Re: [dnsext] DNAME YXDOMAIN validation

["W.C.A. Wijngaards" <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi George,

On 05/16/2011 08:14 AM, George Barwood wrote:
> What are the requirements on resolvers for validating DNAME YXDOMAIN responses?

There are no requirements.  Because there is no text in RFC2672 or -bis.

> http://tools.ietf.org/html/draft-ietf-dnsext-rfc2672bis-dname-22#section-5.3.1
> 
> says
> 
>   The domain name can get too long during substitution.  For example,
>    suppose the target name of the DNAME RR is 250 octets in length
>    (multiple labels), if an incoming QNAME that has a first label over 5
>    octets in length, the result would be a name over 255 octets.  If
>    this occurs the server returns an RCODE of YXDOMAIN [RFC2136].  The
>    DNAME record and its signature (if the zone is signed) are included
>    in the answer as proof for the YXDOMAIN (value 6) RCODE.
> 
> which implies that YXDOMAIN responses can be validated.

Yes.

> However, I'm wondering if this is actually useful, and simply clearing the AD
> bit would be acceptable. i.e. "validators MAY validate YXDOMAIN responses" but no stronger.
> Or maybe I'm wrong, and YXDOMAIN responses MUST be validated if possible, in which case I think
> this would be best stated explicitly.

I thought it would be good to include the DNAME (I believe the authority
servers already include the DNAME for YXDOMAIN responses, so the
signature (when appropriate, DO flag, signed zone) is not a lot of
work), just because you can.

> As an aside,  I may be mistaken, but it seems that both BIND and UNBOUND don't
> currently handle YXDOMAIN responses, returning SERVERFAIL instead of YXDOMAIN. 
> I think this is quite likely to be the behavior for legacy resolvers as well, maybe that could be noted.

Yes, there does not seem to be a great deal of utility for validating
the YXDOMAIN.  It is nice that there is some sort of proof for the RCODE
(since for many other RCODEs no proof is possible, and considering the
length of effort we took to prove NXDOMAINs).

Best regards,
   Wouter
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJN0OV4AAoJEJ9vHC1+BF+NC7sP/1f62TjtCcT/6myJNazWFium
ONfeQwx25kD3fg7PHAOeiFl02KqiLNdehg3W+DuovK9m7la4SC2x5hGkYl1aJxZK
yXF2zPL7zTELhWd2nlrtQHc7KXn+8M9XE8GcHn2jge2wu628Ecch4Yd9tq9caArZ
tAcsSpRj4hte1XSw9V3HT9QwBvyUvZm1mbkz4aVdk4ACxsILlCKMV8wCsI6d65xz
en4NS1ISGHgCX1RW0D9jBYbFb7CbVCoih35skMkIvznmkYB3VPguCefAUg/CtkVo
fSRtJ/skwOxB1Z6P0ojBkrKUWPJJl90dqAgIN59QqBhgxS3SaoSFK7ssfR7eCKar
/pZMYi4XFKqI0lwa59g8ykhms3Q7lpANazNZE0IacN5Nf2nzaasVQMx7l3nbsaDd
oUuSG4DAIKRJuG6T7VRGq25DYHnFi0wJgdkozRMyVEhn0tEeg9Xj1Ned9bs8/zm0
XPieIDiY6m6mlR7G8xgeft/038QtY6ljBLBn0hNc3f+0WCa6f/1zVcYBgrO7n0Hq
MMKiDbUB2fYnt35SwjYz4y3Ot6tmPMR53+9HLfYT2EUj7TGSyAZEyS1tpDJIeDRG
aSw3PKKBwFCbFnKP8RjOpKrKO83y29wYhpj37T8cssnno6xneCRn7OHjJjmF/mK8
1M2WsrAM/DZMziCx7xOg
=tGwd
-----END PGP SIGNATURE-----