Subject: DNAME Issue 16: NSEC3 "under" DNAME RRs

From: Scott Rose <[email-masked]>
Date: Thu, 08 Feb 2007 07:41:58 -0500

New Issue 16:  NSEC3 "under" DNAME

This is different the previous issue 4.12
NSEC3 and DNAME:

http://ops.ietf.org/lists/namedroppers/namedroppers.2006/msg01342.html

The orginal specification for DNAME states that no other
names can exist below a DNAME RR.  However, NSEC3 uses
hashed ownernames, so a zone with a DNAME at the apex
would have the apex name NSEC3 RR exist below the DNAME
(technically).

Currently, draft-ietf-dnsext-rfc2672bis-dname-01 states
in section 5.3:

    NSEC3 records and their signatures are allowed
    to exist below a DNAME.  This is because of the
    nature of NSEC3 RRs in DNSSEC, which creates
    hashed owner names that exist below the apex.
    This is an exception to the rule that there MUST
    NOT be any other RRs under a DNAME RR, if the
    DNAME RR exists at the zone apex.

    Queries for NSEC3 owner names are redirected as
    if there were no such NSEC3 present.

Is this text considered sufficient?  If so, no further
action will be taken.  If not, please suggest changes
and/or provide text.

Scott and Wouter
DNAME clarifcation draft editors

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>