Subject: how to handle DS?

From: Alexis Yushin <[email-masked]>
Date: Tue, 4 Sep 2001 12:21:05 +0200 (CEST)

Hi,

We're currently looking at the possibility of implementing DS
records for BIND 9 here at NLnet Labs... I could not find any
information on how DS records should be handled when actual
resolving takes place. Below is my idea of how it should work.

Imagine we have a secured root and a cache forwarder trying to
resolve the following query:

Q1 .		www.a.b.	A

A1 . -aa

	answ:	-

	auth:	b.		NS	ns.b.
		b.		DS .
		b.		SIG DS .

	add:	.		KEY
		.		SIG KEY
		ns.b.		A glue

Q2 ns.b.	www.a.b.	A

A2 ns.b. -aa

	answ:	-

	auth:	a.b.		NS	ns.a.b.
		a.b.		DS
		a.b.		SIG DS

	add:	b.		KEY
		b.		SIG KEY
		ns.a.b.		A	ip-address

Q3 ns.a.b.	www.a.b.	A

A3 ns.a.b. +aa

	answ:	www.a.b.	A	ip-address
		www.a.b.	SIG	A ip-address

	auth:	a.b.		NS	ns.a.b
		a.b.		SIG	NS

	add:	a.b.		KEY
		a.b.		SIG KEY
		ns.a.b.		A	ip-address

Is this correct? Any comments?

Alexis

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Ólafur Guðmundsson <[email-masked]>
Date: Tue, 04 Sep 2001 23:10:48 -0400

>resolve the following query:

I have assumed that the DS would go in the additional section (unless it is
in the answer section).

>                 ns.a.b.         A       ip-address

almost, A has higher priority than KEY thus it should be before the
Question should the DS have higher priority than the KEY for a. ?

>                 www.a.b.        SIG     A ip-address

Other than order in additional section this looks about right.

         Olafur