[dnsext] Insecure referrals : should SOA be sent

["George Barwood" <[e-mail]>]

http://tools.ietf.org/html/rfc4035#section-3.1.4

says

   If no DS RRset is present at the delegation point, the name server
   MUST return both the NSEC RR that proves that the DS RRset is not
   present and the NSEC RR's associated RRSIG RR(s) along with the NS
   RRset.  The name server MUST place the NS RRset before the NSEC RRset
   and its associated RRSIG RR(s).

( Olafur : Note the constraint on the ordering, re your recent bis clarifications question )

My question is this : shouldn't the SOA also be sent. If not, the non-existence information
cannot be fully cached for downstream resolvers, and an extra query will be needed to get
the full DS non-existence response (with SOA) if a client asks for the DS RRset.

Either that, or clients could use just the TTL of the NSEC records for the negative caching TTL.
The TTL of this non-existence is in any case not clear (to me) from the current text.

George