Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-dnssec-roadblock-avoidance-04.txt

From: Wes Hardaker <[email-masked]>
Date: Fri, 08 Jul 2016 13:57:41 -0700

Paul Wouters <[email-masked]> writes:

> Should item 3. be "if the answer is INSECURE" instead of "If the query
> is INSECURE" ?

Good catch, fixed.

> And should it be "w/o the DO and AD bit set" instead of "w/o the AD
> bit set" ?

I think not, because if the DO bit was set and you understand it but
need to return non-DNSSEC protected data, I think we should be returning
the DO bit but no AD or DNSSEC data.

I suppose you could argue that since we can't do DNSSEC we shouldn't say
we're DO (DNSSEC) compliant?
-- 
Wes Hardaker
Parsons