On 28Sep 2007, at 12:03 AM, Mark Andrews wrote:
The background to this story is that a popular implementation started shipping code that sets the AD bit on validated responses even though the DO bit was not set on the query. These answers are getting stuck in the filters of popular DSL modems. The result being that data from secured zones would not be resolved.Note this was legal to do back in 1999 when DNSSEC was first released.
That is noted, I think that the behavior then made sense, just as it makes sense today.
Unfortunately we are only seeing deployment 8 years later and now the world is stuffed with DSL modems that do not expect the AD bit to be set and are less liberal in what they except then they should.
--Olaf ----------------------------------------------------------- Olaf M. Kolkman NLnet Labs http://www.nlnetlabs.nl/
Attachment:
PGP.sig
Description: This is a digitally signed message part