<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
I suppose many of us read Google's announcement yesterday:<br>
<br>
<a class="moz-txt-link-freetext" href="http://googleonlinesecurity.blogspot.nl/2013/03/google-public-dns-now-supports-dnssec.html">http://googleonlinesecurity.blogspot.nl/2013/03/google-public-dns-now-supports-dnssec.html</a><br>
<br>
Now, Google Public DNS only validates when either the DO-bit or,
according to RFC6840, the AD-bit is set in the query.<br>
<br>
<a class="moz-txt-link-freetext" href="https://developers.google.com/speed/public-dns/faq#dnssec">https://developers.google.com/speed/public-dns/faq#dnssec</a><br>
<br>
Validation upon request, instead of ignoring validation by means of
the CD-bit, so to speak.<br>
<br>
In a way, I kind of like the idea. As for some environments -such as
the one at Google- it might (for now) be a good alternative.It sort
of adheres to the idea; "everything stays the same, unless you want
it to be different" (which at the same time may be considered as
undesirable...).<br>
<br>
Anyway...<br>
<br>
I was wondering what the opinions are on this list, regarding the
design-choices of Google. And if this feature is being considered
for Unbound (in addition to the already present '
<meta charset="utf-8">
val-permissive' mode)?<br>
<br>
Regards,<br>
--<br>
Marco<br>
<br>
</body>
</html>