Re: [dnsext] Fwd: djb on NXDOMAIN/NODATA for non-terminals

[Edward Lewis <[e-mail]>]

At 12:04 +0000 3/30/11, Florian Weimer wrote:
>>
>>  http://tools.ietf.org/html/draft-vixie-dnsext-resimprove-00
>
>I was referring to section 3.  I think it is misleading and would lead
>to poorer service from resolvers if implemented.

Florian, thanks for the pointer. I really had lost track of the thread.

In section 3, it mentions an ambiguity in RFC 1034.  Question: what 
ambiguity (there are a lot of them), like what section or page.  I'm 
asking out of curiosity.

Still, the point of section 3 is right.   If there were no bad code 
out there and if the data never changed then I'd say it is good.  But 
there is bad code out there.

Dan Bernstein's statement (as found in [0]) that returning NXDOMAIN 
for empty non-terminals is acceptable because buggy code did this in 
the past is an interesting point.  While technically wrong to do so, 
this code is out there and to accommodate (work around the bug), 
optimizing according what is in section 3 would be sub-optimal.  I 
would never say that NXDOMAIN for empty non-terminals is correct as a 
protocol analyst.  But if I was dealing with buggy code, I'd play the 
"be liberal in what you accept" card.

Secondly, because of the fact that things change, it might be wrong 
for a cache to synthesize, based on a cached NXDOMAIN what may now be 
in a subdomain of the zone authoritative for the NXDOMAIN.  To me, 
this is a secondary concern because we've long recognized that the 
DNS protocol is pretty much agnostic about time.  It is true that 
RFC's in the past have said an NXDOMAIN can be used by caches to 
declare data of any type at a name as non-existing - but this 
pertains to the same name, not descendents.

So, while I think in theory section 3 is correct, in practice it 
seems to be an over-optimization given an imperfect world.

[0] - http://www.ietf.org/mail-archive/web/dnsext/current/msg11084.html
(I don't see a message "directly" from him, just this forward.  In 
case the forward was a forgery my point is directed at the real 
source of the comment, not Dan Bernstein.)

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"