Re: [DNSOP] Comment on section 2 of draft-ietf-dnsop-nxdomain-cut-05.txt

Edward Lewis <edward.lewis@icann.org> Tue, 27 September 2016 17:55 UTC

Return-Path: <edward.lewis@icann.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 140A212B3CB for <dnsop@ietfa.amsl.com>; Tue, 27 Sep 2016 10:55:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.517
X-Spam-Level:
X-Spam-Status: No, score=-6.517 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I8xoWRX6_pxc for <dnsop@ietfa.amsl.com>; Tue, 27 Sep 2016 10:55:41 -0700 (PDT)
Received: from out.west.pexch112.icann.org (pfe112-ca-1.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0DBA12B300 for <dnsop@ietf.org>; Tue, 27 Sep 2016 10:55:40 -0700 (PDT)
Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 27 Sep 2016 10:55:39 -0700
Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1178.000; Tue, 27 Sep 2016 10:55:39 -0700
From: Edward Lewis <edward.lewis@icann.org>
To: Mark Andrews <marka@isc.org>
Thread-Topic: [DNSOP] Comment on section 2 of draft-ietf-dnsop-nxdomain-cut-05.txt
Thread-Index: AQHSGB1bdhjoj3onHU+w+A+q19myVqCMgefvgAFQ3YA=
Date: Tue, 27 Sep 2016 17:55:38 +0000
Message-ID: <89B42AE2-0377-42A4-B943-E65C52B7CB55@icann.org>
References: <29B4A430-80C7-44C8-A6FA-54A1560D3FD7@icann.org> <20160927004928.22EAE5515C31@rock.dv.isc.org>
In-Reply-To: <20160927004928.22EAE5515C31@rock.dv.isc.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/f.1a.1.160916
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [192.0.47.234]
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3557829337_204809114"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/FTxi3cuM24DFhZwnztT7c9om0GM>
Cc: "dnsop@ietf.org" <dnsop@ietf.org>
Subject: Re: [DNSOP] Comment on section 2 of draft-ietf-dnsop-nxdomain-cut-05.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Sep 2016 17:55:43 -0000

On 9/26/16, 20:49, "Mark Andrews" <marka@isc.org> wrote:
    
>No.  SHOULD is not MUST.  Every SHOULD has a implict UNLESS
><unspecified reason>.  In this case we actually have a reason for
>the why the second and third SHOULD are not MUSTs.
>   
>    I could turn first SHOULD into a MUST and still reach the MAY.
 
I have to admit I don't quite understand that response.  (This coming after reading some children's books by Roald Dahl where he just makes up words and tries to explain them.)

I'd written up a response, but perhaps the intent of the text is fine.  The way it is written is what is throwing me.

Perhaps instead of this:

#   When an iterative caching DNS resolver receives a response NXDOMAIN,
#   it SHOULD store it in its cache and all names and RRsets at or below
#   that node SHOULD then be considered to be unreachable.  

When an iterative caching DNS resolver receives a response with RCODE being NXDOMAIN, the resolver SHOULD store the response in its (negative) cache.  During the time the response is cached, any query with a QNAME at or descended from the denied name that is not otherwise cached (positively), can be assumed to result in a name error.  Responses to those queries SHOULD set RCODE=NXDOMAIN (using the DNSSEC records cached as proof).

...that's not the best wording either - but "unreachable" is not a term I'd use.  I'm not sure "negative cache" and "positive cache" are recognized terms.


>Temporal issues are not new.

There is something oddly ironic about that statement.