Subject: [DNSOP] I-D Action: draft-ietf-dnsop-nxdomain-cut-00.txt

From: [email-masked]
Date: Sun, 27 Dec 2015 13:23:49 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Domain Name System Operations Working Group of the IETF.

        Title           : NXDOMAIN really means there is nothing underneath
        Authors         : Stephane Bortzmeyer
                          Shumon Huque
	Filename        : draft-ietf-dnsop-nxdomain-cut-00.txt
	Pages           : 9
	Date            : 2015-12-27

Abstract:
   This document states clearly that when a DNS resolver receives a
   response with response code of NXDOMAIN, it means that the domain
   name which is thus denied AND ALL THE NAMES UNDER IT do not exist.

   REMOVE BEFORE PUBLICATION: this document should be discussed in the
   IETF DNSOP (DNS Operations) group, through its mailing list.  The
   source of the document, as well as a list of open issues, is
   currently kept at Github [1].

   This documents clarifies RFC 1034 and modifies a bit RFC 2308 so it
   updates both of them.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-nxdomain-cut/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-dnsop-nxdomain-cut-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 27 Dec 2015 22:35:12 +0100

On Sun, Dec 27, 2015 at 01:23:49PM -0800,
 [email-masked] <[email-masked]> wrote 

> 	Filename        : draft-ietf-dnsop-nxdomain-cut-00.txt

This follows the Call for Adoption and its result. The main changes
from the previous non-WG document are:

* new text for the "Rules" section, the heart of the RFC, to be
  implementation-independent

* new concept, "denied name" (the NXDOMAIN does not always refer to
  the QNAME, see RFC 6604)

* new text for the DNSSEC case (NSEC* records to return)

* new implementation, Unbound

* move the discussion on the use of the SOA in an appendix

But now it's a WG document, the working group can command :-)