Re: [dnsext] Fwd: djb on NXDOMAIN/NODATA for non-terminals

[Edward Lewis <[e-mail]>]

At 15:27 +0100 3/31/11, Tony Finch wrote:
>Colm MacCárthaigh <[e-mail]> wrote:
>>
>>  My vote would be for;
>>
>>    Recommending that authoritative servers implementing DNSSEC SHOULD
>>  NOT return NXDOMAIN for non-terminal labels.
>
>I believe that requirement already exists as a MUST NOT.

Although I agree that sending a NXDOMAIN for an 
empty non-terminal is a protocol error[0], I'll 
note that in the resimprove document it says:

# This is due to an ambiguity in RFC 1034 that failed to distinguish
# empty nonterminal domain names from nonexistent names.

To convert "I believe" to something more 
fact-based, it would be helpful if the ambiguity 
were identified.

[0] from this in RFC 1034, section 4.3.2:

# 3. Start matching down, label by label, in the zone.  The
#      matching process can terminate several ways:
#
#         a. If the whole of QNAME is matched, we have found the
#           node.

That is, the name/node exists, whether it has a type match remains to be seen.

#           ...skipping CNAME stuff...
#
#           Otherwise, copy all RRs which match QTYPE into the
#           answer section and go to step 6.

If there are no RRs to match (and empty 
non-terminal), none match, hence no data is put 
into the answer section.

On the other hand, of the name isn't there, here 
is the instruction for Name Error (aka NXDOMAIN):

#         c. If at some label, a match is impossible (i.e., the
#            corresponding label does not exist), look to see if a
#            the "*" label exists.
#
#            If the "*" label does not exist, check whether the name
#            we are looking for is the original QNAME in the query
#            or a name we have followed due to a CNAME.  If the name
#            is original, set an authoritative name error in the
#            response and exit.  Otherwise just exit.

RFC 2308, section 2.1 shows NXDOMAINs where the 
name is not original.  Reducing the logic that 
would mean the above reads as:

              If the "*" label does not exist, set an authoritative name
              error in the response and exit.  Otherwise just exit.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at [phone]

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"