Subject: Re: trustworthy MX->A caching

From: "D. J. Bernstein" <[email-masked]>
Date: 20 Dec 1999 19:59:37 -0000

Robert Elz writes:
> Where are those "rules" supposed to come from, and what exactly are
> they supposed to be?

The basic anti-poisoning rule is that records for (e.g.) sun.com must
come from the root servers, the .com servers, or the sun.com servers.

This rule reflects the hierarchical structure of DNS delegation. An
empty cache that wants information about sun.com will contact the roots,
then possibly the .com servers, then possibly the sun.com servers.

The same rule is enshrined by DNSSEC. Under DNSSEC, the only servers
that have power over sun.com are the root servers, the .com servers, and
the sun.com servers.

> The "ancient examples that would never have happened with NS limits"
> are still current examples,

No. The examples don't obey NS limits. They are rejected as poison by
BIND 4.9.6 and above. They are rejected as poison by my new cache.

I don't care what benefits you think the ``credibility'' idea has for
caches that don't enforce NS limits. Those caches are obsolete. They are
explicitly excluded from my questions.

---Dan