[DNSOP] How black are black lies, really?

[John R Levine <[e-mail]>]

RFC 9824 on Compact Denial of Existence in DNSSEC says how to generate 
miniallly covering DNSSEC signatures on the fly which works great so long 
as the name exists.  If it doesn't, we invented the NXNAME psedudo-RRtype 
as a flag to say this response is really an NXDOMAIN.  Section 5 describes 
that and encourages resolvers to return a real NXDOMAIN.

Over in another working group I got an proposed errata for RFC9989 saying 
that where it says applications check for NXDOMAIN, they also have to 
check for NXNAME, for resolvers that don't recover the NXDOMAIN.  I 
rejected it but he insists claiming that (approximately) the resolvers 
he's seen don't actually recover NXDOMAIN.

It seems to me that's a bug in the resolver, that's the whole point of the 
CO flag and NXNAME.  The alternative is to file a similar erratum on every 
RFC that mentions NXDOMAIN.  What do you think?

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly