Re: [DNSOP] Clarifying referrals (#35)

[Andrew Sullivan <[e-mail]>]

Hi,

On Mon, Nov 13, 2017 at 08:14:14AM -0800, Paul Vixie wrote:
> > If I ask the authoritative server for example.com about a name
> > label.example.net, in a graph-theoretic sense the NS RRset for the
> > root zone is clearly closer to label.example.net than anything else I
> > can give.
> 
> dns is not that kind of graph.
> 
> if the qname is acetes.pa.dec.com and the query is being processed by the
> dec.com authority server who knows that pa.dec.com is a delegation, then
> pa.dec.com is closer to acetes.pa.dec.com than the root would be.

Obviously.  But your example is still on the current tree, just not
immediately below.  The example I gave is in a completely different
section of the tree, and my point is that none of the text you quoted
shows why "." isn't the "closer server" that an authoritative server
somewhere beneath com. can give in response to a qname that is
somewhere beneath net.  We might think today that is a misfeature in
STD13, but I don't think it's a misinterpretation of what STD13 says.
I don't know what kind of graph would make that false.

> as i wrote during the SOPA wars, REFUSED has been widely used as an
> administrative denial, and repurposing it would not be effective at this
> late date.

This, too, seems to be a claim that is at best poorly justified.  It
might be that it is how BIND interprets the RCODE, but it's not what
it is defined to be. I'm anyway not sure your description in the
circleid piece (or elsewhere) is inconsistent with the RFC 1035
definition of RCODE 5: "The name server refuses to perform the
specified operation for policy reasons."  Refusing to respond to this
or that IP address is a policy, and refusing to perform upward
referrals is also a policy, no?

Best regards,

A

-- 
Andrew Sullivan
[e-mail]