[DNSOP] Re: [Ext] Re: Speaking of names that don't exist

2025-02-13 Thread John Levine
It appears that Petr � pa� ek said: >> That is NXDOMAIN for everything in the zone and NOERROR for the apex >> where (fabricated) SOA and NS records exist. > >BIND does the same, and I think it's fine. It has worked like that since >2012 (in BIND, by default), so if a protocol police comes after

[DNSOP] Re: [Ext] Re: Speaking of names that don't exist

2025-02-13 Thread Petr Špaček
On 12. 02. 25 11:33, Yorgos Thessalonikefs wrote: On 11/02/2025 21:29, John Levine wrote: It appears that Wessels, Duane said: For whatever it’s worth, I think Unbound’s (presumably default) behavior here is the right thing to do. It matches my expectation for my argument that caching DNS se

[DNSOP] Re: [Ext] Re: Speaking of names that don't exist

2025-02-12 Thread Yorgos Thessalonikefs
On 11/02/2025 21:29, John Levine wrote: It appears that Wessels, Duane said: For whatever it’s worth, I think Unbound’s (presumably default) behavior here is the right thing to do. It matches my expectation for my argument that caching DNS servers "SHOULD, by default, generate immediate ne

[DNSOP] Re: [Ext] Re: Speaking of names that don't exist

2025-02-11 Thread John Levine
It appears that Wessels, Duane said: >For whatever it’s worth, I think Unbound’s (presumably default) behavior here >is the right thing to do. > >It matches my expectation for my argument that caching DNS servers "SHOULD, by >default, generate immediate >negative responses for all such queries”.

[DNSOP] Re: [Ext] Re: Speaking of names that don't exist

2025-02-11 Thread Wessels, Duane
> On Feb 11, 2025, at 9:11 AM, Paul Hoffman wrote: > > Caution: This email originated from outside the organization. Do not click > links or open attachments unless you recognize the sender and know the > content is safe. > > On Feb 11, 2025, at 08:46, John Levine wrote: >> >> It appears

[DNSOP] Re: [Ext] Re: Speaking of names that don't exist

2025-02-11 Thread Paul Hoffman
On Feb 11, 2025, at 08:46, John Levine wrote: > > It appears that Stephane Bortzmeyer said: > >> [localhost. nobody.invalid. 1 3600 1200 604800 10800] : 59 occurrences > > That's what Unbound returns. Comments in the config file say that it > by default returns an empty stub for a bunch of n