Why isn't DNSSEC enabled by default?

[webernetz]

Just because I am curious...

Querying with "dig" lists the AD flag by default.

[farrokhi]

The main reason is, I would like to keep the behavior consistent across releases to avoid confusion for user.

[webernetz]

Ok, I see what you mean. I have a different opinion though. ;) To my mind, (1) we should enforce DNSSEC anyway, and (2) since BIND packages (server as well as dig) are using DNSSEC by default, this would follow their approach.

[webernetz]

To my mind, the following is not consistent: I am querying an invalid as well as a valid DNS RR from a recursive DNS server which validates DNSSEC. Hence the invalid query gives a SERVFAIL while the valid query does currently NOT display the AD flag though we know that the resursive DNS servers has validated it:

weberjoh@nb17-lx2:~/dnsdiag$ ./dnsping.py --server 1.1.1.1 --flags sigfail.verteiltesysteme.net
dnsping.py DNS: 1.1.1.1:53, hostname: sigfail.verteiltesysteme.net, proto: UDP, rdatatype: A, flags: RD
63 bytes from 1.1.1.1: seq=1   time=18.195 ms [QR RD RA]  SERVFAIL
63 bytes from 1.1.1.1: seq=2   time=10.134 ms [QR RD RA]  SERVFAIL
63 bytes from 1.1.1.1: seq=3   time=9.785 ms [QR RD RA]  SERVFAIL
63 bytes from 1.1.1.1: seq=4   time=9.705 ms [QR RD RA]  SERVFAIL
^C
--- 1.1.1.1 dnsping statistics ---
4 requests transmitted, 4 responses received, 0% lost
min=9.705 ms, avg=11.955 ms, max=18.195 ms, stddev=4.164 ms
weberjoh@nb17-lx2:~/dnsdiag$ ./dnsping.py --server 1.1.1.1 --flags sigok.verteiltesysteme.net
dnsping.py DNS: 1.1.1.1:53, hostname: sigok.verteiltesysteme.net, proto: UDP, rdatatype: A, flags: RD
71 bytes from 1.1.1.1: seq=1   time=17.014 ms [QR RD RA]  NOERROR
71 bytes from 1.1.1.1: seq=2   time=2.676 ms [QR RD RA]  NOERROR
71 bytes from 1.1.1.1: seq=3   time=2.530 ms [QR RD RA]  NOERROR
71 bytes from 1.1.1.1: seq=4   time=2.354 ms [QR RD RA]  NOERROR
^C
--- 1.1.1.1 dnsping statistics ---
4 requests transmitted, 4 responses received, 0% lost
min=2.354 ms, avg=6.144 ms, max=17.014 ms, stddev=7.248 ms