Re: Beating an Old Horse, but....

Colm MacCárthaigh wrote:

----- Original message -----
> A preprocessor wouldn't do. The name-server would need to support EDNS0,
> and the smarts to include DS and RRSIG records correctly.

NSEC3 needs even more server-side processing for each query.

> It's a fairly large undertaking.

It took BIND several years to implement and debug.

Even if you do manage to add all the code necessary to support DNSSEC, where's the point in running _tiny_dns?

I like tinydns. It can serve large zones from a small memory footprint. I wouldn't want to load the 400MB copy of asn.routeviews.org into BIND.

But for DNSSEC zones, I rather use one of the not-so-tiny implementations, e.g. BIND or NSD. PowerDNS 
is coming along, too, and with Unbound, I have a validating resolver small enough to run on my mobile phone/computer gadget.

IMHO, DNSSEC is out of scope for tinydns and that's not necessarily a bad thing.


Hauke