.