[PATCH] Silence resolver logging for DNAME records when DNSSEC is enabled

[Carlos O'Donell]

On 02/23/2015 10:44 AM, Florian Weimer wrote:
> On 02/23/2015 04:41 PM, Carlos O'Donell wrote:
>>>> * The semantics of the DO bit remain roughly the same.
>>>
>>> That depends what the semantics are.  If “DO” means “DNSSEC OK”, then
>>> the semantics did change significantly.  If it means “you can send along
>>> random garbage, and I will cope”, semantics remained unchanged.
>>
>> Why? The original RFC says simply that the DO bit means "can accept DNSSEC
>> security RRs" but says nothing about needing to understand them.
> 
> The original RFC probably meant to restrict the effect to the record
> types known at the time (SIG and NXT, KEY is not relevant in this
> context).  glibc reflected this in its logging decision, the few DNS
> implementations which sent the DO bit by default apparently did not,
> which is why the flag was reused.

OK, we are on the same page. Thanks. We will continue to use the DO bit
to mean "We are OK with receiving additional unrelated records 
and will attempt to parse them to the best of our ability, or ignore
them." Which is all you can do if you don't understand the new RRs.

Cheers,
Carlos.