I want to use DNSCurve (for privacy) to a trusted DNSSec resolver (for integrity), and want to ensure that I can tell a recursive resolver (like, or OpenDNS) that I only want DNSSec queries.

Logically this would be similar to issuing either of the following options:

  • Recurse
  • No Recurse


Does such a technique exist, no matter if it is enforced by a DNS recursive resolver (mentioned above) or as a proposed RFC enhancement to the passive DNS client to Server protocol?

  • Is DNSCurve a requirement for an acceptable solution for you?
    – schroeder
    Commented Apr 10, 2015 at 4:55
  • @schroeder I'm writing an app for iOS and Android that requests resolution of a DNS name. I assume that no such extension exists, or for idealistic reasons, it doesn't exist either. I want to have a guarantee to my app that the DNS host is really the DNS host that is expected ... (using a local resolver, or an imported Java or iOS resolver) Commented Apr 12, 2015 at 2:27

1 Answer 1


It appears that secure DNSSec recursive queries are not possible to enforce.

According to the notes in this IETF draft:

DNSSEC is not an enforcement mechanism, it's a resource. When I see folks voice opinions that DNSSEC's recommended operation has to strictly followed, my gut reaction is that these folks have forgotten the purpose of all of our efforts. ~ Ed Lewis

DNSSEC is offered as a help and DNS servers can be configured to maintain the security of the recursion chain, or not. It also appears form Mr Lewis' comment, that there might not be a method to enforce secure recursion for some time.

  • I just read that note... somewhat abstract points he is saying. He does seem to say that a "local policy" is what trumps a global policy... specifically on the Caching Server. If a caching server is in my "local policy" realm of influence, I don't see why I can't have a local policy that says "ensure that this DNS label is not spoofed via DNSSEC". Since he works for Ultra, and I'm a UltraDNS customer, I'll open a support ticket.... Commented Apr 10, 2015 at 14:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .