Subject: NSEC3-01 - more wildcard nits

From: Alex Bligh <[email-masked]>
Date: Wed, 30 Mar 2005 16:37:08 +0100

I think this has been brought up before, but not made the draft.

Imagine a zone

$ORIGIN example.com.
example.com.		IN	SOA	...
			IN	NS	...
			IN	NS	...
www			IN	A	1.2.3.4
*			IN	MX	2.3.4.5
H(www.example.com.)	IN	NSEC3 ... H(example.com.) A RRSIG
H(example.com.)	IN	NSEC3 ... H(*.example.com.) SOA NS RRSIG
H(*.example.com)	IN	NSEC3 ... H(www.example.com.) MX RRSIG

I'm using H(blah) to indicate the hash of "blah".

Now, under RFC403[345] (DNSSEC-bis), a query with QTYPE=MX returns
an MX of 2.3.4.5 for all QNAME queries other than "www.example.com".

With NSEC3 that is nearly true. The exception (as currently written)
is if the query happens to be one of the hashes of the name, e.g.
H(www.example.com.), H(example.com.), H(*.example.com). These will
retain empty data.

That's because the draft should (but as far as I can see does not)
modify the search algorithm such that NSEC3 records are ignored for
all searches other than QTYPE=NSEC3.

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alex Bligh <[email-masked]>
Date: Thu, 31 Mar 2005 09:13:14 +0100

--On 30 March 2005 21:25 -0500 Danny Mayer <[email-masked]> wrote:

> I assume you were tired when you wrote this. I think you really meant to

Mea culpa, several people pointed this out. My excuse is that the wildcard
was against an A record until the minute before I sent it when I thought
"a wildcard MX would be more realistic". But let's get it right completely
for the records:

$ORIGIN example.com.
example.com.            IN      SOA     ...
                        IN      NS      ...
                        IN      NS      ...
www                     IN      A       1.2.3.4
*                       IN      MX      10 mail.example2.com.
mail                    IN      A       2.3.4.5
H(www.example.com.)     IN      NSEC3 ... H(example.com.) A RRSIG
H(example.com.)         IN      NSEC3 ... H(*.example.com.) SOA NS RRSIG
H(*.example.com)        IN      NSEC3 ... H(www.example.com.) MX RRSIG

However, I think the point about querying QTYPE=MX, QNAME=H(www.example.com)
still holds.

Alex