Subject: Re: [dnsext] caches, validating resolvers, CD and DO

From: [email-masked]
Date: Thu, 21 Apr 2011 19:04:07 +0000

On Thu, Mar 31, 2011 at 07:27:42AM -0700, Nicholas Weaver wrote:
> 
> > I agree in principle, however that policy can also be "trust the caching
> > recursive resolver."  Saying that the client MUST validate does not
> > allow for this trusting policy.
> > 
> > -derek
> 
> Good point, however, the default policy should still be a must, since your configuration is rather unusual:  DNSSEC enables DNS to not trust the recursive resolver, and the default policy should take advantage of this.
> 
> Defaults should provide maximum safety and maximum interoperability for the majority of the clients.
> 

	so your saying the default should be MUST - but the default MUST be over-ridable?

/bill
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext