Subject: [DNSOP] ENT and NXDOMAIN: the case of RFC 4035

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 25 Sep 2016 10:14:22 +0200

[If you don't enjoy byzantine discussions, with a lot of
chapter-and-verse mentions of RFCs, please skip the thread.]

I've been directed recently to RFC 4035 and there is a question I would
like to ask about its handling of ENTs.

Section 3.1.3 says:

   No Data: The zone contains RRsets that exactly match <SNAME, SCLASS>
      but does not contain any RRsets that exactly match <SNAME, SCLASS,
      STYPE>.

   Name Error: The zone does not contain any RRsets that match <SNAME,
      SCLASS> either exactly or via wildcard name expansion.

The second item means that a "name error" (NXDOMAIN) is an appropriate
response for an ENT. It seems to contradict all recent RFCs.

Section 3.1.3.2 mentions explicitely the ENT but just says to send
NSEC records, and does not mandate a specific error code (except in
its title, which is a bit ambiguous).

My gut feeling is that RFC 4035 is wrong. But I prefer to ask first:
how do you read it?

---

From: Matthijs Mekking <[email-masked]>
Date: Mon, 26 Sep 2016 09:49:42 +0200

Stephane,

> My gut feeling is that RFC 4035 is wrong. But I prefer to ask first:

I think you are right that 4035 is wrong. I think it meant to say
something like:

  Name Error: The node <SNAME, SCLASS> does not exist in the zone either
exactly or via wildcard name expansion.

where existence is defined in the at time not yet existing RFC 4592
Section 2.2.3.

Best regards,
  Matthijs

> 
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Ray Bellis <[email-masked]>
Date: Mon, 26 Sep 2016 09:31:32 +0100

> where existence is defined in the at time not yet existing RFC 4592

This came up before.  See
<https://www.ietf.org/mail-archive/web/dnsop/current/msg15809.html>

Roy Arend's response was that the intent was that an ENT response
requires the same NSEC records as an NXDOMAIN response, but not the same
RCODE.

Ray

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 29 Sep 2016 13:24:42 +0200

On Mon, Sep 26, 2016 at 09:31:32AM +0100,
 Ray Bellis <[email-masked]> wrote 

> requires the same NSEC records as an NXDOMAIN response, but not the same

Sure, but the title of the section is very misleading.

I tried to write an errata to RFC 4035 but it is complicated because
it requires to find new terminology for the two cases named "No data"
and "Name error".

May be just adding in 3.1.3.2:

   This section only deals with NSEC records to return. Its title does
   not imply that the proper RCODE is
   always "Name error" (NXDOMAIN). For instance, in the case of an
   ENT, the correct RCODE is "No error".