Subject: an example on wildcard proof.

From: Roy Arends <[email-masked]>
Date: Tue, 8 Mar 2005 20:48:27 +0100 (CET)

Here is an example to complement Ben's text on wildcard proof.

Given a zone, com, an existing record example.com and a
qname for test1.test2.example.com, the authoritative server needs to
return three NSEC3 records.

The set of NSEC3 proves the following:

1) example.com exist.
2) test2.example.com does not exist.
3) *.example.com does not exist.

where:

1 and 2 prove the closest encloser:

Since test2.example.com does not exist, while example.com does, the
latter must be the closest encloser.

Since there may be a wildcard RRset at example.com (thus being
*.example.com), we need the third NSEC3 to prove that the wildcard RRset
does not exist.

Note that there is no need to prove the nonexistence of
test1.test2.example.com, since test2.example.com does not exist.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Danny Mayer <[email-masked]>
Date: Thu, 10 Mar 2005 21:30:37 -0500

>test1.test2.example.com, since test2.example.com does not exist.

I'm not sure that that is true. If I add the following A record to the
example.com zone:

test1.test2            10800   IN      A       1.2.3.4

and I don't create any records for test2 does test2.example.com
exist, and if I ask won't I get an NXDOMAIN response?

Danny