[DNSOP] Re: Fwd: New Version Notification for draft-sury-d nsop-rrsig-refused-00.txt

Thanks Shumon, that’s reasonable suggestion. I don’t have a strong opinion on that. I simply looked what CF is doing at the moment.

Neither option can be cached, so the only practical difference is the human perception.

Also the draft says it is already implemented in BIND 9, but currently it is just a merge request yet.

Ondřej
--
Ondřej Surý (He/Him)

A gentle nudge is always appreciated if I take a little longer to reply.

On 14. 8. 2026, at 21:38, Shumon Huque <[email protected]> wrote:



On Fri, Aug 14, 2026 at 2:34 PM Ondřej Surý <[email protected] > wrote:

Colleagues,

this is the first version of complement to RFC8482 that specifies how the DNS requestors

and DNS responders should behave in case of RRSIG query.

1. this already describes a practice of some DNS operators (Cloudflare, NS1)

2. it is important to realize that any validating resolver can't validate RRSIG(RR)

records without receiving RDATA for RR, so RRSIG queries for signed domains

can't be cached (not without significantly increasing a complexity)

3. RRSIG queries for signed domains have a same property as ANY queries,

but they are even worse. The ANY queries have a fringe debugging property,

the RRSIG responses are just "stuffing" that is being used for reflection attacks.

I agree with the goal of this draft, and that it would be good to refuse responses

for RRSIG queries.

I wonder though if rcode REFUSED and EDE 'Not Supported' is the ideal response.

In RFC9824, we introduced EDE 30 'Invalid Query Type', and we respond with

FORMERR for the NXNAME meta-type:

https://datatracker.ietf.org/doc/html/rfc9824#name-responses-to-explicit-queri

Implementations like BIND and Unbound already respond to unknown q & meta-type

type codes (and any meta-type that has no defined query behavior) with FORMERR.

And we tried to formalize that in this (now expired) draft:

https://datatracker.ietf.org/doc/html/draft-huque-dnsop-private-metatypes-00#name-handling-unknown-q-and-meta

Maybe that behavior should be generalized to include other types that should not

be allowed in queries too like RRSIG.

If the goal is to ban RRSIG queries, FORMERR and the Invalid Query Type EDE

carries a stronger semantic (there is a format error in the query, because it contains

an invalid or disallowed protocol element). By contrast, REFUSED and 'Not Supported'

implies the server may have refused to respond by policy or because it doesn't have

an answer, but that the query is not generally disallowed.

Shumon.

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]