Subject: [DNSOP] RFC 6891 Clarification (EDNS=1 and higher behaviour)

From: Ondřej Surý <[email-masked]>
Date: Mon, 15 Sep 2014 17:09:01 +0200 (CEST)

Hey all,

we have received a notice that Knot DNS adds an
answer in case the EDNS=1 (and higher) in the
response where RCODE=BADVERS (and OPT EDNS=0).

The RFC 6891 doesn't forbid such behaviour:

      If a responder does not implement the VERSION level of the
      request, then it MUST respond with RCODE=BADVERS.  All responses
      MUST be limited in format to the VERSION level of the request, but
      the VERSION of each response SHOULD be the highest implementation
      level of the responder.  In this way, a requestor will learn the
      implementation level of a responder as a side effect of every
      response, including error responses and including RCODE=BADVERS.

And in fact we think this might be a more
forward compatible behaviour than returning
an empty response with RCODE=BADVERS.

(Sending it here as dnsext is concluded...)

Cheers,
--
 Ondřej Surý -- Chief Science Officer
 -------------------------------------------
 CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
 Americka 23, 120 00 Praha 2, Czech Republic
 mailto:[email-masked]    http://nic.cz/
 -------------------------------------------

---

From: Mark Andrews <[email-masked]>
Date: Tue, 16 Sep 2014 09:52:57 +1000

In message <[email-masked]>, =?utf-8?Q?On
d=C5=99ej_Sur=C3=BD?= writes:
>  Ondej Sur -- Chief Science Officer
>  CZ.NIC, z.s.p.o.    --    Laboratoe CZ.NIC
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

Just setting BADVERS does not work for negative responses.  You
cannot distingish between a NOERROR NODATA and a NXDOMAIN response
by just looking at the contents of the answer and authority sections
unless you also include the DNSSEC records.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]