Subject: [dnsext] [Slightly OT] Past DNSEXT actions?

From: Alex Nicoll <[email-masked]>
Date: Wed, 3 Oct 2012 08:28:10 -0400

One of the problems inherent in an eclectic system like the IETF is a record of just what has happened when.  While I realize I can search past mailing lists and discussion forums, it usually isn't an optimal way to find the information I'm looking for - which is usually in the head of one of the people on this list.  So - my apologies if this isn't exactly on topic for the list, but I'm betting you guys know the answer.

I was told recently that NS records in a parent domain should be authoritative and be used in preference to NS records that exist at a child domain.  The reason for this was "disaster recovery techniques."  I couldn't find much on this on DNSOP, but RFC 1034 says:
---
RFC1034 Section 4.2.1:

The RRs that describe cuts around the bottom of the zone are NS RRs that
name the servers for the subzones.  Since the cuts are between nodes,
these RRs are NOT part of the authoritative data of the zone, and should
be exactly the same as the corresponding RRs in the top node of the
subzone.  Since name servers are always associated with zone boundaries,
NS RRs are only found at nodes which are the top node of some zone.  In
the data that makes up a zone, NS RRs are found at the top node of the
zone (and are authoritative) and at cuts around the bottom of the zone
(where they are not authoritative), but never in between.
---

This statement seems to say that the NS records at a parent that point to a child domain are NOT authoritative under any circumstance.  

So - my question (sorry for the long background) - has DNSEXT taken or know of any action on the part of the IETF that would override that clause to make NS records at a parent authoritative?

Thanks in advance!

-Alex

Alex Nicoll
Senior Cybersecurity Analyst 
CERT
Carnegie Mellon University/Software Engineering Institute
[email-masked]
(412)268-9205 (USA)

Vaporware:  A much discussed piece of software that doesn’t actually exist.
Cloud:  Condensed Vapor.

---

From: Tony Finch <[email-masked]>
Date: Wed, 3 Oct 2012 13:49:36 +0100

Alex Nicoll <[email-masked]> wrote:
>
> This statement seems to say that the NS records at a parent that point
> to a child domain are NOT authoritative under any circumstance.
>
> So - my question (sorry for the long background) - has DNSEXT taken or
> know of any action on the part of the IETF that would override that
> clause to make NS records at a parent authoritative?

No, it has been reinforced. In particulat, DNSSEC makes it extra clear
that delegation records are not authoritative. See RFC 2181 section 5.4.1
especially the last paragraph, and RFC 4035 section 2.2. There are
probably other instances.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first.
Rough, becoming slight or moderate. Showers, rain at first. Moderate or good,
occasionally poor at first.

---

From: Dick Franks <[email-masked]>
Date: Wed, 3 Oct 2012 14:40:46 +0100

On 3 October 2012 13:28, Alex Nicoll <[email-masked]> wrote:
>
> I was told recently that NS records in a parent domain should be authoritative and be used in preference to NS records that exist at a child domain

Sadly, you were misinformed.  RFC2181, 6.1  says:

   ...   The NS records that indicate a zone cut are the
   property of the child zone created, as are any other records for the
   origin of that child zone, or any sub-domains of it.  A server for a
   zone should not return authoritative answers for queries related to
   names in another zone, which includes the NS, and perhaps A, records
   at a zone cut, unless it also happens to be a server for the other
   zone.

Dick
--

---

From: Mark Andrews <[email-masked]>
Date: Wed, 03 Oct 2012 23:58:15 +1000

In message <[email-masked]>, Tony Fi
> probably other instances.

The child is authoritative for the contents of the NS records.
The parent is authoritative for the existance of the delegation.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]