Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Paul Vixie
Andrew Sullivan wrote: On Tue, Nov 28, 2017 at 03:18:57PM -0800, Paul Vixie wrote: what would "to work" mean in the above text? "Not strictly speaking required to work" was intended to observe that, if you didn't get a referral under this condition, nothing ought to break (or, if it did, it

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Evan Hunt
> "Not strictly speaking required to work" was intended to observe that, > if you didn't get a referral under this condition, nothing ought to > break (or, if it did, it was already broken). I think the phrasing is unclear because "this response is not required to work" is ambiguous. The response

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Mark Andrews
When the CNAME refers to a name that is out of zone and the target zone is below a zone that the server serves you will have CNAME (DNAME) + referral. 4.3.2 loops. pass 1 -> 3a (adds CNAME, AA is set as it matches the question section, QNAME is updated). pass 2 -> 3b (we have

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Mark Andrews
And you can have partial answer and with no referral data responses which are confusable with NOERROR NODATA. We really should do EDNS(1) and add NXRRSET to the list of rcodes for QUERY. > On 29 Nov 2017, at 12:57 pm, Mark Andrews wrote: > > You can answer only responses, you can have referral

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Andrew Sullivan
Hi Mark, On Wed, Nov 29, 2017 at 12:57:26PM +1100, Mark Andrews wrote: > You can answer only responses, you can have referral only responses, > you can partial answer + referral responses. Where in the algorithm in section 4.3.2 of 1034 (or other, derived cases like DNAME) is this "partial answer

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Mark Andrews
You can answer only responses, you can have referral only responses, you can partial answer + referral responses. > On 29 Nov 2017, at 12:53 pm, Andrew Sullivan wrote: > > On Wed, Nov 29, 2017 at 12:46:07PM +1100, Mark Andrews wrote: >> GO READ STD13! > > I thought I had, and I thought indeed t

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Andrew Sullivan
Yes, what I just sent. So how does one end up in 3.b with the AA bit and still have a "referral" according to 1034, section 4.3.2? A On Wed, Nov 29, 2017 at 12:49:48PM +1100, Mark Andrews wrote: > AA Authoritative Answer - this bit is valid in responses, > and specif

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Andrew Sullivan
On Wed, Nov 29, 2017 at 12:46:07PM +1100, Mark Andrews wrote: > GO READ STD13! I thought I had, and I thought indeed that I was quoting it to you (or at least making references). I _suspect_ that you're referring to 4.1.1 in 1035 which describes AA. But that says that it "that the responding name

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Mark Andrews
AA Authoritative Answer - this bit is valid in responses, and specifies that the responding name server is an authority for the domain name in question section. Note that the contents of the answer section may have multip

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Andrew Sullivan
On Tue, Nov 28, 2017 at 03:18:57PM -0800, Paul Vixie wrote: > what would "to work" mean in the above text? "Not strictly speaking required to work" was intended to observe that, if you didn't get a referral under this condition, nothing ought to break (or, if it did, it was already broken). The

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Mark Andrews
GO READ STD13! > On 29 Nov 2017, at 12:44 pm, Andrew Sullivan wrote: > > Hi, > > On Wed, Nov 29, 2017 at 07:39:42AM +1100, Mark Andrews wrote: >> The AA bit may or may not be set depending upon whether the response contains >> a CNAME/DNAME or not. >> > > I replied with an enthusiastic "tha

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Andrew Sullivan
Hi, On Wed, Nov 29, 2017 at 07:39:42AM +1100, Mark Andrews wrote: > The AA bit may or may not be set depending upon whether the response contains > a CNAME/DNAME or not. > I replied with an enthusiastic "thanks" because this struck me as obviously correct, but then I though I'd better look at

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Andrew Sullivan
Excellent point! Thanks. -- Please excuse my clumbsy thums -- On November 28, 2017 15:40:14 Mark Andrews wrote: The AA bit may or may not be set depending upon whether the response contains a CNAME/DNAME or not. On 29 Nov 2017, at 6:50 am, Andrew Sullivan wrote: Dear colleagues

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Paul Vixie
Andrew Sullivan wrote: Dear colleagues, Joe Abley and I have just submitted a draft (https://datatracker.ietf.org/doc/draft-sullivan-dnsop-refer-down/) that is intended to capture the discussion here about referrals and how to describe them. It is intended for BCP, and it discourages upward r

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Mark Andrews
The AA bit may or may not be set depending upon whether the response contains a CNAME/DNAME or not. > On 29 Nov 2017, at 6:50 am, Andrew Sullivan wrote: > > Dear colleagues, > > Joe Abley and I have just submitted a draft > (https://datatracker.ietf.org/doc/draft-sullivan-dnsop-refer-down/) >

Re: [DNSOP] Clarifying referrals (#35)

2017-11-28 Thread Andrew Sullivan
Dear colleagues, Joe Abley and I have just submitted a draft (https://datatracker.ietf.org/doc/draft-sullivan-dnsop-refer-down/) that is intended to capture the discussion here about referrals and how to describe them. It is intended for BCP, and it discourages upward referrals by authoritative s

Re: [DNSOP] Call for Adoption: draft-huston-kskroll-sentinel

2017-11-28 Thread David Conrad
On Nov 27, 2017, 11:47 AM -0800, Richard Barnes , wrote: > I don't think that it make sense to infer from the failure of RFC 8145 that > resolver/authoritative telemetry isn't possible Huh? RFC 8145 wasn’t a failure — it was stunningly successful. Within a few months of publication it provided