Subject: draft-ietf-dnsext-nsec3-06

From: Mark Andrews <[email-masked]>
Date: Mon, 21 Aug 2006 11:56:58 +1000

7.3.

   Once the closest encloser has been discovered, the validator MUST
   check that the NSEC3 that has the closest encloser as an ownername is
   from the proper zone.  Neither the NS nor the DNAME type bit may be
   set: this would be an indication that an attacker is using them to
   falsely deny the existence of records for which the server is not
   authoritative.

	The test for a valid CE is wrong.  SOA + NS is a valid CE.

-- 
ISC Training!  October 16-20, 2006, in the San Francisco Bay Area,
covering topics from DNS to DHCP.  Email [email-masked].
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE:	+61 2 9871 4742		         INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>