Subject: Re: name server without root cache

From: Jakob Schlyter <[email-masked]>
Date: Wed, 3 Apr 2002 19:13:26 +0200 (CEST)

On Wed, 3 Apr 2002, Mats Dufberg wrote:

> > Of greater importance is how the vast installed base out there would react
> > to that. 'REFUSED' has different connotations ie 'I would have answered but
> > your IP address doesn't allow me to'.
>
> I agree. If there is no hint file, SERVFAIL is the correct response.

if the hints file was missing unintentionally, I agree that SERVFAIL is
the correct response. however, if the file was left out due to policy,
REFUSED is better since I did leave it out on purpose. put in other words,
I simply choose to refuse to answer queries not in my zones.

	jakob

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "D. J. Bernstein" <[email-masked]>
Date: 3 Apr 2002 21:32:25 -0000

tinydns discards misdirected queries.

Mats Dufberg writes:
> According to my view, the best practice is to have a hint file, and
> return a referal to the root.

Root referrals are useless. Caches discard them. (Any cache that doesn't
is horribly broken.)

Maintaining the root addresses in a non-caching server is a waste of
administrative time. There's no reason that the server should know
anything about the roots.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

---

From: Jakob Schlyter <[email-masked]>
Date: Wed, 3 Apr 2002 10:37:59 +0200 (CEST)

> your IP address doesn't allow me to'.

REFUSED could mean 'I maybe could have answered but I did not feel like
it'.

bind8 returns SERVFAIL without any root cache, bind9 returns REFUSED if
configured not do recursion and not to supply additional from cache,
otherwise it returns it's built-in root cache if I remember correctly.

	jakob

---

From: Mats Dufberg <[email-masked]>
Date: Wed, 3 Apr 2002 11:04:32 +0200 (CEST)

On Apr 3, 2002, 10:22 (+0200) bert hubert <[email-masked]> wrote:

> When I investigated this I found that sending out 'hints' was not mandatory
> and in fact (imnsho) only confuses matters.

According to my view, the best practice is to have a hint file, and return
a referal to the root.

> > my personal view: if it is required, a name server without a root cache
> > should return SERVFAIL if it can not provide a referral. if it is not
> > required, a nameserver without a root cache may return REFUSED if it
> > choose not to answer the query.
>

One problem with DNS is that the status NOERROR is overloaded with
different meanings. We want the server to say

"The name you asked for is not within any of the domains that I handle,
and I don't do any recursion (or you asked me not to recurse)"

The NS records to root as such are of no importance, but must be there to
give a reasonble responce.

Mats

----------------------------------------------------------------------
Mats Dufberg				             Registry TeliaNet
[email-masked]                                  Skanova/AO Networks
+46 8 456 7274                                               Box 10707
+46 70 258 2588                                    SE-121 29 Stockholm
----------------------------------------------------------------------