Subject: RE: NSEC2 01

From: Samuel Weiler <[email-masked]>
Date: Tue, 27 Jul 2004 17:32:22 -0400 (EDT)

> > I'm not convinced that the wildcard discussion/example is correct.
>
> I'm guessing it's the part about response construction.  In the
> example, I don't know why 2) non-existance of b.c.d.e. is there.
> Shouldn't the EXIST RR and subsequent NSEC2 RR show who the closest
> encloser is?  That's how the current DNSSECbis spec does it.  The
> server only needs to provide:

I thought any label stopped wildcard processing.  Meaning you'd have
to prove that a.b.c.d.e isn't there (Section 5, item a) and that
there's no *.b.c.d.e (not listed), but that the other items listed in
Section 5 don't need to be proven.  I'm not certain about this, which
is why I wanted our wildcard experts to speak up.

I also don't understand where EXIST records must be inserted into a
zone.  Perhaps the document editor would clarify this?  For what it's
worth, Section 3 probably needs to say something about the EXIST RR
presentation format.

-- Sam

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>