Re: Naked domain resolution with DNSSEC
Dave Lawrence <[email protected]>
| Newsgroups | gmane.ietf.dnsext |
|---|---|
| Message-ID | <[email protected]> |
Sourav Sain writes: > Presented below is a name resolution for "facebook.com, type=A". In > the first name resolution against "218.248.240.179" we see that > "69.171.239.12#53(a.ns.facebook.com)" ends up returning an A record > for QName=facebook.com. Since COM is signed A record for facebook.com > needs to have an RRSIG(A) in the response, which, obviously is missing > as a.ns.facebook.com cannot return the signature for A using keys > owned by COM. Our concern is, a security aware validating server, > having root or COM's Trust Anchor, will expect an RRSIG in the > response for facebook.com, type=A, not having which, will conclude the > response as BOGUS. To expand a little on the answer that Jim Reid gave, it is important to remember the principle that for records at a zone cut, almost all records are authoritatively owned by the delegated zone, not the delegator. The only exception to this is the DS record. Therefore this sentence from above, and the crux of your problem, is not correct: > Since COM is signed A record for facebook.com needs to have an > RRSIG(A) in the response A properly written, standards-compliant validating resolver will recognize that when it originally asked the GTLD servers for facebook.com it got a provably insecure delegation to the facebook.com nameservers. Therefore it will know that all records within the zone, including those at the apex, will not come with signatures. _______________________________________________ dnsext mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsext