Re: [dnsext] MaraDNS and NXDOMAIN/NOERROR on non-terminal nodes

[Sam Trenholme <[e-mail]>]

[John: Sorry about giving you two copies of this email]

> the wrongness of returning NXDOMAIN for an
> empty node with other nodes below it

[citation needed].  In other words, accusations of RFC non-compliance
need to quote chapter and verse of the relevant RFC or are invalid.

> By the way, telling people "you're wrong, change it because it's hard for me
> to fix" is rarely a winning strategy

That's not what I said.  I said that Paul Vixie once said that the
opposite behavior was the correct behavior [1], so it was reasonable
for DNS implementers in the 2000s to feel the opposite behavior was
correct.  And, indeed, there are at least two DNS implementers which
did precisely that.

I do feel that, in light of that fact that ip6.arpa can be very
sparse, it would be helpful to have a DNS server be able to say "not
only does this node not exist, but all child nodes also do not exist".
 [2]  But doing it in a way that breaks the existing internet and has
security problems [3] is, IMHO, not a good idea.

- Sam

[1] http://groups.google.com/group/comp.protocols.dns.std/msg/69e4500e7b7d73c8

[2] Actually, on second thought, I have promised a friend that I would
implement a simple DNS server that would convert all queries in the
form "0.1.2.3.4.5.6.7.8.9.a.b.c.d.e.f.0.1.2.3.4.5.6.7.8.9.a.b.c.d.e.f.ip6.arpa
PTR" in to answers like
"ip6.fedc-ba98-7654-3210-fedc-ba98-7654-3210.example.com" (and,
correspondingly, convert AAAA queries for
"ip6.fedc-ba98-7654-3210-fedc-ba98-7654-3210.example.com" in to
"fedc:ba98:7654:3210:fedc:ba98:7654:3210"), so ip6.arpa does not
necessarily have to be sparse.

[3] http://marc.info/?l=djbdns&m=130141880325287&w=1 and
http://www.ietf.org/mail-archive/web/dnsext/current/msg11101.html