RFC 3655

Redefinition of DNS Authenticated Data (AD) bit ✨

Okay bestie, let's get into it 🎀 This is RFC 3655, a Standards Track doc from the Network Working Group, written by B. Wellington and O. Gudmundsson, dated November 2003. It updates RFC 2535 💜 and doesn't list any documents it obsoletes. It's giving official protocol energy 💅

Status of This Memo

This is an Internet standards track protocol for the whole Internet community 🌐 and the authors are literally asking for discussion and suggestions 💬 For where this protocol stands in standardisation, check the current edition of the "Internet Official Protocol Standards" (STD 1) 📋 And distribution of this memo is unlimited 🦋

Copyright Notice

Copyright (C) The Internet Society (2003). All Rights Reserved. 🌸

Abstract

Tea time ☕ The TL;DR is that this doc changes RFC 2535. Based on how people actually used it, the Authenticated Data (AD) bit in the DNS header turned out to be not that useful 😭 So it gets redefined. The AD bit is only set if every answer, or every record proving that no answers exist, in the response has been cryptographically verified or otherwise meets the server's local security policy 🔐 Iconic, honestly.

1. Introduction ✨

Knowing the DNS system [RFC1035] and the DNS security extensions [RFC2535] helps a lot 📚 but it's not required, so no pressure 🫶

As RFC 2535 (section 6.1) puts it, the AD (Authenticated Data) bit tells you that all data in the answer and authority sections of a response was authenticated by the server, according to that server's policies 🧚 Here's the tea: that's not especially useful in practice, because a conformant server SHOULD never reply with data that failed its security policy. Like, why would it? 🙈

So this document redefines the AD bit so it's only set if all data in the response has been cryptographically verified or otherwise meets the server's local security policy 💖 That means a response with properly delegated insecure data won't have the AD set, and neither will a server that's configured without DNSSEC keys 🙅‍♀️ Data that failed to verify still won't be returned, same as before. The main glow-up is this: an application on a host that trusts the server doing the recursive query can now read the AD bit to figure out whether the data is secure 🔥

1.1. Motivation

A full DNSSEC capable resolver that an application calls directly can hand the application the security status of the RRsets in the answer 👑 But most apps use a limited stub resolver that leans on an external recursive name server, which has a full resolver inside 🍓 The recursive nameserver can use the AD bit in a response to show the security status of the data in the answer, and the local resolver can pass that info along to the application ✨ The application here can be a human using a DNS tool or a software application, either one 💅

The AD bit SHOULD be used by the local resolver if and only if it has been explicitly configured to trust the remote resolver 🔐 The AD bit SHOULD be ignored when the recursive name server is not trusted 🙈

You could also embed a full DNSSEC resolver into every application instead, but that comes with some downsides 😬

• DNSSEC validation is both CPU and network intensive, and caching SHOULD be used whenever possible 💸
• DNSSEC requires non-trivial configuration. The root key must be configured, along with keys for any "islands of security" that will exist until DNSSEC is fully deployed 🗝️ The number of configuration points should be minimized, bestie 🫠

1.2. Requirements

The key words "MAY", "MAY NOT" "MUST", "MUST NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", in this document are to be interpreted as described in BCP 14, RFC 2119 [RFC2119] 📖 These are the official capital-letter key words, so pay attention to them 👀

1.3. Updated documents and sections

The definition of the AD bit in RFC 2535, Section 6.1, is changed 🔄 This is the exact spot being glow-upped ✨

2. Setting of AD bit

The CD (Checking Disabled) bit in a query does not affect how the AD bit is set in the response 🦋 If the CD bit is set, the server won't do the checking, but it SHOULD still set the AD bit if the data has already been cryptographically verified or complies with local policy 💅 The AD bit MUST only be set if DNSSEC records were requested via the DO bit [RFC3225] and relevant SIG records are returned 🔐 No DO bit, no AD bit, periodt 💀

2.1. Setting of AD bit by recursive servers

RFC 2535, Section 6.1 says:

"The AD bit MUST NOT be set on a response unless all of the RRs in the answer and authority sections of the response are either Authenticated or Insecure."

The replacement text reads:

"The AD bit MUST NOT be set on a response unless all of the RRsets in the answer and authority sections of the response are Authenticated."

"The AD bit SHOULD be set if and only if all RRs in the answer section and any relevant negative response RRs in the authority section are Authenticated."

So a recursive DNS server following this modified spec only sets the AD bit once it has cryptographically verified the data in the answer 🥰 Main character behaviour 👑

2.2. Setting of AD bit by authoritative servers

A primary server for a secure zone MAY have the policy of treating authoritative secure zones as Authenticated 🧁 Secondary servers MAY have the same policy, but they SHOULD NOT consider zone data Authenticated unless the zone was transferred securely and/or the data was verified 🙅‍♀️ An authoritative server MUST only set the AD bit for authoritative answers from a secure zone if it has been explicitly configured to do so 🔒 The default for this behaviour SHOULD be off 💜

Also, having the AD bit clear on an authoritative answer is totally normal and expected 🌈 Not a bug, just vibes.

2.2.1. Justification for setting AD bit w/o verifying data

Setting the AD bit on authoritative answers only affects the small group of resolvers configured to directly query and trust authoritative servers 🎯 It only matters for servers that act as both recursive and authoritative ✨ Iterative resolvers SHOULD ignore the AD bit 🫶

Verifying all signatures on load can be expensive for an authoritative server, and it pushes back how soon the server can start answering queries 🐢 Verifying signatures at query time is also costly, and it could make resolvers time out on lots of queries right after the server reloads zones 😭

Organisations that need every DNS response to contain cryptographically verified data will need to split the authoritative name server and the signature verification jobs into separate things, since name servers are not required to validate signatures for data they're authoritative for 🧩

3. Interpretation of the AD bit

A response with data marked Insecure in the answer or authority section MUST never have the AD bit set 🚫 In that case, the resolver SHOULD treat the data as Insecure, whether or not SIG records are present 🔍

Don't blindly trust the AD bit, bestie! A resolver MUST NOT blindly trust the AD bit unless it talks to a recursive nameserver over a secure transport mechanism, or uses a message authentication such as TSIG [RFC2845] or SIG(0) [RFC2931], AND it's explicitly configured to trust that recursive name server 🛡️

10. Normative References ✨

okay bestie, here are the docs this one leans on so hard it's basically their biggest fan 💅 I'm keeping every title, number, and date exactly as written because I'm not trying to be the one who misquotes an RFC 😭

[RFC1035] Mockapetris, P., "Domain Names - Implementation and
          Specification", STD 13, RFC 1035, November 1987.

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
          Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2535] Eastlake, D., "Domain Name System Security Extensions", RFC
          2535, March 1999.

[RFC2845] Vixie, P., Gudmundsson, O., Eastlake 3rd, D. and B.
          Wellington, "Secret Key Transaction Authentication for DNS
          (TSIG)", RFC 2845, May 2000.

[RFC2931] Eastlake, D., "DNS Request and Transaction Signatures
          (SIG(0))", RFC 2931, September 2000.

[RFC3225] Conrad, D., "Indicating Resolver Support of DNSSEC", RFC
          3225, December 2001.

11. Authors' Addresses 🦋

these are the two icons who wrote it, so here's where you can find them 🫶

Brian Wellington
Nominum Inc.
2385 Bay Road
Redwood City, CA, 94063
USA

EMail: Brian.Wellington@nominum.com


Olafur Gudmundsson
3821 Village Park Drive
Chevy Chase, MD, 20815
USA

EMail: ogud@ogud.com

12. Full Copyright Statement 🎀

this part is the legal stuff, so I'm keeping it word for word. no vibes changed here, promise 🙈

Copyright (C) The Internet Society (2003). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assignees.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🌸

funding for the RFC Editor function is currently provided by the Internet Society. the end, and we made it through together 🧚💜