ietf-corpus

rfc-3655

Redefinition of DNS Authenticated Data (AD) bit

B. Wellington, O. Gudmundsson
date2003-11 streamIETF areaint wgdnsext statusPROPOSED STANDARD pages8 canonicalhttps://www.rfc-editor.org/rfc/rfc3655 doi10.17487/RFC3655
This document alters the specification defined in RFC 2535. Based on implementation experience, the Authenticated Data (AD) bit in the DNS header is not useful. This document redefines the AD bit such that it is only set if all answers or records proving that no answers exist in the response has been cryptographically verified or otherwise meets the server's local security policy.

obsoleted by

updates

Extracted elements (23)

design-rationale §2.2.1

Authoritative servers are permitted (with explicit configuration) to set the AD bit without re-verifying signatures because the cost of verifying all signatures on zone load is high and increases startup delay; signature verification at query time could cause resolver timeouts after zone reloads.

dns, security

design-rationale §1.1

Embedding a full DNSSEC resolver into every application was rejected because DNSSEC validation is CPU and network intensive (requiring caching), and requires non-trivial configuration including root key and island-of-security keys; the AD bit approach minimizes configuration points.

dns, security

design-rationale §1

The original AD bit definition (RFC 2535 §6.1) was not useful in practice because a conformant server should never reply with data that failed its security policy, making the bit redundant. The redefinition makes AD meaningful by restricting it to cryptographically verified data.

dns, security

interoperability-note §2.2.1

Organizations requiring that all DNS responses contain cryptographically verified data must separate the authoritative name server and signature verification functions, since authoritative servers are not required to validate signatures of data for which they are authoritative.

dns, security

interoperability-note §5

This document updates RFC 2535 Section 6.1, replacing the AD bit definition. Resolvers trusting the AD bit must confirm the responder supports the updated definition, which is indicated by support for the DO bit (RFC 3225).

dns, security

normative-requirement §3 MUST NOT

A resolver MUST NOT blindly trust the AD bit unless it communicates with a recursive nameserver over a secure transport mechanism or using message authentication such as TSIG or SIG(0) and is explicitly configured to trust that server.

dns, security

normative-requirement §3 MUST

A response containing data marked Insecure in the answer or authority section MUST never have the AD bit set; the resolver SHOULD treat the data as Insecure whether or not SIG records are present.

dns, security

normative-requirement §2.2 MUST

An authoritative server MUST only set the AD bit for authoritative answers from a secure zone if it has been explicitly configured to do so; the default for this behavior SHOULD be off.

dns, security

normative-requirement §4 SHOULD NOT

In the absence of trust establishment (fiat, personal, or knowledge-based), the AD bit from a recursive name server SHOULD NOT be trusted. A roaming/traveling host SHOULD NOT use recursive DNS servers offered by DHCP when security status matters.

dns, security

normative-requirement §2.2.1 SHOULD

Iterative resolvers SHOULD ignore the AD bit, as its setting by authoritative servers only affects resolvers configured to directly query and trust authoritative servers.

dns

normative-requirement §2.2 SHOULD NOT

Secondary servers MAY treat zone data as Authenticated but SHOULD NOT do so unless the zone was transferred securely and/or the data was verified.

dns, security

normative-requirement §2.1 MUST NOT

The AD bit MUST NOT be set on a response unless all of the RRsets in the answer and authority sections of the response are Authenticated.

dns, security

normative-requirement §2 MUST

The AD bit MUST only be set if DNSSEC records have been requested via the DO bit (RFC3225) and relevant SIG records are returned.

dns, security

normative-requirement §2.1 SHOULD

The AD bit SHOULD be set if and only if all RRs in the answer section and any relevant negative response RRs in the authority section are Authenticated.

dns, security

normative-requirement §1.1 SHOULD

The AD bit SHOULD be used by the local resolver if and only if it has been explicitly configured to trust the remote resolver; it SHOULD be ignored when the recursive name server is not trusted.

dns, security

normative-requirement §2 SHOULD

The presence of the CD (Checking Disabled) bit in a query does not affect the setting of the AD bit; if CD is set, the server will not perform checking but SHOULD still set AD if data has already been cryptographically verified or complies with local policy.

dns, security

normative-requirement §4 RECOMMENDED

When no satisfactory recursive nameservers are available, running one locally is RECOMMENDED, as it can be trusted and allows applications using stub resolvers to use the AD bit.

dns

protocol-element §2

The AD (Authenticated Data) bit is a flag in the DNS response header. As redefined by this document, it is set only when all RRsets in the answer and authority sections have been cryptographically verified or meet the server's local security policy.

dns, security

protocol-element §2

The CD (Checking Disabled) bit in a DNS query signals that the server should not perform DNSSEC checking. Its presence does not alter AD bit setting logic for already-verified data.

dns, security

protocol-element §2

The DO (DNSSEC OK) bit, defined in RFC 3225, is a prerequisite for the AD bit: the AD bit MUST only be set if DNSSEC records were requested via DO and relevant SIG records are returned.

dns, security

security-consideration §5

Authoritative servers can be explicitly configured to set the AD bit without performing cryptographic checks; this behavior MUST be off by default and SHOULD only be used on servers acting as both authoritative and recursive name servers.

dns, security

security-consideration §5

Resolvers (full or stub) that blindly trust the AD bit without knowing the security policy of the server generating the answer cannot be considered security aware. Trust in the AD bit requires a secure transport (e.g., IPsec) or message authentication (TSIG, SIG(0)) plus explicit configuration.

dns, security

security-consideration §4

The AD bit MUST only be trusted when the end consumer has confidence in the trustworthiness of the intermediary resolver, established via out-of-band mechanisms such as organizational fiat, personal trust/reputation, or published server policy.

dns, security