Re: [dnsext] zone cut semantics

[Jay Ashworth <[e-mail]>]

[ SPECULATION AHEAD ]

----- Original Message -----
> From: "Brandon Black" <[e-mail]>

> The only way the resolver knows to believe the answer from the
> .brandon name servers is based on glue it believed from the root
> server. One way or another, you cannot avoid the fact that the root
> servers control .brandon's resolution, directly or indirectly. The
> root servers make a poor example though, because they're universal.
> Let's look at example.com. vs example.org. again, assuming the root
> delegates com. and org. to different sets of nameservers.
> 
> If the org. nameservers answer www.example.org. with:
> 
> example.org. NS ns1.example.com.
> ns1.example.com. A 192.0.2.1
> 
> I thought it was part of avoiding cache poisoning, etc, that org.
> nameservers are not to be believed for glue outside of its authority,

I believe that you're not supposed to *cache* them.  But you *have* to 
believe the parent glue, as it's the only way you *have* to locate the
zone servers for the subdomain, is it not?

root -> .org -> example.org
             ^^ that right there is the referral we're talking about.

> and that the resolver should query ns1.example.com. separately. 

If you don't believe the IP addresses that .org hands you for example.org's
zone servers, where else are you going to ask?

> Or is it the view of the RFCs that ns1.example.com. is basically
> functionally a "temporary" name that ties those two response RRs
> together just to be used once to contact 192.0.2.1 for this one
> delegation and never cached, and that this doesn't need to be
> independently verified through the com. servers? I was under the
> impression this is why it matters whether example.org.'s nameserver
> glue is or isn't within org., and hence my whole point about why this
> matters for glue. An un-snarky correction on this would be
> appreciated :P

It is just a "temporary name", I suppose, and if you have an authoritative
locally cached copy of the pointer to the zone server, I suppose it might
override what you're handed... but then you wouldn't trace the whole
chain, anyway, would you?

I suspect that, orthogonal to the questions about zone cut semantics, 
exactly how the resolvers work is implementation-defined... as Apple
taught us a decade or more ago...

Cheers,
-- jra