Re: [dnsext] RFC 6604 Clarification

Closest-enclosing-zone logic. If the non-recursive server, in the hypothetical mentioned below, happens to be authoritative for the *root* zone, then since "root" logically encloses all other zones, the nameserver wouldn't return a SERVFAIL in that case, right?

									- Kevin

-----Original Message-----
From: dnsext [mailto:dnsext-bounces@ietf.org] On Behalf Of Kumar Ashutosh
Sent: Tuesday, March 31, 2015 9:11 PM
To: Brian Dickson
Cc: DNSEXT Group Working
Subject: Re: [dnsext] RFC 6604 Clarification

Hi 

" Sending the query to the previous auth server would be the wrong thing to do. Even if such a query were received, the correct behavior is NOERRROR, NODATA, with AA unset (set to zero).

If you are not sure you understand this, please ask any clarifying questions you may have.

Please tell us that MS DNS does NOT do SERV_FAIL, or if it does, that you are going to fix it. :-)"

For CNAME partial chains, MS DNS servers respond with NOERROR in all the cases till now. We were evaluating to see what RFC 6604 compliance would mean in terms of changes.

For your question above. If a query for A of x.example.com is received on an authoritative server, which does not have any idea of example.com or .com, then it will simply respond with serv_fail. NODATA will be returned only when there is a x.example.com of some other type. 

-----Original Message-----
From: Brian Dickson [mailto:brian.peter.dickson@gmail.com]
Sent: Wednesday, April 1, 2015 04:09
To: Kumar Ashutosh
Cc: DNSEXT Group Working
Subject: Re: [dnsext] RFC 6604 Clarification

On Mon, Mar 30, 2015 at 2:04 AM, Kumar Ashutosh <Kumar.Ashutosh@microsoft.com> wrote:
> Hi
>
> As per RFC 6604, section 3
>
>       When an xNAME chain is followed, all but the last query cycle
>
>       necessarily had no error.  The RCODE in the ultimate DNS 
> response
>
>       MUST BE set based on the final query cycle leading to that
>
>       response.  If the xNAME chain was terminated by an error, it 
> will
>
>       be that error code.  If the xNAME chain terminated without 
> error,
>
>               it will be zero.

> 2. If the CNAME chain points to a Qname for which the auth server is 
> non-authoritative (and recursion is disabled on the auth server.) The 
> server in this case cannot get the response. A direct query for this 
> Qname will result in SERV_FAIL. Should the auth server return SERV_FAIL in this case?
> Will resolvers respect answers with SERV_FAIL in RCODE and cache the 
> partial response?

Just to clarify your question further:

A CNAME chain is normally processed ENTIRELY by the iterative
(recursive) resolver.
In the case of a given authority server being authoritative for the domain name found on the right-hand-side of a CNAME, as an optimization, it MAY provide the results of a re-started query using that RHS value.

It can ONLY do that so long as it is authoritative. If it is not, it simply returns the data it is authoritative for, with a NOERROR RCODE.

Pointing to a domain name that it is not authoritative for, is not an error condition.

The iterative resolver would need to continue processing the rewritten QNAME, by sending the rewritten query to whatever authority server is authoritative for that new QNAME.

Sending the query to the previous auth server would be the wrong thing to do. Even if such a query were received, the correct behavior is NOERRROR, NODATA, with AA unset (set to zero).

If you are not sure you understand this, please ask any clarifying questions you may have.

Please tell us that MS DNS does NOT do SERV_FAIL, or if it does, that you are going to fix it. :-)

Brian
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext