Local-data in combination DNSSEC signed zones

Unbound
1

Hello,

I conducted a small test with the cool 'local-data' feature of Unbound
in combination with a signed zone. It seems to work, be it in an
'insecure' way for the 'local-data'.

My intuition tells me I might be doing something unnatural here, off
which I might not completely oversee the consequences.

Basically what I am wondering is if anyone has an opinion on this? I am
not exactly sure what think of it.

For example, Windows 7 has a policy-option in the “Name Resolution
Policy Table” to demand DNSSEC for certain domains (never actually tried
it):

https://www.dnssec.nl/pipermail/dnssec/attachments/20100120/ab304386/attachment-0001.png

You get the picture; When 'local-data' is used, Unbound might return
insecure answers, with no 'ad'-flag set, for a zone that is expected to
be secure.

I guess the way it works now is the best way to go, so I am not
advocating any changes here. Just wondering about other people's opinion
on this.

Regards,

2

I don't know about that. unbound is basically serving verifiably false information
without a ServFail and CD bit. I'd say that's probably wrong, and that it should
not allow overriding dnssec data with non-dnssec data. But that's pretty
much a "protocol view" over a "real world view". Though with more and more validating
resolvers out there, and those moving to the endusers, that data will be less
usefull and will get rejected ultimately anyway.

Paul