Subject: Re: Empty non-terminals and NSEC records

From: Rob Austein <[email-masked]>
Date: Wed, 03 Dec 2003 14:14:12 -0500

At Wed, 03 Dec 2003 15:49:07 +0100, Erik Rozendaal wrote:
> 
> The example zone in the draft-ietf-dnsext-dnssec-protocol-03.txt document 
> contains the following records (among others and excluding RRSIG records):
> 
>     ns2.example.   3600 IN A   192.0.2.2
>                    3600 NSEC   *.w.example. A RRSIG NSEC
>     *.w.example.   3600 IN MX  1 ai.example.
>                    3600 NSEC   x.w.example. MX RRSIG NSEC
> 
> Notice there are no RRs for the w.example. domain, making it an empty 
> non-terminal.  According to the original DNS RFCs empty non-terminals do 
> exist (in other words, querying for w.example. will not result in NXDOMAIN 
> but in NODATA).
> 
> However, the signed version does not include proper NSEC records for 
> w.example.  Is this intentional and expected behaviour?

Er, if empty non-terminal nodes had NSEC RRs, they wouldn't be empty.

The approach we took in the DNSSECbis docs was to talk about RRsets
and owner names of RRsets rather than name existance per se.

If you're asking what the form of a response should be for a query
w.example, it'd be the form covered in 3.1.3.2: note that section
3.1.3.2 deliberately does not specify the RCODE.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Thu, 04 Dec 2003 08:28:18 +1100

> Erik

	You don't need a NSEC record to know that w.example exists.
	You can prove that it exist with this NSEC record.

	ns2.example. NSEC *.w.example. A RRSIG NSEC

	The above record proves that "ns2.example.", "*.w.example.",
	"w.example.", "example." and "." exist.

	It also proves that "ns2.example." and "*.w.example." contain
	data.  It also proves what data exists at "ns2.example.".

	It also proves that "w.example." is empty.

	It does not say whether "example" or "."  contain data or not.

	Note "example." is the common subdomain of the two domains in
	the record.

	Note "w.example." is a interior domain between the common
	subdomain and the next domain name.  Interior domains between
	the common subdomain and the next domain name are always
	empty.

	Mark

--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]