Subject: Re: wildcards draft

From: [email-masked]
Date: Wed, 19 Feb 2003 10:14:33 +1100

> Hi,
> 
> I dont like the wildcard clarification draft, what I'm saying is that I dont
> like the idea of existance of non-existing or better put non-explicitly-confi
> gured
> domains. It is quite non intuitive.
> 
> What's the main driver behing this clarification draft? NXT processing? Certa
> in
> implementation shortcomings?
> 
> Alexis

	The main driving force is to demonstate that you only need
	a maximum of two NXT records to prove the non-existance of
	the qname.  One for the qname and potentially an additional one
	for the wildcard.

	People were saying that you need lots of NXT records which was
	just wrong. 

	Additionally it was counter intuitive returning NXDOMAIN
	for a name which clearly exist and RFC 1035 says should
	result in a NOERROR response.  It's also counter intuitive
	for a empty node to be used for wildcard processing but 
	to have it return NXDOMAIN.
	
	NXT processing can be done either way.  You just have to have
	agreement upon what is the correct RCODE for a empty node as
	the validator will reject the wrong RCODE.  DS is a major change
	and the validator needs to be re-written.

	DNSSEC should not change the basics of DNS.  It should be
	securing the DNS.  The wording in RFC 2535 could be interpreted
	to allow for both NOERROR and NXDOMAIN.

	Mark

	P.S. I've always though NXDOMAIN was wrong for the empty node
	case.

--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Wed, 19 Feb 2003 18:01:43 +0800

At 23:05 +0100 2/18/03, Alexis Yushin wrote:
>like the idea of existance of non-existing or better put 
>non-explicitly-configured

I don't exactly understand the question.

It's not what exists or doesn't exist in a protocol, the issue is 
what response is generated by a query.

In RFC 1034 there are three concepts regarding existence.

Wild cards are tools for synthesizing answers.  Whether you want to 
say the an answer synthesized from a wild card represents existence 
or not, the fact remains that an answer is obtained for the query.

RFC 1034 does define an authoritative name error for queries whose 
QNAME is neither a leaf with data nor an interior node.  In this 
case, if the node does not exist, a query against it results in an 
authoritative name error (NXDOMAIN in BIND lingo).

The third incidence of 'existence' is the impact on the algorithm in 
4.3.2, section C.  Given the defintion in 3.1, it's quite clear that 
empty non-terminals play a role in the execution of 4.3.2-c, hence 
they 'exist'.

(I exist, ergo I impact a response, or, if a domain name falls in the 
forest...)

>What's the main driver behing this clarification draft? NXT 
>processing? Certain

Someone asked me to write up text on wild cards.  Apparently some 
feel it is unclear from RFC 1034, I just reiterated what is in that 
RFC.

Perhaps my question is - do you think the wild card draft differs 
from RFC 1034?  I don't intend it to, but if that is the impression 
it gives, the draft is in error.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer