Subject: DNAME Issue 15: Synthesized CNAME RRs

From: Scott Rose <[email-masked]>
Date: Thu, 08 Feb 2007 07:40:53 -0500

Issue 15: Should servers omit synthesized CNAME RRs?

This is a new issue that was brought up during the IETF67
DNSEXT WG meeting.

In section 3.3 of draft-ietf-dnsext-rfc2672bis-dname:

    The EDNS DNSSEC-OK bit signals understanding
    of the DNAME record [RFC4034].  If set, the
    synthesized CNAME MAY be omitted, since it is
    not signed and therefore not useful for
    validation and a waste of bandwidth.

Also from the draft:

    TBD: Is this useful to specify?  Resolvers MUST
    be able to handle unsigned responses with only
    the CNAME, or with the DNAME only, or both CNAME
    and DNAME.  Resolvers that query with DNSSEC_OK
    MUST be able to handle signed responses with
    only the DNAME, or with the unsigned synthesized
    CNAME included.

Validators will reconstruct the CNAME from the signed
DNAME, not needed the synthesized CNAME.  Older resolvers
would still need it, but most likely NOT signal DNAME
understanding.

Would it be acceptable for servers to not include
synthesized CNAME RRs in a response if the DNSSEC OK
flag is set in the query?  A signed DNAME RR would
exist in the response.

Scott & Wouter
The DNAME clarification draft editors
-- 
----------------------------------------
Scott Rose            Computer Scientist
NIST
ph: +1 301-975-8439
[email-masked]

http://www-x.antd.nist.gov/dnssec
http://www.dnssec-deployment.org/
-----------------------------------------

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>