Subject: [dnsext] MaraDNS and NXDOMAIN/NOERROR on non-terminal nodes

From: Sam Trenholme <[email-masked]>
Date: Sat, 23 Apr 2011 14:11:40 -0500

Hello, I am Sam Trenholme, the implementer and maintainer of MaraDNS.
This email discusses whether to return NXDOMAIN or NOERROR with
non-terminal nodes.

I apologize for not writing this email sooner.  I became aware of the
relevant discussion this morning.  A description is here:

http://samiam.org/blog/20110423.html

To summarize:  Let us suppose we have the DNS name
www.sub.example.com, but, for whatever reason, sub.example.com does
not exist.  Let us further suppose that someone sends a request for
sub.example.com.  Do we return a NXDOMAIN or a "NOERROR" reply?

MaraDNS 1.0 returned a NOERROR reply.  MaraDNS 1.2 and later return a
NXDOMAIN reply.

The reason for the 1.0 -> 1.2 change is because I once got a private
email from a developer of an embedded DNS server.  This server was
unable to process "NOERROR" replies and thought it got a positive
reply if it received a NOERROR answer.

Since MaraDNS uses a hash to store records, it would be non-trivial to
return "NOERROR" for non-terminal nodes.  Since Paul Vixie has said
that "NOERROR" should not be returned in this case, this was
reasonable behavior when I implemented it thusly nearly six years ago.

MaraDNS does not have support for edns0 nor for DNSSEC, so mandating
this behavior only for DNSSEC-aware DNS servers would be reasonable.
However, since MaraDNS is only being maintained and is no longer
actively developed, it would be unfair to create a new RFC that
retcons under what circumstances a NXDOMAIN reply is sent from DNS
servers without edns0/DNSSEC support.

Please update http://tools.ietf.org/html/draft-vixie-dnsext-resimprove-00
appropriately.

Thank you for your time,

- Sam

P.S. As an aside, while I do side with DJB here, I do not always agree
with him.  For example:
http://maradns.blogspot.com/2010/09/eulogy-for-dnscurve.html
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: "John R. Levine" <[email-masked]>
Date: 23 Apr 2011 17:08:00 -0400

> Please update http://tools.ietf.org/html/draft-vixie-dnsext-resimprove-00

Particularly with IPv6 rDNS, the wrongness of returning NXDOMAIN for an 
empty node with other nodes below it is no longer harmless.  I'm working 
to fix rbldnsd, you can fix maradns.  It's an open question whether people 
will fix rbldnsd, or we'll just give up on it, since it's unlkely ever 
to handle EDNS0 or DNSSEC either.

By the way, telling people "you're wrong, change it because it's hard for 
me to fix" is rarely a winning strategy.  Within a day of my asking the 
djbdns list how hard it would be to fix tinydns, someone had an 
approximate fix for it.  It's not that hard, you put dummy entries in your 
hash where the noerror responses need to be.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Sam Trenholme <[email-masked]>
Date: Sat, 23 Apr 2011 17:33:02 -0500

[John: Sorry about giving you two copies of this email]

> the wrongness of returning NXDOMAIN for an
> empty node with other nodes below it

[citation needed].  In other words, accusations of RFC non-compliance
need to quote chapter and verse of the relevant RFC or are invalid.

> By the way, telling people "you're wrong, change it because it's hard for me
> to fix" is rarely a winning strategy

That's not what I said.  I said that Paul Vixie once said that the
opposite behavior was the correct behavior [1], so it was reasonable
for DNS implementers in the 2000s to feel the opposite behavior was
correct.  And, indeed, there are at least two DNS implementers which
did precisely that.

I do feel that, in light of that fact that ip6.arpa can be very
sparse, it would be helpful to have a DNS server be able to say "not
only does this node not exist, but all child nodes also do not exist".
 [2]  But doing it in a way that breaks the existing internet and has
security problems [3] is, IMHO, not a good idea.

- Sam

[1] http://groups.google.com/group/comp.protocols.dns.std/msg/69e4500e7b7d73c8

[2] Actually, on second thought, I have promised a friend that I would
implement a simple DNS server that would convert all queries in the
form "0.1.2.3.4.5.6.7.8.9.a.b.c.d.e.f.0.1.2.3.4.5.6.7.8.9.a.b.c.d.e.f.ip6.arpa
PTR" in to answers like
"ip6.fedc-ba98-7654-3210-fedc-ba98-7654-3210.example.com" (and,
correspondingly, convert AAAA queries for
"ip6.fedc-ba98-7654-3210-fedc-ba98-7654-3210.example.com" in to
"fedc:ba98:7654:3210:fedc:ba98:7654:3210"), so ip6.arpa does not
necessarily have to be sparse.

[3] http://marc.info/?l=djbdns&m=130141880325287&w=1 and
http://www.ietf.org/mail-archive/web/dnsext/current/msg11101.html
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Edward Lewis <[email-masked]>
Date: Mon, 25 Apr 2011 09:23:32 -0400

At 14:11 -0500 4/23/11, Sam Trenholme wrote:

>not exist.

By definition, a domain name with subdomains exists.  If there is a 
"www.shortname", then "shortername" exists.

RFC 4592, section 2.2.3.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: "Marc Lampo" <[email-masked]>
Date: Wed, 27 Apr 2011 08:25:59 +0200 (CEST)

Who claims that this in fact a subdomain ?
A '.' *can* be a delegation point, but it is not obligation.
--> "www.sub" might simply be a (one) string (label ?) in the zone
"example.com",
    with no delegation (SOA/NS) at the '.'

So "sub.example.com" is another label in the same zone file;
if that label does not exist by itself, I would say "NXDOMAIN" is the
logical answer.

Kind regards,

Marc Lampo

-----Original Message-----
From: Edward Lewis [mailto:[email-masked]] 
Sent: 25 April 2011 03:24 PM
To: Sam Trenholme
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [dnsext] MaraDNS and NXDOMAIN/NOERROR on non-terminal nodes

RFC 4592, section 2.2.3.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-
Edward Lewis
NeuStar                    You can leave a voice message at
+1-571-434-5468

---

From: Paul Vixie <[email-masked]>
Date: Wed, 27 Apr 2011 06:47:16 +0000

> From: "Marc Lampo" <[email-masked]>
> Date: Wed, 27 Apr 2011 08:25:59 +0200 (CEST)
> 

if there is a dot then the label on the left is always a 'subdomain', by
definition, though it might not also be a 'subzone' since no delegation
point is required by the dot syntax.

> A '.' *can* be a delegation point, but it is not obligation.

yes.

>     with no delegation (SOA/NS) at the '.'

it's two labels but it's in the same zone.

> if that label does not exist by itself, I would say "NXDOMAIN" is the

whether nxdomain is the right answer is unrelated to the question of
where the delegation points are.  though quite clearly if there is
a delegation point then a domain is not empty of rrsets since there
will be NS RR's there.

> "www.shortname", then "shortername" exists.

yes (though i think ed means "shortname" exists not "shortername" exists).
the proper response to QNAME=www.shortname is RCODE=0 ANCOUNT=0 in order
to signal an empty (but existing) domain name.
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Edward Lewis <[email-masked]>
Date: Wed, 27 Apr 2011 09:34:42 -0400

In short: Domain != Zone, subdomain != subzone.

The "." domain encompasses everything in the DNS.
The "." zone is just the names from "." to the TLD cut points.

E.g., "www.neustar.biz." is in the "biz." domain but not in the "biz." zone.

Any name exists if it has a descendent (or has at least one set of 
data).   That is, another name in it's domain.  If that other name 
(assuming we are talking about one label "down") owns an NS set, then 
that name is delegated to another zone.  If that other name does not 
a NS set, it is in the same zone.

A lot of thought has gone into this topic over the years.  Consult 
RFC 2308 and 4592 (and STD 13 too I suppose) for starters.  If you 
feel these RFCs are incorrect, suggest fixes or updates to them.

---

From: Hugo Salgado <[email-masked]>
Date: Wed, 27 Apr 2011 11:58:22 -0300

> to signal an empty (but existing) domain name.

I think the QNAME=shortname is the empty non-terminal, in this example.

Hugo

---

From: Edward Lewis <[email-masked]>
Date: Wed, 27 Apr 2011 11:27:31 -0400

As others pointed out...I should have written this.

At 9:23 -0400 4/25/11, Edward Lewis should have written:

>If there is a "www.shortname", then "shortname" exists.

>I think the QNAME=shortname is the empty non-terminal, in this example.

Yes, that's true.

---

From: Paul Vixie <[email-masked]>
Date: Wed, 27 Apr 2011 15:37:56 +0000

> Date: Wed, 27 Apr 2011 11:58:22 -0300
> From: Hugo Salgado <[email-masked]>
> 

you are of course quite correct.
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext