Re: [dnsext] perhaps we should reintroduce "resimprove"

On Thu, Feb 9, 2012 at 7:09 AM, paul vixie <vixie@isc.org> wrote:
> based on the renewed interest in the delegation and glue ttl problem
> caused by the "ghost domains" paper, i looked again at:
>
> http://tools.ietf.org/html/draft-vixie-dnsext-resimprove-00
>
> ...which i presented in prague about a year ago. the sticking point was:
>
>    B. Stopping a downward cache search when an NXDOMAIN is encountered.
>
> and all of section 3. this proposal was considered controversial since
> two existing implementation (rbldnsd and tinydns) currently send
> nxdomain when queried for an empty nonterminal domain name. i did not
> agree that this was a problem since RBL DNS queries are always full
> length (that is, for all octets or all nybbles of an inverted host
> address) and since the DNSSEC specification clarified non-terminal names
> as existing but empty.
>
RFC 4035, "3.1.3.2.  Including NSEC RRs: Name Error Response" has the
following text towards the end:

   Note that this form of response includes cases in which SNAME
   corresponds to an empty non-terminal name within the zone (a name
   that is not the owner name for any RRset but that is the parent name
   of one or more RRsets).

I don't see anything clarified in the dnssec-bis-updates document
regarding this. Could you clarify what you meant by "DNSSEC
specification clarified non-terminal names as existing but empty" ?

thanks
mohan

> i now propose that we dust off this draft, remove (B) and section 3, and
> progress it not as an improvement but as a security and resiliency
> requirement (so, a proposed standard) in the face of the "ghost domain"
> problem.
>
> i may yet reintroduce the NXDOMAIN matter but i don't think that we
> should logjam on it any further.
>
> with five shows of support i would consider the editorial work involved
> here to be worth doing.
>
> paul
>
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext