Subject: new DNSSECbis implementation notes doc

From: Samuel Weiler <[email-masked]>
Date: Tue, 8 Mar 2005 15:27:53 -0500 (EST)

In an effort to keep minor DNSSECbis clarifications in one place, I
started this document.  There won't be an announcement 'til next week,
but it's in the repository now.  Comments, suggestions, and
contributions are welcome.

Would the WG like to adopt this as a WG work item?  What else needs to
be included (send text)?

http://www.ietf.org/internet-drafts/draft-weiler-dnsext-dnssec-bis-updates-00.txt

-- Sam

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Scott Rose" <[email-masked]>
Date: Tue, 8 Mar 2005 21:06:53 -0600

I think the cause of the inconsistency in section 4 of the document is
actually just because of poor wording.  Section 4.2 is correct, NS queries
should be used to find the parent of a given zone.  B.8 (and C.8) is
actually an example of a DNS query that generates a NSEC response.  In that
scenario, a resolver is trying to obtain a DS RR for a given zone, and
mistakenly sending the query to the child zone.  It gets back the NSEC RR
showing it is the child zone, and therefor the wrong zone server to ask.
The query for the DS RRType is only for the example purpose.

So it is actually 2 different topics in the two sections, and should not be
read together.  Admittedly, it may need further clarification.

Scott

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Samuel Weiler
> Sent: Tuesday, March 08, 2005 2:28 PM
> To: [email-masked]
> Subject: new DNSSECbis implementation notes doc
>
>