Re: [dnsext] perhaps we should reintroduce "resimprove"

On 2/15/2012 8:11 PM, Mohan Parthasarathy wrote:
> On Thu, Feb 9, 2012 at 7:09 AM, paul vixie <vixie@isc.org> wrote:
>> ... i did not
>> agree that this was a problem since RBL DNS queries are always full
>> length (that is, for all octets or all nybbles of an inverted host
>> address) and since the DNSSEC specification clarified non-terminal names
>> as existing but empty.
>>
> RFC 4035, "3.1.3.2.  Including NSEC RRs: Name Error Response" has the
> following text towards the end:
>
>    Note that this form of response includes cases in which SNAME
>    corresponds to an empty non-terminal name within the zone (a name
>    that is not the owner name for any RRset but that is the parent name
>    of one or more RRsets).
>
> I don't see anything clarified in the dnssec-bis-updates document
> regarding this. Could you clarify what you meant by "DNSSEC
> specification clarified non-terminal names as existing but empty" ?

what i mean is hard to quote a chapter and verse for, but in dnssec if
an authority server receives a query for a domain name which is empty of
rrsets but has children, then the answer is NOERROR not NXDOMAIN, and
there is no need to provide the usual proofs (of no wild card and so on)
that would accompany an NXDOMAIN response.

some dns implementations have been behaving this way for decades (BIND
for example). others have been returning NXDOMAIN under these
conditions. the original DNS spec didn't make either behaviour wrong. in
DNSSEC one way is right and the other way is wrong.

paul
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext