Re: [dnsext] Possible DNSSECbis clarifications

[Michael Graff <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 3/28/11 2:54 PM, Marc Lampo wrote:
> In my opinion, the use of the second SOA to indicate the zone did not
> change (at sender side) since the zone transfer started is more important
> (then the indication of the end of the zone transfert).

The AXFR (and IXFR) specs bracket the parts by SOA record, not by other
records.  The purpose is to ensure that the transfer is complete and was
not closed early by the sender.  If you then allow other records on the
end, you will lose that confirmation.

Think of the SOA records as brackets.  That they are also data is the
mistake, but it's one that is in place and can't be changed.  The marker
could have been an empty DNS packet (just header) but unfortunately, it
wasn't.

- --Michael
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJNkIsCAAoJEDRzoY2A7tzbLZAIAIUMGwBDiHAeKdRJYENRvQES
zptiLgt13vKMR1X2Y2yOLwhCcTpX4Hg0h2/bU8QkYLJKf63NdizNB71GuTCvo6h8
N002eh12E5QM3HuDETANc8k9WdfAWAPuENH55gvFlXFQJCG+1IrMA2C1pwhpq6wN
dc3WCWRQdD9uYCI/7Psbdie9ePPaOcC3RU1V5+yTA3nDYYKZRhYtjTkVqmy85xqb
ukst8+FIDiV3CbEo710YYeocLniGJCRm+omHIxPNt4Jw2Zb/qIH4OYs1tnIZz49V
RnD9kAzjKN3fiI32cwb11RvBDXM9T0FEDTm5/YS2kywV3BiNAl7t9O9eq4dBuBQ=
=ljlX
-----END PGP SIGNATURE-----