Subject: SOA records in negative responses

From: Roy Arends <[email-masked]>
Date: Mon, 15 May 2006 16:22:10 +0100

Hi,

Negative responses may have SOA records included so the cache has an 
indication for the time it should cache a negative response.

With DNSSEC, all negative responses have NSEC records with its own TTL. 
Therefor, I don't think it is useful to include SOA record and 
signature(s), saving a little more space, and reducing the amplification 
vector a bit.

I've heard arguments in private discussions that a cache would want the 
SOA record anyway in order to include it in non-dnssec negative responses 
to RD=1 requests. However, this is not required, since a resolver could 
easily return rfc2308 name-error response type 3 or 4 (or nodata response 
type 3).

Is this worth discussing ?

Regards,

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Robert Martin-Legene" <[email-masked]>
Date: Thu, 25 May 2006 01:20:56 +0200

> indication for the time it should cache a negative response.

Hello Roy.

I think some people want / use it for finding zone cuts. I have no
practical experience if it's worth anything, but I believe Paul had
some input at IETF64.. or was it Mark?

-- Robert, .dk

---

From: Mark Andrews <[email-masked]>
Date: Thu, 25 May 2006 10:46:30 +1000

> some input at IETF64.. or was it Mark?

	draft-andrews-dnsext-soa-discovery-00

	I need to revive it, possibly by requesting publication,
	as it expired April 14, 2006.

	Mark
 
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Jim Reid <[email-masked]>
Date: Thu, 25 May 2006 10:02:54 +0100

> some input at IETF64.. or was it Mark?

There is a draft in the ENUM WG -- draft-ietf-enum-void-02.txt --  
that relies on this technique. The idea was a lookup for an  
undelegated number would get an NXDOMAIN response containing the SOA  
for the zone cut. A lookup for the name of that zone cut could  
identify a default SIP server or whatever. The intention is to avoid  
the evils of wildcards.

---

From: Paul Vixie <[email-masked]>
Date: Thu, 25 May 2006 14:05:32 +0000

> > some input at IETF64.. or was it Mark?

mark's draft on this is excellent.  much better than the comments in my
code where the technique was first worked out, and more accessible too.
(see bind8/src/lib/resolv/res_findzonecut.c for history.)

> that relies on this technique. The idea was a lookup for an  undelegated
> number would get an NXDOMAIN response containing the SOA  for the zone
> cut. A lookup for the name of that zone cut could  identify a default SIP
> server or whatever. The intention is to avoid  the evils of wildcards.

lovely.  somebody should tell the SPF people though.  dns doesn't subclass
well, but it can be done.

---

From: Julian Mehnle <[email-masked]>
Date: Thu, 25 May 2006 18:47:50 +0000

Paul Vixie wrote:
> lovely.  somebody should tell the SPF people though.  dns doesn't
> subclass well, but it can be done.

I have been following this thread and will bring it to the attention of 
[email-masked].