[dnsext] draft-vixie-dnsext-resimprove - NXDOMAIN for empty non-terminals

[Tony Finch <[e-mail]>]

Arising from the discussion at the meeting about treating a cached
NXDOMAIN as applying to all child domains...

The main concern about this clarificationin is buggy implementations that
give an NXDOMAIN for empty non-terminal names that have non-empty child
domains. The examples cited were DJBDNS and in particular rbldnsd. (I
presume there are others that we don't know about.)

We care about rbldnsd because it is widely deployed and there are a lot of
empty non-terminals in RBL zones. However the bug will not normally be
triggered by a mail server since mail servers don't query for the
non-terminal domains. But there is a serious risk if the mail server is
sharing a cache with untrusted clients, since they can make a query that
gets an NXDOMAIN response and thereby make the cache think that vast
sections of the DNSBL are empty.

This is of course a special case of the general problem with this
clarification. I don't know if it affects how much we care about it or if
it just means we should worry more about the buggy DNS servers that we
don't know about.

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Southwest Forties, Cromarty, Forth: Southwesterly 4 or 5, occasionally 6,
becoming variable 3 later. Slight or moderate. Occasional rain. Good,
occasionally poor.