Re: [DNSOP] followup and proposed actions: RFC 6761 interim and next steps

[Paul Vixie <[e-mail]>]

Paul Wouters wrote:
>
> OLD:
> 1) some stupid application asks for "mail"
> 2) some resolver library interprets this as unqualified (maybe because
>    it did not resolve from the root), adds its own search domain
> ".example.com"
>    and re-queries.
> 3) resolver finds IP for mail.example.com and returns it
> 3) stupid application happy
>
> NEW:
> 1) some stupid application asks for "mail"
> 2) same resolver library, now finding mail exists, does not add
>    search domain ".example.com" and returns NXDOMAIN. 3) stupid
> application fails
>
> No, i do not know how common or uncommon or important/unimportant this
> is. We would only know once this fails.

i can only repeat what you quoted:

On Tue, 26 May 2015, Paul Vixie wrote:

>
> yes. i wrote a lot of the 15-year-old code in question. (actually some
> of it is 25 years old.) NOERROR vs. NXDOMAIN doesn't matter. all that
> matters is that there is no AAAA or A RR at "MAIL.", and that's already
> a rule, so what we're discussing here (your mail.corp.com example) will
> not be impacted. 
 
that is, NOERROR and NXDOMAIN have the same fallback path in the era
you're worried about.

-- 
Paul Vixie