[DNSOP] Re: PQ DNSSEC?

Mukund Sivaraman <[email protected]> Tue, 21 Jul 2026 04:51:38 +0800
Newsgroups	gmane.ietf.dnsop
Message-ID	<al6KWrKIS8QaIR5y@p5>
Hi Peter

On Mon, Jul 20, 2026 at 03:32:40PM +0200, Peter Thomassen wrote:
> Hi Mukund,
> 
> On 7/20/26 10:14, Mukund Sivaraman wrote:
> > If it's that answer + RRSIG RRsets ought to pass over UDP to a client
> > that's not a validating resolver which queries for it and it can't pass
> > over UDP, it'll get a response with TC=1 for DO=1 and won't be able to
> > query it over UDP. But can this not be considered negligible considering
> > the client can't do UDP and it's not going to be validating? RFC 6840
> > allows AD flag signal in the response if the query has AD=1 even if
> > DO=0, so a client that can only use UDP and wants just the answer but
> > also wants to know if it is authenticated can still get just that signal
> > in the AD bit without any of the RRSIGs, and the validation happens on a
> > resolver that's capable of TCP.
> 
> That clients don't validate is the current operational reality, but not a DNSSEC design limitation. Clients can get all the info they need to do validation, and things like RFC 7901 can make it easier.
> 
> Just reducing clients' role in DNSSEC (including their future role) to looking at the AD bit is a significant conceptual change to the security model, turning current practical issues into a design limitation -- and that in my view undermines the whole concept.

My last response was not to withhold DNSSEC RR types for all clients. It
mentioned that a client that's limited to UDP with small datagram sizes
can still receive answers with a DNSSEC AD indicator. A client that can
use DNS over TCP can receive anything. The point was, can a client
that's limited to UDP be considered a negligible case?

		Mukund

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]
signature.asc (application/pgp-signature, 1.5 KB)