RRSIGs in additional section
Kumar Ashutosh <[email protected]> Fri, 15 Nov 2013 12:07:36 +0000
| Newsgroups | gmane.ietf.dnsext |
|---|---|
| Message-ID | <E66B38BB793BAF439EF374F3E7EBEE464B63C0E2@SINEX14MBXC415.southpacific.corp.microsoft.com> |
Hi As per RFC 4035 section 3.1.1 When placing a signed RRset in the Additional section, the name server MUST also place its RRSIG RRs in the Additional section. If space does not permit inclusion of both the RRset and its associated RRSIG RRs, the name server MAY retain the RRset while dropping the RRSIG RRs. If this happens, the name server MUST NOT set the TC bit solely because these RRSIG RRs didn't fit. If such a response is received by a caching resolver it may Cache the RRSet in additional section without their RRSIGs and subsequent queries from this resolver might be responded without RRSIGs. Will not this lead to issues? Is there any update to this behaviour? Am I missing something? Thanks Ashu _______________________________________________ dnsext mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsext