Subject: dnssec-bis item, include SOA

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Tue, 11 Mar 2008 20:23:22 +0100

Hi,

There was confusion during DNSEXT about what I proposed. And what the
trouble is. As Mark said, the trouble is some replies can be ambiguous.
I have not seen this in practice, but stumbled on it while implementing
a validator. Very much in the spirit of RFC2308. But RFC2308 does not
include DNSSEC of course. The presence of NSEC/NSEC3 records in the
authority section does not relieve the replier of the obligation to
include a SOA record for the receiver to determine the proper negative
response type. The NSEC/NSEC3 records only provide authentication.

All major implementations (esp DNSSEC aware) perform brilliantly on
this, as far as I know, I only thought that it could be documented more
clearly. Hence the dnssec-bis suggestion.

Best regards,
~   Wouter

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>