Subject: [DNSOP] DS records and validating resolvers

From: Einar Bjarni Halldórsson <[email-masked]>
Date: Thu, 14 Jul 2016 16:20:35 +0000

Hi,

I’ve looked and could not find an answer to my question anywhere.

If there are multiple DS records in a parent, with different key tags, where only one of the DS records has a corresponding DNSKEY record in the child zone that correctly signs the DNSKEY RRSET, will validating resolvers ignore the other DS records or could they cause responses from the child to become invalid?

.einar
ISNIC

---

From: Ólafur Guðmundsson <[email-masked]>
Date: Thu, 14 Jul 2016 12:33:01 -0400

One DS +DNSKEY is sufficient, others are ignored as they can be for past or
future keys.
The only exception is when the DS records are for multiple algorithms some
implementations demand that all algorithms are working

Olafur

On Thu, Jul 14, 2016 at 12:20 PM, Einar Bjarni Halldórsson <[email-masked]>
wrote:

> If there are multiple DS records in a parent, with different key tags,
> where only one of the DS records has a corresponding DNSKEY record in the
> child zone that correctly signs the DNSKEY RRSET, will validating resolvers
> ignore the other DS records or could they cause responses from the child to
> become invalid?
>
> .einar
> ISNIC
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Tony Finch <[email-masked]>
Date: Thu, 14 Jul 2016 17:33:25 +0100

Einar Bjarni Halldórsson <[email-masked]> wrote:
> where only one of the DS records has a corresponding DNSKEY record in
> the child zone that correctly signs the DNSKEY RRSET, will validating
> resolvers ignore the other DS records or could they cause responses from
> the child to become invalid?

Normally any individual DS record is sufficient to authenticate the DNSKEY
RRset - the others can be ignored.

However if there are DS records of multiple different algorithms then at
least one DS record of each algorithm must authenticate the DNSKEY RRset.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/  -  I xn--zr8h punycode
Humber, Thames: Northwest 4 or 5, becoming variable 3 or 4, becoming southwest
4 or 5 later. Slight or moderate, occasionally smooth. Fair. Good.