Protect the last hop separately
04A validating recursive resolver and a stub client are distinct trust boundaries.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 5 ↗
RFC 4033 · § 5EXAMPLE
3 / 3
03
Secure the last hop or validate at the stub as appropriate.
Secure the last hop or validate at the stub as appropriate.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
A security-aware stub must either validate itself or trust its resolver over an appropriately protected channel.
- A security-aware stub must either validate itself or trust its resolver over an appropriately protected channel.
- DNSSEC does not itself encrypt queries or secure every resolver-to-client hop.
The drawing is a simplified worked example. Follow the linked RFC and its updates for implementation requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy