Naked domain resolution with DNSSEC

Hi 

In a scenario where,

Server NS1 hosts myzone.com (myzone.com is not DNSSEC signed) with an A record at zone apex { myzone.com A 10.0.0.1 }
And 
COM server hosts NS for myzone.com pointing to NS1

If the Query for A record of type myzone.com goes to  ROOT server from a DNSSEC validating resolver

Now as ROOT ( "." ) zone is signed. Root says that COM is signed by replying with DS record for COM.
A DNSSEC aware resolver with this data will conclude that COM is signed. Hence a record under COM should be signed unless it's a delegation NS record (at the zone cut).
COM replies with NS record pointing to NS1 without any RRSIG and NSEC3 (as DS for myzone.com is absent indicating an insecure delegation), which is expected.

Next the DNSSEC validating resolver asks NS1 for myzone.com. To this resolver a record under COM MUST have RRSIG.
But NS1 that hosts the myzone.com responds for the A query with an A record without any RRSIG.
The resolver was expecting a signed response for everything under COM, gets an unsigned response and marks them as BOGUS and returns a SERV_FAIL
Some resolvers, do let the response pass but with AD bit set to 0 which a DNSSEC aware end client may not accept.

Is there any guidance around this?

Thanks
Ashu



_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext