Subject: validating a qtype=* response

From: David Blacka <[email-masked]>
Date: Thu, 19 May 2005 14:55:54 -0400

It occurred to me that is isn't totally obvious how a DNSSEC validator 
should validate a (non rcode=3) response to a qtype=* (or qtype=ANY, if 
you will) query.

I can think of 2 approaches:

1. Verify any answer section rrsets (that match qname+qclass, that is). 
     If there are no answer section rrsets, validate via a authority 
section NSEC that qname is, in fact, an empty-non-terminal.  Validate 
the authority section as normal.

2. Don't validate it at all, don't set the AD bit.

Opinions?  #1 makes the most sense to me, but I see an appeal in #2 
(less work, what is the qtype=* query used for anyway?).

Does this need additional clarification?  I'm thinking that this sort of 
thing might go into Sam's bis-updates document, but it could've been 
obvious to everyone else.

-- 
David Blacka    <[email-masked]>
Sr. Engineer    VeriSign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>