[dnsext] DNAME YXDOMAIN validation

["George Barwood" <[e-mail]>]

What are the requirements on resolvers for validating DNAME YXDOMAIN responses?

http://tools.ietf.org/html/draft-ietf-dnsext-rfc2672bis-dname-22#section-5.3.1

says

  The domain name can get too long during substitution.  For example,
   suppose the target name of the DNAME RR is 250 octets in length
   (multiple labels), if an incoming QNAME that has a first label over 5
   octets in length, the result would be a name over 255 octets.  If
   this occurs the server returns an RCODE of YXDOMAIN [RFC2136].  The
   DNAME record and its signature (if the zone is signed) are included
   in the answer as proof for the YXDOMAIN (value 6) RCODE.

which implies that YXDOMAIN responses can be validated.

However, I'm wondering if this is actually useful, and simply clearing the AD
bit would be acceptable. i.e. "validators MAY validate YXDOMAIN responses" but no stronger.
Or maybe I'm wrong, and YXDOMAIN responses MUST be validated if possible, in which case I think
this would be best stated explicitly.

As an aside,  I may be mistaken, but it seems that both BIND and UNBOUND don't
currently handle YXDOMAIN responses, returning SERVERFAIL instead of YXDOMAIN. 
I think this is quite likely to be the behavior for legacy resolvers as well, maybe that could be noted.

George