Subject: Re: Q-03: inclusion of KEY records in additional records section

From: Paul Vixie <[email-masked]>
Date: Thu, 24 Apr 2003 05:44:07 +0000

> Listed below in order of frequency of inclusion of KEY RRset
> in additional section:
> 	1. Always include covering KEY
> 	2. Include covering KEY on referral only
> 	3. Never
> Please express preference on which rule to pick, and why.

#3.  the time the KEY is needed is the first time a validator sees a SIG
with that keyname.  there is no way for a server to know when that's 
occuring.  including it every time the SIG is exposed (as in #1 above)
would waste resources.  including it only in the case of a referral (#2
above) misses the target since the next key the validator will need is
in the child zone and won't be the one you're including.

> Should inability to include one or both of the KEY RRsets cause the
> TC bit to be set ? (RFC2535 said no)

no.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Thu, 24 Apr 2003 18:25:36 +0000

> > >       Additional section: glue addresses signed by gtld-servers.net.
> >
> >Glue was never to be signed, or has this been changed recently?
> 
> In this case the server is authoritative for .com and gtld-servers.net.,
> so in this case the use of the word "glue" is wrong, but I'm not sure
> what the right term is ?

it's still glue.  the protocol doesn't permit a client to impute authority
of additional data based on name-similarity to data in other sections which
is claimed as authoritative.