Re: dnssec-updates text, include SOA in negative answers

[Edward Lewis <Ed.Lewis@neustar.biz>]

Title: Re: dnssec-updates text, include SOA in negative answers

At 5:09 PM +0100 11/28/07, W.C.A. Wijngaards wrote:

>particular types, and so on. The outcome of these checks, taken together
>with the proof question, result in a security status. The security
>status is not determinable without determining as well whether the

>message is a referral or a negative (or something else).

Okay, I thought you meant something else.

It's necessary to understand the unchecked message before knowing "what to solve for."  So, it's plain to say that a message has to be unambiguous in meaning.

So returning to the original suggestion to include the SOA, I think (as already stated) that would be the wrong step.  We should stick with the suggestion in RFC 2308 to only send Type 2 negative responses (see the RFC for what Type 2 means) and just amplify that under DNSSEC.

I would think that we should recommend that a NXDOMAIN never include NS records.  That goes for caches that are not required to include the SOA as well as authoritative servers.  But - perhaps it is needed to help decide the RFC 2181 trustworthiness of the data?  Maybe not, if we can trust the AA bit.

From RFC 2181:

# Trustworthiness shall be, in order from most to least:
#
#     + Data from a primary zone file, other than glue data,
#     + Data from a zone transfer, other than glue,
#     + The authoritative data included in the answer section of an
#       authoritative reply.
#     + Data from the authority section of an authoritative answer,
#     + Glue from a primary zone, or glue from a zone transfer,
#     + Data from the answer section of a non-authoritative answer, and
#       non-authoritative data from the answer section of authoritative
#       answers,
#     + Additional information from an authoritative answer,
#       Data from the authority section of a non-authoritative answer,
#       Additional information from non-authoritative answers.

Then again, under DNSSEC, trustworthiness has less impact.

-- 

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Think glocally.  Act confused.