Re: Breaking up a class for delegation

55 msg	What is sysquery ?
57 msg	BIND 9.4.1-P1 compilation settings.
2 msg	Identifying and deleting unused DNS entries
1 msg	LISA '07 - Latest News and Top 5 Reasons to Attend

Breaking up a class for delegation
\ Bischof, Ralph F. (MSFC-NNM04AA0 (24 Sep 2007)
. \ Chris Buxton (24 Sep 2007)
. \ Dawn Connelly (24 Sep 2007)
. \ Niall O'Reilly (24 Sep 2007)
. . \ Curt Sampson (25 Sep 2007)
. . . \ Niall O'Reilly (26 Sep 2007)
. \ Mark Andrews (26 Sep 2007)
. \ Mark Andrews (26 Sep 2007)

24 msg	Problems with our migration from MS to BIND thi...
6 msg	rndc stats on SLES 10 (BIND 9.3.2)
2 msg	Rndc stats not showing correct figures
3 msg	Bind 9
3 msg	How to create my own RPM from RPM source?
2 msg	xfer-in.log errors
1 msg	Re: Views causing zone transfer problems? RESOLVED
4 msg	Views causing zone transfer problems?
3 msg	NS server coming up lame
2 msg	New version of Bind9 LDAP SDB driver - HOWTO?
3 msg	chaching is possible on dns-ldap?
2 msg	Reg : DNS Cache poisoning
3 msg	from nslookup's query
2 msg	log file flags...
4 msg	Performance issues

Subject:	Re: Breaking up a class for delegation
Group:	Bind-users
From:	Mark Andrews
Date:	26 Sep 2007

> I'm led to believe that a resolver can't properly support DNSSEC
> unless it supports DNAME. I haven't fully understood the argument,
> but understand that some unacceptable corner cases arise otherwise.

The synthesized CNAME is unsigned. To be validate the CNAME
you need to be able to validate the DNAME and understand what it
does. In practice DNAME aware resolvers ignore the CNAME and
just regenerate it when required using the DNAME.

> /Niall
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews