Subject: Fw: DNSSECbis Q-16 suggested text CORRECTION

From: "Scott Rose" <[email-masked]>
Date: Tue, 2 Sep 2003 07:22:22 -0400

The last sentence should read:  "However, if the DO bit is not set, the name
server side MUST strip all DNSSEC related RRsets from the final response."

Sorry
Scott

----- Original Message ----- 
From: "Scott Rose" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, September 02, 2003 7:20 AM
Subject: DNSSECbis Q-16 suggested text

> Looking back at the suggested text, I realize I agreed with Andreas but
> misinterpreted the text based on previous discussions.
>
> The DO and CD bit should not be able to override each other, as they have
> different meanings to the resolver.  Suggested text for the last paragraph
> of section 4.1:
>
> "The name server side of a security-aware recursive name server MUST
> pass the sense of the CD bit to the resolver side along with the rest
> of an initiating query, so that the resolver side will know whether
> whether or not it is required to verify the response data it returns
> to the name server side.  The name server side is not required to pass
> the sense of the DO bit to the resolver side depending on local policy.
> However, if the DO bit is set, the name server side MUST strip all DNSSEC
> related RRsets from the final response."
>
>
>
> Comments welcome.
>
> Scott
>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>