<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>The question to answer is: How many stub resolver do set DO/AD flag or eve allow to set it? So this doesn't make much sense to me to implement in Unbound too, since I consider this practically useless.<br><br>Ondřej Surý</div><div><br>On 20. 3. 2013, at 7:49, "Marco Davids (SIDN)" <<a href="mailto:marco.davids@sidn.nl">marco.davids@sidn.nl</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
Hi,<br>
<br>
I suppose many of us read Google's announcement yesterday:<br>
<br>
<a class="moz-txt-link-freetext" href="http://googleonlinesecurity.blogspot.nl/2013/03/google-public-dns-now-supports-dnssec.html">http://googleonlinesecurity.blogspot.nl/2013/03/google-public-dns-now-supports-dnssec.html</a><br>
<br>
Now, Google Public DNS only validates when either the DO-bit or,
according to RFC6840, the AD-bit is set in the query.<br>
<br>
<a class="moz-txt-link-freetext" href="https://developers.google.com/speed/public-dns/faq#dnssec">https://developers.google.com/speed/public-dns/faq#dnssec</a><br>
<br>
Validation upon request, instead of ignoring validation by means of
the CD-bit, so to speak.<br>
<br>
In a way, I kind of like the idea. As for some environments -such as
the one at Google- it might (for now) be a good alternative.It sort
of adheres to the idea; "everything stays the same, unless you want
it to be different" (which at the same time may be considered as
undesirable...).<br>
<br>
Anyway...<br>
<br>
I was wondering what the opinions are on this list, regarding the
design-choices of Google. And if this feature is being considered
for Unbound (in addition to the already present '
<meta charset="utf-8">
val-permissive' mode)?<br>
<br>
Regards,<br>
--<br>
Marco<br>
<br>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Unbound-users mailing list</span><br><span><a href="mailto:Unbound-users@unbound.net">Unbound-users@unbound.net</a></span><br><span><a href="http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users">http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users</a></span></div></blockquote></body></html>