Subject: [dnsext] type NSEC query at a parent's zone cut

From: JINMEI Tatuya / 神明達哉 <[email-masked]>
Date: Thu, 04 Oct 2012 11:33:04 -0700

I have a quick and simple question: what should an authoritative
server return to a query for an NSEC RR(set) at the parent side of a zone
cut?  For example, what should a root server return to the query
"com/NSEC"?

I'm asking this because different root servers actually return
different answers (and based on initial offlist communication this
didn't seem to be a very known topic).  It may depend on from where
you query, but from the location I'm writing this message, the E, H, K
and L root servers return a referral to .com (just like when asking
for com/AAAA).  Others return an authoritative answer that has the
com/NSEC RR in the answer section (just like when asking for com/DS).

According to Section 2.6 of RFC4035, the latter behavior seems to be
correct:

   This specification updates the original DNS specification to allow
   NSEC and DS RR types at the parent side of a zone cut.  These RRsets
   are authoritative for the parent when they appear at the parent side
   of a zone cut.

Also, Section 4.2 of the RFC even seems to suggest the difference
could lead to interoperability problems:

   When attempting to retrieve missing NSEC RRs that reside on the
   parental side at a zone cut, a security-aware iterative-mode resolver
   MUST query the name servers for the parent zone, not the child zone.

because if the parent zone's authoritative server returns a referral,
the resolver cannot get what it tries to retrieve - although this may
not be a serious problem due to the note in the preceding paragraph:

   Security-aware resolvers MAY query for missing security RRs in an
   attempt to perform validation; implementations that choose to do so
   must be aware that the answers received may not be sufficient to
   validate the original response.  For example, a zone update may have
   changed (or deleted) the desired information between the original and
   follow-up queries.

In any case, it's not clear to me whether the RFC specifies what the
authoritative server should do at the parent side.  It's very specific
about the case for DS (Section 3.1.4.1), but it seems to be mostly
silent about the NSEC case.

Is this described somewhere (if so, which behavior is correct)?  Or
was there a consensus it can be an implementation dependent behavior?

Any clarification is appreciated.  Thanks,

---
JINMEI, Tatuya