[Cerowrt-devel] [Dnsmasq-discuss] test-ipv6.com vs dnssec

[Török Edwin]

On 04/28/2014 10:57 PM, James Cloos wrote:
>>>>>> "DT" == Dave Taht <dave.taht at gmail.com> writes:
> 
> DT> As one example of a registrar not with the program, name.com
> DT> (registrar for bufferbloat.net) does not allow for ds records to
> DT> come from it, so that domain can't be fully signed.
> 
> DT> So it sounds to me as if negative proofs are not possible with
> DT> registrars that lack this support?
> 
> No.  Signed parent zones (like com, net, org) always provide either a
> signed DS record if it exists or proof of non-existance.
> 
> Try doing:
> 
> dig @i.gtld-servers.net. bufferbloat.net ds +dnssec
> 
> The two nsec3 records (each signed by an rrsig record) prove that there
> is no DS record in net. with the name bufferbloat.net.
> 
> Compare that with what you get asking for ns records:
> 
> That replies with the two ns records, as well as the proof that the DS
> records do not exist.
> 
> Now, try with a zone which is signed:
> 
> dig @i.gtld-servers.net. jhcloos.net ns +dnssec
> dig @i.gtld-servers.net. jhcloos.net ds +dnssec
> 
> The first returns both the ns and ds records, with an rrsig over the ds
> records (returned in the authority section); the latter returns the
> signed ds records in the answer section and net's own signed ns set in
> the authority section.
> 
> Given that some zones have nameservers which fail to respond if they do
> not like or understand the query, it seems that only root-down verifi-
> cation can work.  Unless I'm missing something....

Given that a NS is more likely to get answered than a DS (by a nameserver
that is broken/doesn't support DNSSEC), can you make a NS query, and decide
based on the reply whether you should switch to a top-down verification?
i.e. if the NS answer included everything you wanted, then you're done,
otherwise, for broken nameserver, you fallback to verifying from the root that 
they're indeed unsigned.
Does that make sense, or the NS reply doesn't have all the required info?

Best regards,
--Edwin