Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread Mark Andrews
BIND 8 did it both ways depending apon whether RD was set or not and whether we offered recursion. RD=0 or we didn't offer recursion then a delegation was returned. If recursion was desired and it was available then a answer was returned. This was a compromise due to using a single database for

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread Peter van Dijk
Hello, On Mar 16, 2012, at 15:04 , Peter van Dijk wrote: > On Mar 16, 2012, at 14:54 , Tony Finch wrote: > >> Remi Gacogne wrote: >>> >>> I noticed a difference in the behavior of bind, powerdns (using bind or >>> MySQL backend) and nsd regarding the answer to an NS query for a >>> delegated z

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread RijilV
On 16 March 2012 09:47, Tony Finch wrote: > RijilV wrote: >> >> Could you help me understand how you understood that every answer >> containing the NS RRs for the query zone should be in the AUTHORITY >> rather than in the ANSWER regardless if it is the answer to the direct >> query? > > Sure. Zo

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread Peter Koch
On Fri, Mar 16, 2012 at 04:47:08PM +, Tony Finch wrote: > The relevant text in RFC 2181 section 6.1 is: > > The NS records that indicate a zone cut are the >property of the child zone created, as are any other records for the >origin of that child zone, or any sub-do

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread Tony Finch
Lutz Donnerhacke wrote: > * Tony Finch wrote: > > Sure. Zone cuts are very subtle :-) The basic principle is that the parent > > zone is not authoritative for any data at or below the cut, except for the > > DNSSEC records (DS + RRSIG, NSEC + RRSIG). > > Be careful: The parent zone is responsible

[dns-operations] Auto-Re: dns-operations Digest, Vol 74, Issue 8

2012-03-16 Thread ������
我的邮箱已经更换为 x...@cnic.cn , 请更新您的联系方式,谢谢! The l...@cnnic.cn will not be available soon, please update your contact information to x...@cnic.cn, thanks a lot. ___ dns-operations mailing list dns-operations@lists.d

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread Lutz Donnerhacke
* Tony Finch wrote: > Sure. Zone cuts are very subtle :-) The basic principle is that the parent > zone is not authoritative for any data at or below the cut, except for the > DNSSEC records (DS + RRSIG, NSEC + RRSIG). Be careful: The parent zone is responsible for DS (+ RRSIG). NSEC (+ RRSIG) exi

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread David C Lawrence
RijilV writes: > Could you help me understand how you understood that every answer > containing the NS RRs for the query zone should be in the AUTHORITY > rather than in the ANSWER regardless if it is the answer to the direct > query? The relevant text taken from section 6.1 of RFC 2181 says: > >

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread Tony Finch
RijilV wrote: > > Could you help me understand how you understood that every answer > containing the NS RRs for the query zone should be in the AUTHORITY > rather than in the ANSWER regardless if it is the answer to the direct > query? Sure. Zone cuts are very subtle :-) The basic principle is th

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread paul vixie
On 3/16/2012 4:36 PM, RijilV wrote: > On 16 March 2012 06:54, Tony Finch wrote: >> Remi Gacogne wrote: >>> I noticed a difference in the behavior of bind, powerdns (using bind or >>> MySQL backend) and nsd regarding the answer to an NS query for a >>> delegated zone. Powerdns is responding to the

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread RijilV
On 16 March 2012 06:54, Tony Finch wrote: > Remi Gacogne wrote: >> >> I noticed a difference in the behavior of bind, powerdns (using bind or >> MySQL backend) and nsd regarding the answer to an NS query for a >> delegated zone. Powerdns is responding to the query by putting >> corresponding NS R

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread Remi Gacogne
On Mar 16, 2012, at 14:54 , Tony Finch wrote: BIND and NSD are correct. See RFC 2181 section 6.1. Thanks, I missed it. Thanks for the pointer! It turns out we have this issue in specific backend configurations. I've added a test to our test suite and am fixing the backends responsible.

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread Peter van Dijk
Hi Tony, Rémi, On Mar 16, 2012, at 14:54 , Tony Finch wrote: > Remi Gacogne wrote: >> >> I noticed a difference in the behavior of bind, powerdns (using bind or >> MySQL backend) and nsd regarding the answer to an NS query for a >> delegated zone. Powerdns is responding to the query by putting

Re: [dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread Tony Finch
Remi Gacogne wrote: > > I noticed a difference in the behavior of bind, powerdns (using bind or > MySQL backend) and nsd regarding the answer to an NS query for a > delegated zone. Powerdns is responding to the query by putting > corresponding NS RRs into the ANSWER section, whereas bind and nsd a

[dns-operations] NS answer inconsistency between implementations for delegated zone

2012-03-16 Thread Remi Gacogne
Hi, I noticed a difference in the behavior of bind, powerdns (using bind or MySQL backend) and nsd regarding the answer to an NS query for a delegated zone. Powerdns is responding to the query by putting corresponding NS RRs into the ANSWER section, whereas bind and nsd are putting them into