Re: secure entry point

["Olaf M. Kolkman" <olaf@ripe.net>]

> yes.. so if I spoof the secure entry IP for .nl, the whole of .nl is bad

Yes.. Bad luck I'd say.

DNSSEC does not provide for a way to check the delegation. If a
delegation points you to the wrong server your lost; that is to be
seen as a DOS attack.

If you want to be 'resistant' to drop of connectivity to the root than
have your recursive servers be slave of your local domains. That can
be done independend of your "trusted-keys".

DNSSEC does not give a bit about where data came from. Let's not add
that dependency in the resolv.conf you (provide buckshots to shoot ones
foot off :-) ) 


--Olaf

--------------------------------------------| Olaf M. Kolkman
                                            | www.ripe.net/disi


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>