Re: [DNSOP] RFC 1035 vs. mandatory NS at apex?

Mukund Sivaraman <muks@mukund.org> Thu, 07 February 2019 16:03 UTC

Return-Path: <muks@mukund.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE85E12008F for <dnsop@ietfa.amsl.com>; Thu, 7 Feb 2019 08:03:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.001
X-Spam-Level:
X-Spam-Status: No, score=-0.001 tagged_above=-999 required=5 tests=[SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EZXa0iX5rJJ7 for <dnsop@ietfa.amsl.com>; Thu, 7 Feb 2019 08:03:57 -0800 (PST)
Received: from mail.banu.com (mail.banu.com [IPv6:2a01:4f8:151:2016::99]) by ietfa.amsl.com (Postfix) with ESMTP id 735B41228B7 for <dnsop@ietf.org>; Thu, 7 Feb 2019 08:03:57 -0800 (PST)
Received: from jurassic.lan.banu.com (unknown [27.5.235.215]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by mail.banu.com (Postfix) with ESMTPSA id 738365A40C3C; Thu, 7 Feb 2019 16:03:54 +0000 (GMT)
Date: Thu, 7 Feb 2019 21:33:50 +0530
From: Mukund Sivaraman <muks@mukund.org>
To: Ted Lemon <mellon@fugue.com>
Cc: Tony Finch <dot@dotat.at>, "dnsop@ietf.org" <dnsop@ietf.org>
Message-ID: <20190207160350.GA25708@jurassic.lan.banu.com>
References: <fcd790a2-414b-491e-01e2-9aa92f7b1c4e@nic.cz> <CC75C79C-E5FB-4C91-9453-103E36EDC505@fugue.com> <48a12f46-eee1-823e-a448-8f3b0d973f7d@nic.cz> <F821C2A2-BD6F-41D1-A2D6-3928E783614B@fugue.com> <alpine.DEB.2.20.1902071407530.18720@grey.csi.cam.ac.uk> <0F4355DC-CC6C-430B-AE8E-6FB5A44FD9C8@fugue.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <0F4355DC-CC6C-430B-AE8E-6FB5A44FD9C8@fugue.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/lnW3tg6ECP6H6any_bJ4SYAiEWQ>
Subject: Re: [DNSOP] RFC 1035 vs. mandatory NS at apex?
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Feb 2019 16:04:00 -0000

On Thu, Feb 07, 2019 at 09:40:24AM -0500, Ted Lemon wrote:
> On Feb 7, 2019, at 9:16 AM, Tony Finch <dot@dotat.at> wrote:
> > But in this scenario things soon go wrong, because RFC 2181 says the
> > NODATA reply replaces the delegation records in the resolver's cache. This
> > means that if a client explicitly asks for the NS records of a zone that
> > lacks them, resolution for other records in the zone will subsequently
> > fail.
> 
> Ah, there you have it.  So then it _is_ required.  Kevin’s point also
> points in that direction.
> 
> Is there somewhere in a later spec where this is stated explicitly, then?

Though RFC 1034/1035 are a point for DNS that obsoleted some preceding
RFCs and other documentation and they are quite comprehensive, there are
things that they have missed. Something that comes to mind is the
definition of hostnames. Remember that DNS evolved to RFC 1034/1035. It
didn't begin there, so if something is not clear, there are documents
preceding it which may be obsolete but can contain useful information
and justification.

For this topic of NS at apex, there is some mention of it in RFC 883:

      Note that there is one special case that requires consideration
      when a name server is implemented.  A node that contains a SOA RR
      denoting a start of zone will also have NS records that identify
      the name servers that are expected to have a copy of the zone.

(The word "will" cannot be strictly assumed to have RFC 2119 meaning,
 but it's clear that it's expected.)

There's mention of it in RFC 882 where it says an NS record is necessary
because an authority for the zone is expected to answer for a query for
NS information of the zone.

If all else fails in explaining something, there's also the old saying -
"Do what BIND does". :-)

		Mukund