Is there a way for a domain
good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host
*.good.com should be rejected? In other words, is there a way for a zone to provide a signed statement indicating that it is DNSSEC protected, and to suggest that DNSSEC clients can use strict signature checking for DNS records in that zone?
This would be analogous to a HSTS record (where a site opts into only HTTPS, and suggests that browsers should reject any attempts to connect through insecure HTTP), or a SPF policy that opts into strict checking (stating that emails that don't comply with the SPF policy should be rejected).
Background (as I understand it). In principle, DNSSEC provides protection against man-in-the-middle attacks: the client can check whether the DNS response has a valid signature, and ignore all unsigned responses and responses with invalid signatures. Unfortunately, in practice, this has an unacceptable compatibility cost. If you treat all unsigned responses as invalid, then you "break the Internet": some sites stop working, either because the domain isn't consistently signing all records, or (I'm told) because signatures occasionally get stripped by middleboxes.
As a result, for practical deployment reasons, many DNSSEC-capable clients are actually non-validating: they look at the signature, but if the signature is missing, they still accept the DNSSEC response. (Even Google's public DNS resolver will do this in some cases.)
This opens up a nasty man-in-the-middle attack: the man-in-the-middle simply strips all of the DNSSEC signatures, and then modifies the records however he likes. If the client accepts unsigned DNS responses, this man-in-the-middle attack negates the value of DNSSEC. Of course the other side of this unhappy situation is that if the client rejects all unsigned DNS responses, then it might be secure against man-in-the-middle attacks, but many legacy sites will stop working, causing an unacceptable compatibility cost. At least, this is my understanding.
You could imagine a better solution might be possible if DNSSEC-aware clients had a way to tell which zones should use strict signature validation. In particular, if
good.com had a way to declare "I guarantee all of my DNS records will be signed, and I want you to treat any unsigned records as invalid", then a cooperating client could apply strict validation to DNS records for
*.good.com, while being non-validating for other zones. This might allow good compatibility with legacy domains while allowing strict checking for zones that want to opt into it, in other words, providing partial protection against man-in-the-middle attacks without "breaking the Internet".
Does such a mechanism exist?