Subject: Q-27 Setting AD for DNAME synthesis of CNAME

From: Olaf Kolkman <[email-masked]>
Date: Wed, 28 Jan 2004 14:24:37 +0100

This is a question regarding the interaction between the rules
governing the setting of an AD bit in a reply message and the
inclusion of a DNAME RR in an answer.  In addition to more rules, an
AD bit is to be set (to 1) only if the server has cryptographicly
verified each of the RRsets in the answer section of the message.
According to the rules governing the inclusion a DNAME RR in an answer
section, a synthesized CNAME RR is also included to assist older
implementations that might not understand the DNAME RR.

The question is whether it is appropriate to set the AD bit when a
signed, checked, DNAME RR set is in an answer, followed by its
synthesized, unsigned CNAME RR?  On the one hand, the CNAME RR is
unsigned and hence unchecked, suggesting the answer is no.  On the
other hand, the CNAME RR is verifiably generated via an algorithm from
a signed and checked DNAME RR, hence the AD bit can still be set in
the answer (barring other reasons to not set the AD bit).

The suggested answer is that setting the AD bit is appropriate with
the DNAME RR warrants it, regardless of there being the synthesized
CNAME RR.  If a client is unable to understand DNAME RR, the client is
also assumed to not be able to understand the AD bit.  If a client
does understand the DNAME RR, it can ignore the presence of the CNAME
RR, so the lack of a signature covering the CNAME is immaterial.

--Olaf

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Thu, 29 Jan 2004 00:55:09 +1100

> RR, so the lack of a signature covering the CNAME is immaterial.

	This also needs to extended to other synthesised records.

	If a zone is marked as secure (permitted by RFC 3655) then
	wildcard answers also set AD.

	The wording needs to be in terms of synthesised from secure
	rather than DNAME.  DNAME -> CNAME is a example of when you
	apply the rule.  This will future proof the spec.

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]