Subject: semantics of responses

From: "D. J. Bernstein" <[email-masked]>
Date: 24 Nov 1998 19:58:31 -0000

An iterative resolver must distinguish between a response that ``answers
the question,'' a response that ``contains a better delegation,'' a
response that ``shows a CNAME,'' and a temporary failure.

What exactly do these phrases mean? I don't see definitions in RFC 1034
and RFC 1035. The examples are clear, but they don't cover every case,
even if we assume that the resolver never uses qdcount larger than 1.

(Can a server reject packets where qdcount is larger than 1? Should it
use rcode 4? What exactly does rcode mean for multiple queries, anyway?)

The most obvious problem is to distinguish between referrals and (lame
or cached) non-authoritative no-matching-data answers. In both cases aa,
rcode, and ancount are zero. Does the lack of an NS in the authority
section, for non-truncated responses, guarantee that this is an answer?
Does the presence of an NS, for single-query responses, guarantee that
this is a referral? Or does that depend on whether the NS matches part
of the query name? Does it matter whether there is an SOA?

---Dan

---

From: [email-masked]
Date: Wed, 25 Nov 1998 09:07:21 +1100

> of the query name? Does it matter whether there is an SOA?
	Have a look RFC 2308.  It goes into more detail about some of these
	issues.  They need to be clarified to get negative caching working.

	Mark
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "D. J. Bernstein" <[email-masked]>
Date: 30 Nov 1998 20:47:11 -0000

[email-masked] writes:
> Have a look RFC 2308.

Thanks. You seem to be suggesting this algorithm to handle single-query
responses:

   (1) If rcode is 3, stop. The domain does not exist (except possibly
       as an alias for a nonexistent domain).

   (2) Otherwise, if rcode is nonzero, try again later. The domain may
       or may not exist.

   (3) Otherwise, if the answer section contains one or more records
       (for this domain) of the right type and class, stop. The domain
       exists, and those are the answers.

   (4) Otherwise, if the answer section contains a CNAME (for this
       domain), replace the domain with the CNAME and start over. The
       domain is an alias.

   (5) Otherwise, if there are one or more SOA records in the authority
       section, stop. The domain exists, and there are no answers.

   (6) Otherwise, if there are one or more NS records in the authority
       section, start over with those servers. The domain may or may not
       exist; this is a referral.

   (7) Otherwise stop. The domain exists, and there are no answers.

Did I get that right? Are there any other exceptions?
   
I'm still wondering about responses with qdcount > 1. How exactly is a
client supposed to interpret such responses? What exactly is the server
supposed to do if some names have answers, some names exist but have no
answers, some don't exist, some encounter temporary failures, and some
are delegated to other servers? Is the server permitted to reject
packets with qdcount > 1? Does anyone actually use qdcount > 1?

---Dan

---

From: [email-masked]
Date: Tue, 01 Dec 1998 10:03:10 +1100

> Did I get that right? Are there any other exceptions?

	That is about it.  You have to take care with CNAMES, type ANY
	queries and recursion.

> packets with qdcount > 1? Does anyone actually use qdcount > 1?

	Well BIND refuses to answer such queries at present, I don't
	know what the Microsoft server does.

	There is some work going on at present in the working group to
	define the behaviour for qdcount > 1.

	See:
	http://www.ietf.org/internet-drafts/draft-ietf-dnsind-edns0-00.txt
	http://www.ietf.org/internet-drafts/draft-ietf-dnsind-edns1-01.txt

	Mark