I want to use DNSCurve (for privacy) to a trusted DNSSec resolver (for integrity), and want to ensure that I can tell a recursive resolver (like 8.8.8.8, or OpenDNS) that I only want DNSSec queries.
Logically this would be similar to issuing either of the following options:
Question
Does such a technique exist, no matter if it is enforced by a DNS recursive resolver (mentioned above) or as a proposed RFC enhancement to the passive DNS client to Server protocol?
It appears that secure DNSSec recursive queries are not possible to enforce.
According to the notes in this IETF draft:
DNSSEC is not an enforcement mechanism, it's a resource. When I see folks voice opinions that DNSSEC's recommended operation has to strictly followed, my gut reaction is that these folks have forgotten the purpose of all of our efforts. ~ Ed Lewis
DNSSEC is offered as a help and DNS servers can be configured to maintain the security of the recursion chain, or not. It also appears form Mr Lewis' comment, that there might not be a method to enforce secure recursion for some time.
