[dns-operations] DNSSEC in the root, please help me understand

[Stephane Bortzmeyer]

On Fri, Jan 15, 2010 at 01:07:21AM -0800,
 Matthew Dempsky <matthew at dempsky.org> wrote 
 a message of 12 lines which said:

> > So, it [DNSSEC] works (it allows you to detect forgeries) even if
> > you are redirected to the wrong name server.
> 
> Not if the server you're directed to isn't using DNSSEC.  

Not true. If a cracker redirects you to a non-DNSSEC root name server,
the validating resolver, having a trust anchor for the root, will see
there is a problem and will report it. (Same thing for other domains,
with the DS record.)

> ensuring you can reject the wrong data is different from ensuring
> you can accept the right data.

No protocol can protect you against denial-of-service ("preventing you
for getting the right data"). No DNSSEC, but no others.