Re: draft-weiler-dnsext-dnssec-2535-compat-00.txt

[Sam Weiler <weiler@tislabs.com>]

On Sun, 2 Mar 2003, Roy Arends wrote:
>
> Proposing new DNSSEC RR type codes implies upgrading resolvers,
> which seems to be exactly what you wanted to avoid.

DS already forces resolvers to upgrade if they want DNSSEC validation.

I'm trying to make sure that resolvers that don't understand DS at
least get (and don't discard) insecure answers.  The problem described
causes legacy resolvers to discard good data from signed zones.  If
that were likely to happen, some zones (cnn.com. being my favorite
example) would REALLY not want their parent to be signed.  I don't
want to see the CNN's of the world lobbying to keep .com from being
signed.

-- Sam


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>