Re: Protection of unsecured delegations

[Paul Vixie <paul@vix.com>]

> > I can see resolvers doing any of:
> > 
> > [a] Do the lookup and only return trusted data.  Not useful to me
> > until everyone I care about has opted in..
> > 
> > [b] If there's trusted data anywhere on the path, return the first
> > trusted answer, otherwise return the first non-trusted answer.
> > 
> > [c] Return the first name along the path for which a query returns
> > some data.
> 
> Maybe I'm the only one, but I'm sorry, I don't understand your [b] or [c].
> 
> For [b], what do you mean "return the first trusted answer" and "first
> non-trusted answer"?  I don't understand "first" in this context.

see the "search" directive of /etc/resolv.conf.

bill's examples are the first i've seen of how common applications will
benefit from dnssec.  counter proposals should look like API specifications.


to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.