RFC Errata


Errata Search

 
Source of RFC  
Summary Table Full Records

RFC 4035, "Protocol Modifications for the DNS Security Extensions", March 2005

Source of RFC: dnsext (int)

Errata ID: 5226
Status: Reported
Type: Technical
Publication Format(s) : TEXT

Reported By: Peter van Dijk
Date Reported: 2018-01-04

Section 3.1.4.1 says:

   The need for special processing by a security-aware name server only
   arises when all the following conditions are met:

   o  The name server has received a query for the DS RRset at a zone
      cut.

   o  The name server is authoritative for the child zone.

   o  The name server is not authoritative for the parent zone.

   o  The name server does not offer recursion.

It should say:

   The need for special processing by a security-aware name server only
   arises when all the following conditions are met:

   o  The name server has received a query for the DS RRset at a zone
      cut.

   o  The name server is authoritative for the child zone.

   o  The name server is not authoritative for any zone above the
      child's apex.

   o  The name server does not offer recursion.

Notes:

The original text is ambiguous in the face of an authoritative server having zones C.B.A. and A. but not B.A., and could cause DS queries for C to return a NODATA at C's apex, instead of the desired referral to B. which would allow resolution to continue correctly.

Report New Errata