Re: [DNSOP] Comment on section 2 of draft-ietf-dnsop-nxdomain-cut-05.txt

Edward Lewis <> Tue, 27 September 2016 17:55 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 140A212B3CB for <>; Tue, 27 Sep 2016 10:55:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.517
X-Spam-Status: No, score=-6.517 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id I8xoWRX6_pxc for <>; Tue, 27 Sep 2016 10:55:41 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id F0DBA12B300 for <>; Tue, 27 Sep 2016 10:55:40 -0700 (PDT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 27 Sep 2016 10:55:39 -0700
Received: from ([]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([]) with mapi id 15.00.1178.000; Tue, 27 Sep 2016 10:55:39 -0700
From: Edward Lewis <>
To: Mark Andrews <>
Thread-Topic: [DNSOP] Comment on section 2 of draft-ietf-dnsop-nxdomain-cut-05.txt
Thread-Index: AQHSGB1bdhjoj3onHU+w+A+q19myVqCMgefvgAFQ3YA=
Date: Tue, 27 Sep 2016 17:55:38 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
user-agent: Microsoft-MacOutlook/f.1a.1.160916
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: []
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3557829337_204809114"
MIME-Version: 1.0
Archived-At: <>
Cc: "" <>
Subject: Re: [DNSOP] Comment on section 2 of draft-ietf-dnsop-nxdomain-cut-05.txt
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 27 Sep 2016 17:55:43 -0000

On 9/26/16, 20:49, "Mark Andrews" <> wrote:
>No.  SHOULD is not MUST.  Every SHOULD has a implict UNLESS
><unspecified reason>.  In this case we actually have a reason for
>the why the second and third SHOULD are not MUSTs.
>    I could turn first SHOULD into a MUST and still reach the MAY.
I have to admit I don't quite understand that response.  (This coming after reading some children's books by Roald Dahl where he just makes up words and tries to explain them.)

I'd written up a response, but perhaps the intent of the text is fine.  The way it is written is what is throwing me.

Perhaps instead of this:

#   When an iterative caching DNS resolver receives a response NXDOMAIN,
#   it SHOULD store it in its cache and all names and RRsets at or below
#   that node SHOULD then be considered to be unreachable.  

When an iterative caching DNS resolver receives a response with RCODE being NXDOMAIN, the resolver SHOULD store the response in its (negative) cache.  During the time the response is cached, any query with a QNAME at or descended from the denied name that is not otherwise cached (positively), can be assumed to result in a name error.  Responses to those queries SHOULD set RCODE=NXDOMAIN (using the DNSSEC records cached as proof).

...that's not the best wording either - but "unreachable" is not a term I'd use.  I'm not sure "negative cache" and "positive cache" are recognized terms.

>Temporal issues are not new.

There is something oddly ironic about that statement.