Subject: Re: Wildcard NS and DNSSEC

From: Paul Vixie <[email-masked]>
Date: Sat, 25 Oct 2003 15:25:17 +0000

> ...  Section 6.2 of wildcard-clarify says (essentially):
> 
>    Is it not a protocol error to have a NS RR owned by a wild card
>    domian name, complimentary to the case of a SOA RR.  However, for
>    this to work, an implementation has to know how to synthesize a
>    zone.
> 
> In other words, wildcard NS records are technically legal.  I am
> not taking a position on whether or not they should be legal.

fwiw, i am.  the above wording gives no guidance to implementors and
should be struck from the document.  the proper wording is simply that
"Having an NS RRset owned by a wild card domain name is undefined" which
in terms of guidance to implementors is very much clearer.  Either set
of wording leaves open the possibility of later defining it.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Tue, 28 Oct 2003 22:10:46 +0000

> > I don't much like this either, but the WG has not chosen to rip the
> > covers off of this particular piece of 2535.
> 
> I guess I'm in the position of arguing that it needs to.

i agree.  and just to make sure my position is unambiguously clear:

> ...  I'll take a position: DNSSEC is not complete without the ability
> to handle types > 127.  Just because there aren't any now is no excuse.

i agree with this too.

> Here is an alternative strawcritter:

sounds like a bakeoff is in order.  mister graff, you may fire when ready.