Re: [dnsext] draft-vixie-dnsext-resimprove - NXDOMAIN for emptynon-terminals

----- Original Message ----- 
From: "Edward Lewis" <Ed.Lewis@neustar.biz>
To: <dnsext@ietf.org>
Cc: "Edward Lewis" <Ed.Lewis@neustar.biz>
Sent: Tuesday, March 29, 2011 5:29 PM
Subject: Re: [dnsext] draft-vixie-dnsext-resimprove - NXDOMAIN for emptynon-terminals

> At 17:16 +0100 3/29/11, George Barwood wrote:
> 
>>I agree it's quite common for zones to give non-deterministic positive answers
>>as a form of load-balancing, where a limited set of A records is randomly
>>(or otherwise) selected from a large set. This is not affected.
> 
> Using that...when you have A, AAAA, and fallback answers like DNAME 
> and CNAME, for example.  It might not be just which A to return, but 
> whether to withhold the AAAA and or use a query redirection tool. 
> Consider that ANY queries may come.
> 
> With IPv6 whitelisting 
> (http://tools.ietf.org/html/draft-livingood-dns-whitelisting-implications-01) 
> as an example, I might want to withhold the existence of a AAAA 
> record from some queriers but not others.

That's adjusting the response based on the identity of the client.
But what I'm asking for is a use case for sending inconsistent NSEC bitmaps
to the same client. I think that's hard to envisage.

> The way the standards read now, it's possible to generate NSEC/3's 
> owning a private type for all names that warrant one (NSEC does not 
> represent empty non-terminals, NSEC3 does) claiming just a private 
> type and things would work.  That's because you don't get a NSEC/3 in 
> a positive answer (other than ANY).

Right. What I'm saying is that an NSEC bitmap tells a client the complete set
of types that don't exist for a domain, and it's reasonable for a client to
use all of that information ( rather than just for the type requested ).
You don't seem to have come up with a plausible example where that
could be a problem, and I cannot see one either.

George

> -- 
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> Edward Lewis
> NeuStar                    You can leave a voice message at +1-571-434-5468
> 
> Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
> Son: "Waah!"
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext