Re: DS and Opt-in - a proposal

[Greg Hudson <ghudson@mit.edu>]

On Fri, 2001-12-28 at 01:50, bert hubert wrote:
> I seem to keep hammering this point - have clientside people been involved
> yet? The vast majority of DNS lookups right now are A queries, and most of
> those come from the browser.

In the Unix world, at least, the applications shouldn't have to get
involved, just the recursive resolver (named, traditionally) and to some
extent the stub resolver in libc.  The application may be interested in
knowing whether a DNS record was signed, but even if it doesn't care, a
signed record can't be subverted by DNS spoofing.

I don't know enough about the non-Unix world (which, admittedly, is
where most of the users are) to comment on it.



to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.