Re: [dnsext] perhaps we should reintroduce "resimprove"

On Wed, Feb 15, 2012 at 1:59 PM, Paul Vixie <vixie@isc.org> wrote:
> On 2/15/2012 8:11 PM, Mohan Parthasarathy wrote:
>> On Thu, Feb 9, 2012 at 7:09 AM, paul vixie <vixie@isc.org> wrote:
>>> ... i did not
>>> agree that this was a problem since RBL DNS queries are always full
>>> length (that is, for all octets or all nybbles of an inverted host
>>> address) and since the DNSSEC specification clarified non-terminal names
>>> as existing but empty.
>>>
>> RFC 4035, "3.1.3.2.  Including NSEC RRs: Name Error Response" has the
>> following text towards the end:
>>
>>    Note that this form of response includes cases in which SNAME
>>    corresponds to an empty non-terminal name within the zone (a name
>>    that is not the owner name for any RRset but that is the parent name
>>    of one or more RRsets).
>>
>> I don't see anything clarified in the dnssec-bis-updates document
>> regarding this. Could you clarify what you meant by "DNSSEC
>> specification clarified non-terminal names as existing but empty" ?
>
> what i mean is hard to quote a chapter and verse for, but in dnssec if
> an authority server receives a query for a domain name which is empty of
> rrsets but has children, then the answer is NOERROR not NXDOMAIN, and
> there is no need to provide the usual proofs (of no wild card and so on)
> that would accompany an NXDOMAIN response.
>
> some dns implementations have been behaving this way for decades (BIND
> for example). others have been returning NXDOMAIN under these
> conditions. the original DNS spec didn't make either behaviour wrong. in
> DNSSEC one way is right and the other way is wrong.
>
Ok. The problem is that RFC 4035, section 3.1.3.2, mentions about ENT
under the name error response. That should be clarified in the
dnssec-bis-updates document then.

-mohan

>
> paul
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext