Subject: Re: DNAME question

From: Roy Arends <[email-masked]>
Date: Mon, 26 Jun 2006 16:57:12 +0200

[email-masked] wrote on 06/26/2006 04:47:25 PM:

> If this is my root zone file:
> 
> $TTL 60
> $ORIGIN .
> @       IN      SOA     ns0. root.ns0. 1 90 90 60480 60
>                  NS      ns0.
> ns0.            A       127.0.0.1
> ;
> tld0.           NS      ns0.
> ;
> tld1.           DNAME   tld0.
> tld1.           MX      10 mailhost.tld0.
> ;
> tld2.           NS      ns0.tld1.
> 
> Is it legal to have the following as glue?
> 
> ns0.tld1.       A       127.0.0.2

It ain't glue, since there is no zone-cut for tld1.

It is not legal. 

> If it is not legal, can there ever been any name servers inside tld1?

there is no tld1 zone.

Regards,

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Peter Koch <[email-masked]>
Date: Mon, 26 Jun 2006 18:39:19 +0200

> It ain't glue, since there is no zone-cut for tld1.

that's not really the point here. The root applies a 'wide' glue policy, so it
maintains glue RRs for every NS RR target for any delegation ("tld2." in
this case).
However, "ns0.tld1." must not appear on the RHS of the "tld2." NS RR, since
it is not immediately resolvable to an address record. So, the problem isn't
about glue, but about the NS RR target.

> It is not legal. 

The result is the same at this level.

-Peter

---

From: Edward Lewis <[email-masked]>
Date: Mon, 26 Jun 2006 13:57:20 -0400

>about glue, but about the NS RR target.

Can there be any name server in the tld1. domain?

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Nothin' more exciting than going to the printer to watch the toner drain...

---

From: Matt Larson <[email-masked]>
Date: Mon, 26 Jun 2006 15:06:30 -0400

On Mon, 26 Jun 2006, Peter Koch wrote:
> So, the problem isn't about glue, but about the NS RR target.

I agree with this assessment.

> Can there be any name server in the tld1. domain?

No, because nothing at or below tld1 is a canonical name.  I tested
something similar recently.  Neither a late-model BIND 9 nor the
Unbound iterative resolvers could use an NS RR whose RDATA was an
alias (i.e., owned by a CNAME).  Recall that authoritative servers are
going to synthesize CNAMEs from that DNAME, so the DNAME effectively
(de)generates to CNAMEs.

Matt

---

From: Roy Arends <[email-masked]>
Date: Tue, 27 Jun 2006 00:44:04 +0200

> about glue, but about the NS RR target.

That is not the problem either.

The question was: 
 
   ns0.tld1.       A       127.0.0.2

Regardless if ns0.tld1 A can be resolved or not, if it is a target 
anywhere, or if you call it wide, narrow, in-bailiwick or super glue, it 
is not legal to have that address record in the root zone. period. this is 
explicitly written in rfc2672:

      If a DNAME RR is present at a node N, there may be other data at N
      (except a CNAME or another DNAME), but there MUST be no data at
      any descendant of N.  This restriction applies only to records of
      the same class as the DNAME record.

> > It is not legal. 

In response to

> If it is not legal, can there ever been any name servers inside tld1?

Assuming Ed meant NS records with 'name servers'; This is not legal 
because you can't have a non-APEX NS set and other data (except for DNSSEC 
records). DNAME is 'other data' in this case.
 
> The result is the same at this level.

It is not legal for entirely different reasons.

Roy

---

From: Roy Arends <[email-masked]>
Date: Tue, 27 Jun 2006 00:51:04 +0200

Matt Larson wrote on 06/26/2006 09:06:30 PM:

> No, because nothing at or below tld1 is a canonical name.

_at_ tld1 is still canonical. below tld1 is effectively an alias.

Roy

---

From: David Blacka <[email-masked]>
Date: Mon, 26 Jun 2006 19:23:41 -0400

> going to synthesize CNAMEs from that DNAME, so the DNAME effectively

To be clear, what I think Matt is pointing out is that you cannot  
(reliably) have any nameserver *targets* under "tld1.".  So, for  
example, if:

   tld1. DNAME tld0.

And, in "example.tld0." there exists:

   sub.example.tld0. NS ns1.example.tld1.
   sub.example.tld0. NS ns2.example.tld2.

then "sub.example.tld0" (or sub.example.tld1.) will not generally be  
reachable.  At least, as I understand it.

--
David Blacka    <[email-masked]>
Sr. Engineer    VeriSign Applied Research

---

From: Roy Arends <[email-masked]>
Date: Tue, 27 Jun 2006 01:43:24 +0200

> Can there be any name server in the tld1. domain?

Trying to finally answer Ed's question.

Can there be any name server in the tld1. domain. 

In the way you wrote your root-zone example, there can't

But if you had delegated tld1 out of the root zone, then you can have a 
DNAME at tld1's apex, together with NS records at the apex, with NSDAME 
(NS RDATA, or NS targets) at (but not below) or outside tld1. Not below 
since the NS RDATA of NS record at the tld1's apex and zone cut must be 
canonical (rfc 2181), while everything under (but not at) the DNAME is 
effectively an alias.

Roy