Subject: Re: DNSSEXT Yokohama Minutes

From: Roy Arends <[email-masked]>
Date: Wed, 4 Sep 2002 09:06:08 +0200 (CEST)

On Tue, 3 Sep 2002, Brian Wellington wrote:

> On Wed, 4 Sep 2002, Roy Arends wrote:
>
> > > And then there is the issue on memory usage in caches, there was an
> > > assertation that opt-in zones cause more memory consumption than other
> > > DNSSEC zones.
> >
> > This is true,
> >
> > A positive response with Opt-in holds:    QTYPE+NXT+SIG(NXT).
> >
> > A positive response without Opt-in holds: QTYPE+SIG(QTYPE).
>
> The positive response with opt-in also needs to contain proof that there's
> no secure wildcard, otherwise secure wildcards can be spoofed away.  This
> will mean another SIG and SIG(NXT) in almost every case.

No, you don't need proof for wildcards.

If I was to spoof a resolver, proof of [non-]existence of secure wildcards
does not prevent or help me do that.

If you asked for something in an unsecured interval, all bets are off.

Remember that this is for delegations only. Are you suggesting proof
of [absent] signed wildcard delegations ?

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Mon, 16 Sep 2002 08:40:41 -0400

I would think [0] that if a signed positive answer is given, there is 
no reason to show that there was potentially a wildcard (signed or 
unsigned) available.  If there exists an unsigned positive answer, 
*is* there a need to prove that there is no wildcard?  I guess so, 
but this is getting sticky.

>will mean another SIG and SIG(NXT) in almost every case.

[0] Apologies - I am reviewing the thread while flying back from 
RIPE, so the reply is delayed and possibly confused.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

---

From: Derek Atkins <[email-masked]>
Date: 16 Sep 2002 10:06:09 -0400

Edward Lewis <[email-masked]> writes:

> *is* there a need to prove that there is no wildcard?  I guess so, but
> this is getting sticky.

Note that the only "unsigned positive response" you could have is an
NS record.  I didn't think that wildcard NS records were allowed?

What it DOES mean is that you need to send twice as much data to prove
an NXDOMAIN.  It is not sufficient to just show the NXT for the
request, but you must also show the NXT for the wildcard.

-derek

> [0] Apologies - I am reviewing the thread while flying back from RIPE,
> so the reply is delayed and possibly confused.
> 
> -- 

-- 
       Derek Atkins
       Computer and Internet Security Consultant
       [email-masked]             www.ihtfp.com

---

From: Edward Lewis <[email-masked]>
Date: Mon, 16 Sep 2002 10:29:57 -0400

>NS record.  I didn't think that wildcard NS records were allowed?

I don't mean to imply that there is a wildcarded NS.  E.g.,:

In my zone I have:

*          900 IN TXT  "This is a wildcard match"
                   SIG  TXT
            900 IN A    10.10.10.10
                   SIG  A
            900 IN MX   10 host
                   SIG  MX
            900 IN NXT  alpha TXT A MX SIG NXT
and

alpha      900 IN NS   nameserver
                   SIG  NS
            900 IN NXT  beta NS SIG NXT(or not)
                   SIG  NXT
alpha1     900 IN NS   nameserver
alpha2     900 IN NS   nameserver
beta       900 IN NS   nameserver
                   SIG  NS
            900 IN NXT  gamma NS SIG NXT(or not)
                   SIG  NXT
...

If I ask for (alpha3 A) I get the wildcard.  If I ask for (alpha2 NS) 
I get the unsigned alpha2 NS.  If I ask for (alpha NS) I get the 
signed alpha NS.  If I ask for (alpha3 NS) I get no such data per the 
wildcard.

The issue here is that it is easy to spoof away the signed wildcard 
with opt-in.  Let's say I do ask for alpha3 A.  Since there's an 
opt-in-ized NXT saying that alpha3 is not explicitly signed in the 
zone, all an attacker needs to do is replay this before the answer 
with the signed * match returns - or - modify a cache to strip away 
the *-synthesized records from an answer.

At first I was surprised by Scott saying that the * trumps opted-out 
data, but now I agree with him.  If you don't assume that there is a 
signed * name in the zone, then it can be spoofed away.

So, if there is an applicable * - then it would hide all the 
unsecured matched "behind it" which is counter-intuitive to the 
algorithm in rfc1034/s4.3.3.

>request, but you must also show the NXT for the wildcard.

To match an opted-out name (unsecured) you have to prove it isn't 
secured, and that there isn't a potential wildcard, the latter may 
require multiple NXT's.

Also - does the presence of an opted-out name impact the scope of a 
wildcard's matches?
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

---

From: Derek Atkins <[email-masked]>
Date: 16 Sep 2002 10:52:45 -0400

> the *-synthesized records from an answer.

As I said, an answer of NXDOMAIN is incomplete without _TWO_ signed
NXT records, so a client would know they were being attacked if they
only received one.  Similarly, an attacker could not add an 'A' record
to this response, because opt-in only allows unsecured delegations.

> So, if there is an applicable * - then it would hide all the unsecured
> matched "behind it" which is counter-intuitive to the algorithm in
> rfc1034/s4.3.3.

Right, but there _are_ no unsecured matches because opt-in only allows
unsecured NS, and you cannot have an NS wildcard.

> secured, and that there isn't a potential wildcard, the latter may

This is correct, but only in the case where you have a multi-layer
zone.

> Also - does the presence of an opted-out name impact the scope of a

It doesn't.  It is no worse than a non-opted-out name.

-derek

---

From: Derek Atkins <[email-masked]>
Date: 16 Sep 2002 11:43:55 -0400

Edward Lewis <[email-masked]> writes:

> Which two NXT's would be sent to prove that alpha3 A does not exist?
> (Would it be that alpha3 is not a signed name and there is no signed
> wildcard?)

Yes.  Two two NXTs are:
        1) prove the alpha3 A does not exist
        2) prove there is no matching wildcard

> Remember that wildcards match names, not names&types.  If the wildcard
> has an A record and no NS record, all queries for matching names and
> (QTYPE=)NS get a NODATA response because the name matched.

HUH?  If I make a query for foo TXT I could get an MX response because
there is a * MX record?  Can you show me where in the RFCs that is
true?

> Okay, I see that, because an opted out name is a zone cut.  (But what
> do you mean by "worse?")
> 
> *.zone        TXT "matches names"
>                SIG TXT
> ...
> unsec.zone    NS
> ...
> 
> querying for anything below unsec.zone would result in a referral
> answer.  I guess this cements the rationale to diallow non-zone cuts
> in the opted-out portion of a zone.

By "no worse" I mean "no different"...

The only issue is the one that Roy pointed out..  You could have an
unsigned NS and a signed "* A" and you need to figure out which one to
believe.

-derek

---

From: Edward Lewis <[email-masked]>
Date: Mon, 16 Sep 2002 11:30:33 -0400

>As I said, an answer of NXDOMAIN is incomplete without _TWO_ signed

no need to yell ;)

>unsecured NS, and you cannot have an NS wildcard.

Remember that wildcards match names, not names&types.  If the 
wildcard has an A record and no NS record, all queries for matching 
names and (QTYPE=)NS get a NODATA response because the name matched.

---

From: Edward Lewis <[email-masked]>
Date: Mon, 16 Sep 2002 11:58:30 -0400

>there is a * MX record?  Can you show me where in the RFCs that is

As I said, if (according to your example) you ask for foo TXT, you do 
not follow the wild card because foo is a name in the zone.  BIND 
9.3.3. does this.  The algorithm followed is in RFC 1034, 4.3.2, in 
particular, step 3 a.

Here's much more detail on my test.  Note that the * has an MX, and 
beached-whale does explicitly exist without an MX.  Hence, asking for 
beached-whale's MX results in no data:

[lead-arin-net:~] edlewis% dig @0 beached-whale.ed.ds.isi.edu. MX

; <<>> DiG 9.3.0s20020722 <<>> @0 beached-whale.ed.ds.isi.edu. MX
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6309
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;beached-whale.ed.ds.isi.edu.   IN      MX

;; AUTHORITY SECTION:
ed.ds.isi.edu.          900     IN      SOA 
beached-whale.ed.ds.isi.edu. edlewis.arin.net. 5 1200 300 3600 900

;; Query time: 13 msec
;; SERVER: 127.0.0.1#53(0)
;; WHEN: Mon Sep 16 11:57:11 2002
;; MSG SIZE  rcvd: 97

[lead-arin-net:~] edlewis% dig @0 ed.ds.isi.edu axfr +multiline

; <<>> DiG 9.3.0s20020722 <<>> @0 ed.ds.isi.edu axfr +multiline
;; global options:  printcmd
ed.ds.isi.edu.          900 IN SOA beached-whale.ed.ds.isi.edu. 
edlewis.arin.net. (
                                 5          ; serial
                                 1200       ; refresh (20 minutes)
                                 300        ; retry (5 minutes)
                                 3600       ; expire (1 hour)
                                 900        ; minimum (15 minutes)
                                 )
ed.ds.isi.edu.          900 IN SIG SOA 1 4 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 UhMiJQArMQyYRxAA8edEI2tynsp1klLDaWolvR+Cq8P0
                                 nXkEYdrAjnvaQ/IwILrYT9hg6z9jar7KeeJ+WrgYZg== )
ed.ds.isi.edu.          900 IN NS beached-whale.ed.ds.isi.edu.
ed.ds.isi.edu.          900 IN SIG NS 1 4 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 nrQVW6iteDqIFvsTivQ/nxRlirZYeYyiE+mw/vmkGfE7
                                 tN+a2BWA5xURifBW341j57yNZivcw6RxBOQry88o0A== )
ed.ds.isi.edu.          900 IN KEY 256 3 1 (
                                 AQPJUDzlyI3S2+ea332/86q7AyouGHidz3HeMC86UtVN
                                 68nbuRGhmHfZCSHmCSNmO2WK3mVwbTWNR2MCyGjd2eUj
                                 ) ; key id = 55781
ed.ds.isi.edu.          900 IN KEY 256 3 1 (
                                 AQPuFDhGvOx1W1csG9r1TAGEohxqLKJKFohNNDuN3r+9
                                 8EmbxVMa8VCqIwqnr3D05/ehxNJRnIqPlUGJa8EV1xcL
                                 VtbI0gV9VQ3UsvXR7w8B34/XcEZFhLB3Tx5QlaE1QbF7
                                 oftosSVQ5DJIzWHy8cnEWoBC+s3Y+yX/Y9epU8Q2eQ==
                                 ) ; key id = 50230
ed.ds.isi.edu.          900 IN SIG KEY 1 4 900 20020927193713 (
                                 20020828193713 50230 ed.ds.isi.edu.
                                 VAFn5ZZEwbWO3maEcanM5rjY1vU+m3PGJPZXMLcem8dn
                                 ZFeAA/Ve0Y8Vp8lfUGnYHIJMNm438I1LUHoDncsUEWrT
                                 pYNKyEGu/poyA5Oo2yPkUpkF3UdvtGBdU737LK8rIpWV
                                 ftmewRxC4zvmVJauJZN+xT7YWKcp6h2eg682n6U= )
ed.ds.isi.edu.          900 IN SIG KEY 1 4 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 n8N04exFheDKFo52P0QxZI+xziYXoaEbrtXtgf+Mvkiu
                                 yosVsDNT4EJPEZNuuLiAMe7cjacJAN//IQRlcsutbw== )
ed.ds.isi.edu.          900 IN NXT *.ed.ds.isi.edu. NS SOA SIG KEY NXT
ed.ds.isi.edu.          900 IN SIG NXT 1 4 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 p7r4ABIIWAOzLkb7MZvR9crQDb4ZbLRruzaMRr9XFWtf
                                 PZlv2zidWfNLDG2h0H1lrQ5bBsMd8cx8/e+zkLttew== )
*.ed.ds.isi.edu.        900 IN MX 10 smtp.ed.ds.isi.edu.
*.ed.ds.isi.edu.        900 IN MX 20 host.ed.ds.isi.edu.
*.ed.ds.isi.edu.        900 IN SIG MX 1 4 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 bzbEWzTp4BoUyspMyudPcbNalVXSY2IsyVSw7/IoUeWL
                                 nvz9JJNnbFv8hHAnoDKjqS8J0sQxg97w7omsg2dIeA== )
*.ed.ds.isi.edu.        900 IN NXT beached-whale.ed.ds.isi.edu. MX SIG NXT
*.ed.ds.isi.edu.        900 IN SIG NXT 1 4 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 HXSi3DHfN9Fv+IcUD/08YfCNPA9HqLYR0GApgVQmIUjh
                                 fv4dZW9a2LZQ202UqOdw5s1BX9bWIkYMXmPtZUoqkw== )
beached-whale.ed.ds.isi.edu. 900 IN A 65.123.202.244
beached-whale.ed.ds.isi.edu. 900 IN SIG A 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 Oo80DkHoXXTBryuwd4plMBm2W2dtdXBuPQFBYSQs909/
                                 N23p/0KLfjOz1MD0XOm1mi1qAFnlP7C+8J2MXDtpOQ== )
beached-whale.ed.ds.isi.edu. 900 IN NXT david.ed.ds.isi.edu. A SIG NXT
beached-whale.ed.ds.isi.edu. 900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 hGtiKOGrHUsWuIkJhZigGF3+U2tzbuCOFHbi/IDQz05G
                                 OmEje0Ta1BMi3RPvCS/eilCMwx1IykB+duJeiUQxZg== )
david.ed.ds.isi.edu.    900 IN NS vogon.david.ds.isi.edu.
david.ed.ds.isi.edu.    900 IN NXT host.ed.ds.isi.edu. NS SIG NXT DS
david.ed.ds.isi.edu.    900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 AQWxgYrY/UnAIyFUkjNTkoiSmD/iEbaWJhD8VH+MI0Ia
                                 tQdIUf927HlKaUF6pMRK9Bv/WmqwAa8SNERF4LnA2w== )
david.ed.ds.isi.edu.    900 IN DS 62959 3 1 (
                                 4A4BEC280149BFFC8268C70EC81FA9D744178F74 )
david.ed.ds.isi.edu.    900 IN SIG DS 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 Ez1mXR2VKx7MjvM856Y6UIuxCg2KoEXunh0En4cVYGBO
                                 /MbKvJPZmigTj52pnvu8+52k9X5eQI0sSbRdhGcJlA== )
host.ed.ds.isi.edu.     900 IN A 65.123.202.244
host.ed.ds.isi.edu.     900 IN SIG A 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 nRY8yYHDR5201t/hA1pX0vVVV7CmuRTTugslcfMkVSbz
                                 5QUVKx9NdBsMpOYNdLQ3mpJdfutRfyFGl5AFf9c/aw== )
host.ed.ds.isi.edu.     900 IN AAAA 2001:5ff::3
host.ed.ds.isi.edu.     900 IN SIG AAAA 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 oqP4p87CVlU03bddJMmLZf5OVnmULuY6fhXodk/bhCw6
                                 aG1Dun7pcoghs+/K3Eb5I+5yXMO/RqlHBVsixBpBKQ== )
host.ed.ds.isi.edu.     900 IN NXT _ftp._tcp.host.ed.ds.isi.edu. A SIG AAAA NXT
host.ed.ds.isi.edu.     900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 DQyvEk4aapa7/HAX/TuASbqezKd19IOZiBvRxVupuWwR
                                 agGm+wzrLh1EHmjzBb/TciPFR1Cmvo88ItnyF5gO0A== )
_ftp._tcp.host.ed.ds.isi.edu. 900 IN TXT "ftp server information"
_ftp._tcp.host.ed.ds.isi.edu. 900 IN SIG TXT 1 7 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 I2qPmjGY9egHq1WvN04Yu7pmBSLwH+no6RsWosDGKxGk
                                 kqFCf0mmm6OXCmP0tbip+PC6jAmKicsEdOoZLMbWFA== )
_ftp._tcp.host.ed.ds.isi.edu. 900 IN NXT localhost.ed.ds.isi.edu. TXT SIG NXT
_ftp._tcp.host.ed.ds.isi.edu. 900 IN SIG NXT 1 7 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 LJwFyoc2YBxBKD6jHlatX+wxXxopMPFEPMTt9sWORebQ
                                 kcwmEMaDj3jDGXDSAGWtxaccJszxmakMpmFyk2i2gQ== )
localhost.ed.ds.isi.edu. 900 IN A 127.0.0.1
localhost.ed.ds.isi.edu. 900 IN SIG A 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 LAFrBp1lLMLHoaMTrCY+ARtaKx8Oa5JDfwVtScSd5BYX
                                 3x74mtFX1ygim53vjwBx3Lv43DA8ssfLcTNbCL6atQ== )
localhost.ed.ds.isi.edu. 900 IN NXT loghost.ed.ds.isi.edu. A SIG NXT
localhost.ed.ds.isi.edu. 900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 h0Wg8aCFPfjkV4KykZCL7pdOc7GKe/JqcIu5yyVWYB5I
                                 vFNlxjXv4n5TCWrdhc4LBxHPV9v/2CakfNUQ2GXLmA== )
loghost.ed.ds.isi.edu.  900 IN CNAME localhost.newzone.ds.isi.edu.
loghost.ed.ds.isi.edu.  900 IN SIG CNAME 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 H0jkvprDiuDQ3KFMdEk4rAC+dBVS1L37PXVpQMoDSGkM
                                 DFgtUNgQbLg+9A8yyUrP3g2tcceNKPJ5oX1WrxfCbg== )
loghost.ed.ds.isi.edu.  900 IN NXT loopback.ed.ds.isi.edu. CNAME SIG NXT
loghost.ed.ds.isi.edu.  900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 qua6I9c61eMfmU3txLXyXaMflKa0LIDNGHyw0DLr/6lB
                                 xDtlse84K1BM7rTLRxsGZHhBuVCI9LCs7dIB1VBp/A== )
loopback.ed.ds.isi.edu. 900 IN CNAME localhost.newzone.ds.isi.edu.
loopback.ed.ds.isi.edu. 900 IN SIG CNAME 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 xzRYUs2nk3NqaOqaXaEVp73NuT945B4K5ldCt5Y8hqAa
                                 m0OsVDdnLvNpFJauXHnNAFB78VixfE6MPXWHTB+pYQ== )
loopback.ed.ds.isi.edu. 900 IN NXT sec.ed.ds.isi.edu. CNAME SIG NXT
loopback.ed.ds.isi.edu. 900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 XGRJn1f1ALCwcm7D66kC02PLgwOk3GB/O2kaM3+mXM9+
                                 H8ykGLpdiPK1dI4RLG7d9bC9kdWIbwCemBWCO+DqDw== )
sec.ed.ds.isi.edu.      900 IN NS beached-whale.ed.ds.isi.edu.
sec.ed.ds.isi.edu.      900 IN NXT smtp.ed.ds.isi.edu. NS SIG NXT DS
sec.ed.ds.isi.edu.      900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 qZdL5M/XGTmPnFWSLrsn5IDLUaWZA64ldymrsuXB+u04
                                 RB3oiH6ofVEAc05PkhIiSFE5e19aj+AO5VUdEG5tCQ== )
sec.ed.ds.isi.edu.      900 IN DS 41704 1 1 (
                                 FC2ADFD12402782BA6BFB4C17C5DC52A32E8DDD8 )
sec.ed.ds.isi.edu.      900 IN SIG DS 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 KXG7YeoQWU6/4GDpQVJPeGT6OJY4HB0OYq7+MvxYLRbd
                                 A/zNEuK70cCZ48jesSvXd6CHFPSpOHxpdiqWK0iISA== )
smtp.ed.ds.isi.edu.     900 IN A 65.123.202.244
smtp.ed.ds.isi.edu.     900 IN SIG A 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 EErG7nINF9UFzjHEOetkXY6ogHijhNt13Bw+3196GWgj
                                 jw0abt9+JLt9D8B6V9v0dxYIyd5FQbX99C5WPiLDKw== )
smtp.ed.ds.isi.edu.     900 IN AAAA 2001:5ff::2
smtp.ed.ds.isi.edu.     900 IN SIG AAAA 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 FhQsCREVN1YhpvKHqiQBRhQbsPmaWLvPzGYwKFCnMtYB
                                 kTZR4R3jqupnXJ8DPCJQlqqMMugmfkLe1Qe73lQ9eg== )
smtp.ed.ds.isi.edu.     900 IN NXT unsec.ed.ds.isi.edu. A SIG AAAA NXT
smtp.ed.ds.isi.edu.     900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 xZZ3MEGo4PiCKwAWBnJi5kwWSTDkXJpT6ILVo8KBKVi3
                                 IvZoGx6OOgE+J7aWcQDD+OtYs+Ujm7PCI+pqj9HriA== )
unsec.ed.ds.isi.edu.    900 IN NS beached-whale.ed.ds.isi.edu.
unsec.ed.ds.isi.edu.    900 IN NXT www.ed.ds.isi.edu. NS SIG NXT
unsec.ed.ds.isi.edu.    900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 pjX6if7tDzPuzQknIp5BXdTzrQk5zkqzxN4BksMeeVHS
                                 MQA4ATLKgPIjsCIsJN3G84tezCRPVaNGAS4n8OPK6g== )
www.ed.ds.isi.edu.      900 IN CNAME www1.ed.ds.isi.edu.
www.ed.ds.isi.edu.      900 IN SIG CNAME 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 Xf8Z+OEKVGdiZlQbati0BEzv00n3Lk1vmzCR0Xjjj13n
                                 gyc3tIe97p8irddlrDyTRLUeFMN27xEHzqugKgxbdg== )
www.ed.ds.isi.edu.      900 IN NXT www1.ed.ds.isi.edu. CNAME SIG NXT
www.ed.ds.isi.edu.      900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 f+ECccgy3GPEG4nic8GYMlxip8OgLZYXJveXygS8oaZV
                                 TByKn/oNjNkOBCZyhs1GU4IHnt6b2y7IJwtKBizoZA== )
www1.ed.ds.isi.edu.     900 IN MX 10 smtp.ed.ds.isi.edu.
www1.ed.ds.isi.edu.     900 IN MX 20 host.ed.ds.isi.edu.
www1.ed.ds.isi.edu.     900 IN SIG MX 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 dueZ7jvStmSKn6q3aOBlf1vEJiNMVKNhjrcUiwzZDdvf
                                 16VGQvqimApJgSgJStW+dHXlVyeu+5HHyDHutX2dRQ== )
www1.ed.ds.isi.edu.     900 IN TXT "no stinkin' http here"
www1.ed.ds.isi.edu.     900 IN SIG TXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 or3rujTTdX+Cuv02HFintNte6H//YLsonUGdAFSasEzT
                                 Px14yBADTC2n+7vvpFiauGbeKy8QCWR1j3fGYZb1AQ== )
www1.ed.ds.isi.edu.     900 IN AAAA 2001:5ff::1
www1.ed.ds.isi.edu.     900 IN SIG AAAA 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 dTmx3oVmTlotq8MRifZ/HfMHg8aAPEK8axOlRl1shdW8
                                 7n3Lo/w2BOEeHufImMuHFFu4DSZBj5CeZPco9DT1SQ== )
www1.ed.ds.isi.edu.     900 IN NXT ed.ds.isi.edu. MX TXT SIG AAAA NXT
www1.ed.ds.isi.edu.     900 IN SIG NXT 1 5 900 20020927193713 (
                                 20020828193713 55781 ed.ds.isi.edu.
                                 FKYpsF89LpA+MpxpZr/cnlgU0dwV7t6Lw5J12YzoLcca
                                 uv2m2X2sL9qBVy6+yty5kT6dMxrwgKZIxTrgbt+05A== )