From: "Peter van Dijk" <peter.van.dijk@powerdns.com>
To: dnsop@ietf.org
Date: Thu, 21 Sep 2017 19:26:37 +0200
Message-ID: <5D87C9A8-1B89-4EA2-BC6D-09B4AFDE0111@powerdns.com>
In-Reply-To: <20170921160115.GA20526@isc.org>
References: <149894524329.526.18431408698564464455@ietfa.amsl.com>
 <20170824142147.lshdlmjv62nojd32@nic.fr>
 <20170921034533.d2isi2idl7cyepea@mx4.yitter.info>
 <8FD138C0-3D99-42E6-8EB2-97C5FA2F0C80@powerdns.com>
 <20170921160115.GA20526@isc.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/pdbmwjryV41dHamJsySENX8_2ZI>
Subject: Re: [DNSOP] Definition of QNAME (Was: I-D Action:
 draft-ietf-dnsop-terminology-bis-06.txt
Precedence: list

Hello,

On 21 Sep 2017, at 18:01, Evan Hunt wrote:

> On Thu, Sep 21, 2017 at 02:20:15PM +0200, Peter van Dijk wrote:
>> thank you for this, I like it a lot. One nit below.
>
> Me too, with another nit...
>
>>>       This creates a kind of confusion, however, because the answer=20
>>> to a
>>>       query that results in CNAME processing contains in the echoed
>>>       Question Section one QNAME (the name in the original query),=20
>>> and a
>>>       second QNAME that is in the data field of the last CNAME.  The
>
> Why only the "last CNAME?" If a chain contains more than one CNAME,=20
> the
> answer includes intermediate names as well:
>
> ;; ANSWER SECTION:
> www.paypal.com.         5       IN      CNAME  =20
> geo.paypal.com.akadns.net.
> geo.paypal.com.akadns.net. 5    IN      CNAME  =20
> wlb.paypal.com.akadns.net.
> wlb.paypal.com.akadns.net. 5    IN      CNAME  =20
> www.paypal.com.edgekey.net.
> www.paypal.com.edgekey.NET. 5   IN      CNAME  =20
> e3694.a.akamaiedge.net.
> e3694.a.akamaiedge.net. 5       IN      A       104.91.181.63

That=E2=80=99s a very good point. If any of these CNAMEs are synthesised =
from=20
wildcards, and DNSSEC is in play, then the use of QNAME in RFC5155 (and=20
presumably also the NSEC equivalent) demands that each step of this=20
chain is the QNAME at some point.

> If it's necessary to have a specific term that only refers to the=20
> *last*
> name, perhaps "QNAME (final)" would be a better choice for that.

+1 - with the caveat that the definition needs to decide if it applies=20
when the chain does not end (a loop, or a failure). Is that =E2=80=98fina=
l=E2=80=99?=20
=E2=80=98effective=E2=80=99?=E2=80=99 =E2=80=98intermediate=E2=80=99? Per=
haps the right division is=20
original+intermediate+final, dropping effective in favour of the=20
intermediate+final division.

Kind regards,
--=20
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/