Re: [Cerowrt-devel] [Dnsmasq-discuss] test-ipv6.com vs dnssec

[James Cloos <cloos@jhcloos.com>]

>>>>> "DT" == Dave Taht <dave.taht@gmail.com> writes:

DT> As one example of a registrar not with the program, name.com
DT> (registrar for bufferbloat.net) does not allow for ds records to
DT> come from it, so that domain can't be fully signed.

DT> So it sounds to me as if negative proofs are not possible with
DT> registrars that lack this support?

No.  Signed parent zones (like com, net, org) always provide either a
signed DS record if it exists or proof of non-existance.

Try doing:

dig @i.gtld-servers.net. bufferbloat.net ds +dnssec

The two nsec3 records (each signed by an rrsig record) prove that there
is no DS record in net. with the name bufferbloat.net.

Compare that with what you get asking for ns records:

That replies with the two ns records, as well as the proof that the DS
records do not exist.

Now, try with a zone which is signed:

dig @i.gtld-servers.net. jhcloos.net ns +dnssec
dig @i.gtld-servers.net. jhcloos.net ds +dnssec

The first returns both the ns and ds records, with an rrsig over the ds
records (returned in the authority section); the latter returns the
signed ds records in the answer section and net's own signed ns set in
the authority section.

Given that some zones have nameservers which fail to respond if they do
not like or understand the query, it seems that only root-down verifi-
cation can work.  Unless I'm missing something....

-JimC
--
James Cloos <cloos@jhcloos.com>         OpenPGP: 0x997A9F17ED7DAEA6