Re: [dnsext] Asking for review on this errata by DNSSEC experts Re: [Errata Verified] RFC4035 (5226)

["Rose, Scott W. (Fed)" <[e-mail]>]

Éric,
I also agree with Mark (and Rob). Section 4.2 states how resolvers should use NS queries to find the parent zone.  That would work in the example given in the errata report: queries for “B.A IN NS” would return the B.A server, which would have the DS RRset for C.B.A.

Unless there is some corner case where this doesn’t work?  Or the implemented behavior is actually different.

Scott


On 5 Aug 2023, at 3:11, Eric Vyncke (evyncke) wrote:

> Mark, thanks for your review. Happy to correct the errata after verification.
>
> What is the view of the DNS directorate members on this errata (see below or at https://www.rfc-editor.org/errata/eid5226) ? I.e., I would appreciate a quick look by several DNS directorate members + original authors.
>
> Thanks, in advance.
>
> -éric
>
>
> On 05/08/2023, 03:46, "Mark Andrews" <[e-mail] <mailto:[e-mail]>> wrote:
>
>
> This is incorrect. DNSSEC aware resolvers make NS queries to determine the parent nameservers. Non DNSSEC resolvers accept the response from the child zone.
>
>
> -- 
> Mark Andrews
>
>
>> On 5 Aug 2023, at 01:52, RFC Errata System <[e-mail] <mailto:[e-mail]>> wrote:
>>
>> The following errata report has been verified for RFC4035,
>> "Protocol Modifications for the DNS Security Extensions".
>>
>> --------------------------------------
>> You may review the report below and at:
>> https://www.rfc-editor.org/errata/eid5226 <https://www.rfc-editor.org/errata/eid5226>
>>
>> --------------------------------------
>> Status: Verified
>> Type: Technical
>>
>> Reported by: Peter van Dijk <[e-mail] <mailto:[e-mail]>>
>> Date Reported: 2018-01-04
>> Verified by: Eric Vyncke (IESG)
>>
>> Section: 3.1.4.1
>>
>> Original Text
>> -------------
>> The need for special processing by a security-aware name server only
>> arises when all the following conditions are met:
>>
>> o The name server has received a query for the DS RRset at a zone
>> cut.
>>
>> o The name server is authoritative for the child zone.
>>
>> o The name server is not authoritative for the parent zone.
>>
>> o The name server does not offer recursion.
>>
>> Corrected Text
>> --------------
>> The need for special processing by a security-aware name server only
>> arises when all the following conditions are met:
>>
>> o The name server has received a query for the DS RRset at a zone
>> cut.
>>
>> o The name server is authoritative for the child zone.
>>
>> o The name server is not authoritative for any zone above the
>> child's apex.
>>
>> o The name server does not offer recursion.
>>
>> Notes
>> -----
>> The original text is ambiguous in the face of an authoritative server having zones C.B.A. and A. but not B.A., and could cause DS queries for C to return a NODATA at C's apex, instead of the desired referral to B. which would allow resolution to continue correctly.
>>
>> --------------------------------------
>> RFC4035 (draft-ietf-dnsext-dnssec-protocol-09)
>> --------------------------------------
>> Title : Protocol Modifications for the DNS Security Extensions
>> Publication Date : March 2005
>> Author(s) : R. Arends, R. Austein, M. Larson, D. Massey, S. Rose
>> Category : PROPOSED STANDARD
>> Source : DNS Extensions
>> Area : Internet
>> Stream : IETF
>> Verifying Party : IESG
>>
>> _______________________________________________
>> dnsext mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/dnsext <https://www.ietf.org/mailman/listinfo/dnsext>


==================================
Scott Rose NIST/CTL
[e-mail]
ph: [phone] (w)
    [phone] (GoogleVoice)
==================================