Subject: new DS draft question

From: Brian Wellington <[email-masked]>
Date: Tue, 5 Mar 2002 12:01:42 -0800 (PST)

The new draft contains the following text:

   An authoritative server queried for type DS MUST return the DS RRset
   in the answer section along with the corresponding NXT RRset in the
   authority section.  If the server is authoritative for both parent
   and child zones, the answer MUST be from the parent.  A caching
   server MUST behave the same way, returning the DS RRset and the
   parent's NXT RRset, if records are available.

I don't understand why the NXT record is returned on a successful query.  
The querying server needs only the DS record and its signatures to 
continue on the validation process, and including an NXT record in the 
authority section makes this look confusingly like a negative response.
Is there a reason for doing this?

I also don't fully understand why the NXT needs to be present in referrals 
to secure zones (the DS is already there, and all that's needed), but 
that's another story.

Brian

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>