Re: [DNSOP] 4035 3.1.4.1 erratum? dig ds root-servers.net @X.root-servers.net

The reply also has to work for STD13 clients which already know about the child zone. The NODATA response is the correct one despite it requiring more work for a DNSSEC client. 

-- 
Mark Andrews

> On 4 Jan 2018, at 05:31, Peter van Dijk <peter.van.dijk@powerdns.com> wrote:
> 
> Output edited for brevity:
> 
> $ dig ds root-servers.net @d.root-servers.net
> 
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17643
> ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
> ;; WARNING: recursion requested but not available
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 4096
> ;; QUESTION SECTION:
> ;root-servers.net.        IN    DS
> 
> ;; AUTHORITY SECTION:
> root-servers.net.    3600000    IN    SOA    a.root-servers.net. nstld.verisign-grs.com. 2017111600 14400 7200 1209600 3600000
> 
> $ dig ds root-servers.net @e.root-servers.net
> 
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26972
> ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27
> ;; WARNING: recursion requested but not available
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 4096
> ;; QUESTION SECTION:
> ;root-servers.net.        IN    DS
> 
> ;; AUTHORITY SECTION:
> net.            172800    IN    NS    a.gtld-servers.net.
> net.            172800    IN    NS    b.gtld-servers.net.
> .. ..
> 
> ;; ADDITIONAL SECTION:
> a.gtld-servers.net.    172800    IN    A    192.5.6.30
> b.gtld-servers.net.    172800    IN    A    192.33.14.30
> .. ..
> 
> 
> 
> When running the query in the Subject, these are the two possible outputs I have observed from various root servers (with some variation from the same letter, presumably because of dual vendor strategies).
> 
> From 4035 3.1.4.1, the NODATA response should be sent when:
> 
>   o  The name server has received a query for the DS RRset at a zone
>      cut.
> 
>   o  The name server is authoritative for the child zone.
> 
>   o  The name server is not authoritative for the parent zone.
> 
>   o  The name server does not offer recursion.
> 
> 
> Points 1, 2 and 4 are clear. It is point 3 that hurts here. The root servers are authoritative for root-servers.net. and for . , but not for net - and they know this because they can see the delegation in the root zone.
> 
> It is my suspicion that 3.1.4.1 was not written with this edge case in mind, and I think that while 3.1.4.1 favours the NODATA response, the referral is much more useful. As a data point, the PowerDNS validator currently gets in trouble with the NODATA response: https://github.com/PowerDNS/pdns/issues/6138
> 
> I think an erratum to 4035 is in order, clarifying the language such that servers would return the referral in this case. I have not figured out the exact wording yet (but I will).
> 
> What does dnsop think?
> 
> Kind regards,
> -- 
> Peter van Dijk
> PowerDNS.COM BV - https://www.powerdns.com/
> 
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop