IETF Logo Mail Archive

Re: [DNSOP] RFC 1035 vs. mandatory NS at apex?

Tony Finch <dot@dotat.at> Thu, 07 February 2019 16:59 UTC

Return-Path: <dot@dotat.at>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A33D4124BF6 for <dnsop@ietfa.amsl.com>; Thu, 7 Feb 2019 08:59:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.299
X-Spam-Level:
X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a8R-cMfxmiYd for <dnsop@ietfa.amsl.com>; Thu, 7 Feb 2019 08:59:50 -0800 (PST)
Received: from ppsw-32.csi.cam.ac.uk (ppsw-32.csi.cam.ac.uk [131.111.8.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D5E9E1200D8 for <dnsop@ietf.org>; Thu, 7 Feb 2019 08:59:49 -0800 (PST)
X-Cam-AntiVirus: no malware found
X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus
Received: from grey.csi.cam.ac.uk ([131.111.57.57]:54390) by ppsw-32.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.138]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1grn1e-000F4o-2V (Exim 4.91) (return-path <dot@dotat.at>); Thu, 07 Feb 2019 16:59:46 +0000
Date: Thu, 07 Feb 2019 16:59:46 +0000
From: Tony Finch <dot@dotat.at>
To: Petr Špaček <petr.spacek@nic.cz>
cc: Kevin Darcy <kevin.darcy@fcagroup.com>, dnsop@ietf.org
In-Reply-To: <56839e19-afe9-df4b-d432-09a949cc658c@nic.cz>
Message-ID: <alpine.DEB.2.20.1902071648340.18720@grey.csi.cam.ac.uk>
References: <fcd790a2-414b-491e-01e2-9aa92f7b1c4e@nic.cz> <CAAeHe+xySnrvpD4-nhi3T0qiEmz8h0ZNUE_2kie7ctq8YPGRPA@mail.gmail.com> <56839e19-afe9-df4b-d432-09a949cc658c@nic.cz>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: multipart/mixed; BOUNDARY="1870870841-2075598731-1549558705=:18720"
Content-ID: <alpine.DEB.2.20.1902071659190.18720@grey.csi.cam.ac.uk>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/QgzA-UB_MOkr9v4zGKexh4H60nI>
Subject: Re: [DNSOP] RFC 1035 vs. mandatory NS at apex?
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Feb 2019 16:59:53 -0000

Petr Špaček <petr.spacek@nic.cz> wrote:
>
> We (as developers in our office) all have had gut feeling that NS is
> mandatory but we could not find it in the RFCs.

There's this bit in RFC 1034 which discusses zone cuts and says the NS
RRset above and below the cut should be exactly the same. DNS admins are
generally too relaxed about allowing them to become inconsistent.

: The RRs that describe cuts around the bottom of the zone are NS RRs that
: name the servers for the subzones.  Since the cuts are between nodes,
: these RRs are NOT part of the authoritative data of the zone, and should
: be exactly the same as the corresponding RRs in the top node of the
: subzone.  Since name servers are always associated with zone boundaries,
: NS RRs are only found at nodes which are the top node of some zone.  In
: the data that makes up a zone, NS RRs are found at the top node of the
: zone (and are authoritative) and at cuts around the bottom of the zone
: (where they are not authoritative), but never in between.

See also RFC 1912 section 2.8:

   Make sure your parent domain has the same NS records for your zone as
   you do.

Tony.
-- 
f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
Dogger: West, backing southwest, 6 to gale 8. Moderate or rough, occasionally
very rough. Occasional rain. Good occasionally poor.

v2.23.0 | Report a Bug | By Email