Subject: DNSSECbis question (authenticated denial)

From: Roy Badami <[email-masked]>
Date: Wed, 9 Mar 2005 10:58:54 +0000

When a security-aware resolver is validating an NXDOMAIN response
(say, when querying for b.a.com of a nameserver authoritative for
.com) then the resolver has to verify that:

    1. The response proves that b.a.com doesn't exist; and

    2. The response proves that *.a.com doesn't exist.

Doesn't the resolver also need to verify that

    3. The response proves tha a.com is not a delegation point?

Is there some reason I'm missing why this isn't necessary?  The
response always will prove point 3, but I can't see where the spec
says the resolver needs to verify it.

     -roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>