Subject: [dnsext] edns-client-ip and NXDOMAIN

From: Matthew Dempsky <[email-masked]>
Date: Fri, 16 Apr 2010 11:19:42 -0700

It's not stated explicitly in draft-vandergaast-edns-client-ip how to
cache an NXDOMAIN response.  Section 4.3 says that only the answer
section resource records are tied to the edns-client-ip parameter, and
since NXDOMAIN is indicated by the header and not the answer section,
I'm led to believe NXDOMAIN responses can be cached for all client
IPs, regardless of the edns-client-ip option.  On the other hand,
NODATA responses would seem to still be cached per-client-IP.

As it's still possible to send NODATA responses, and I don't know any
reason why it'd be desirable to send NXDOMAIN (as opposed to NODATA)
for a name to some clients but not to others, I'm fine with the above
interpretation.  However, I think it would be good then to explicitly
state this to help avoid problems due to authoritative servers sending
unintentional NXDOMAIN responses.  (E.g., some broken authoritative
servers sent NXDOMAIN rather than NODATA responses to AAAA queries for
names that didn't have AAAA records but did have A records; the
consequence being dual-stack IPv6/IPv4 clients that started asking for
AAAA records first would never see the A records either.)