[Bloat] Apple ECN, Bufferbloat, CoDel

[Mikael Abrahamsson]

On Sat, 13 Jun 2015, Dave Taht wrote:

> I don't understand how badly this is going to break dnssec. dnsmasq in 
> particular has been dealing with edge case after edge case on dnssec for 
> the last few months, and it was my hope we'd finally got them all.

DNS64 breaks DNSSEC because it creates an AAAA response where none is 
present in the zone being queried. It's basically doing MITM for DNS, 
which is exactly what DNSSEC was supposed to fix.

DNSSEC would work if Apple decided to just do NAT64 discovery and then do 
their own DNS64 in the host, but I have no information as to what is being 
done here.

At least DNSSEC still works between the Internet and the ISP DNS64 
resolver, but the end host won't be able to verify the response using 
DNSSEC.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se