Subject: nsec3 and update

From: Mark Andrews <[email-masked]>
Date: Fri, 08 Sep 2006 15:00:24 +1000

If I have a secure delegation and remove the DS via UPDATE.

        Which optout bit do I look at the see if I should also remove
        the NSEC3 record?

                The one in NSEC3PARAMS?
                The one at the NSEC3?
                The one at the previous NSEC3?

        Or do I just update the NSEC3 and not try to optout out the
        node?

        Mark

-- 
ISC Training!  October 16-20, 2006, in the San Francisco Bay Area,
covering topics from DNS to DHCP.  Email [email-masked].
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE:	+61 2 9871 4742		         INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Sat, 09 Sep 2006 00:19:27 +1000

>  From all the dynamic update RFC's it has always been the zone admin and 
> primary server that enforces policy, so the decision is there.  It also 
> makes little sense to have an opt-out bit in the NSEC3PARAMS RR if it 
> doesn't indicate a zone-wide status.
> 
> So I would think the easiest would be to use the NSEC3PARAMS RR as a 
> guide.  If there isn't some default server policy in a configuration 
> file somewhere.
> 
> This issue (and some others) makes me think there needs to be another 
> update to the secure dynamic update RFC.

	And if NSEC3PARAMS can change this bit then adding a
	NSEC3PARAMS which is identical other than in the optout bit
	should remove the old NSEC3PARAMS record.
 
> Scott
> Mark Andrews wrote:

---

From: Scott Rose <[email-masked]>
Date: Fri, 08 Sep 2006 09:47:13 -0400

Scott

---

From: David Blacka <[email-masked]>
Date: Sun, 10 Sep 2006 21:04:10 -0400

>         Which optout bit do I look at the see if I should also remove

That bit is not defined to have a value, at least in -07.

>         Or do I just update the NSEC3 and not try to optout out the

In theory, you should retain the all-Opt-Out or all-Not-Opt-Out nature 
of the zone, at the very least.  In this case, since you don't know if 
you are removing an NSEC3 or not, you have a choice of either the 
matching NSEC3 or the previous NSEC3.  In this case, it doesn't matter, 
since both will have the same value for the flag.

In a mixed zone, consistency is sort of impossible to retain with simple 
rules like those laid out in Section 7.5 of the draft, so, again, it 
shouldn't matter (i.e., whichever one you choose will lead to the 
"wrong" state for the span for some zone with a strange, unknown reason 
for being mixed).

But, all things being equal, I would use the value from the matching 
NSEC3 RR.

-- 
David Blacka    <[email-masked]>
Sr. Engineer    Verisign Applied Research