On Sun, Jan 18, 2015 at 12:28:55AM +0100, Florian Weimer wrote: > > It would be nice if unbound were able to enforce "delegation-only" > > zones that contain only delegations and glue. This would be useful > > for the root zone and various TLDs. Otherwise, such zones can > > return apparently valid signed responses that should have been > > delegated to a child zone, but for some reason were not. > > There are very few strictly-delegation-only zones, and zones change > there status over time, so this feature seems fairly risky. The ISC > recommendations for BIND make recursors subject to denial-of-service > attacks that prevent name resolution for entire TLDs. Is the root zone at least compatible with a "delegation-only" policy? Can you be a bit more specific about the DoS? I've certainly seen ccTLD zones that are not delegation-only, for example "nic.li" is a CNAME for "switch.ch". That clearly is neither a delegation nor glue, so "li" is not "delegation-only". Without some constraints on which queries the root, gTLD and ccTLD can choose to answer rather than delegate, it seems difficult to make "transparency" work for DNSSEC. There is likely future work to be done here... On Sat, Jan 17, 2015 at 10:08:48PM +0000, Viktor Dukhovni wrote: > Also, how would one configure unbound to use an auto-trust-anchor-file > via RFC 5011 for a given gTLD or ccTLD? Any comment on my second question? If one enables RFC 5011 tracking for all the trust anchors one cares about, it is no longer necessary to worry about delegation-only above those trust anchors. -- Viktor.