[Editorial Errata Reported] RFC6672 (5297)
RFC Errata System <[email protected]> Fri, 23 Mar 2018 08:24:54 -0700 (PDT)
| Newsgroups | gmane.ietf.dnsext |
|---|---|
| Message-ID | <[email protected]> |
The following errata report has been submitted for RFC6672, "DNAME Redirection in the DNS". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5297 -------------------------------------- Type: Editorial Reported by: Pieter Lexis <[email protected]> Section: 5.3.4.1 Original Text ------------- ;; Header: QR AA RCODE=3(NXDOMAIN) ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; Question foo.bar.example.com. IN A ;; Authority bar.example.com. NSEC dub.example.com. A DNAME bar.example.com. RRSIG NSEC [valid signature] Corrected Text -------------- ;; Header: QR AA RCODE=3(NXDOMAIN) ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; Question foo.bar.example.com. IN A ;; Authority bar.example.com. NSEC dub.example.com. A DNAME RRSIG NSEC bar.example.com. RRSIG NSEC [valid signature] Notes ----- The NSEC record in the original text would in no case be valid as it denies it's own existence and the existence of the RRSIG, while the text indicates that " the validator can see that it is a BOGUS reply from an attacker that collated existing records from the DNS to create a confusing reply". This indicates that NSEC and RRSIG should be set in the NSEC bitmap Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC6672 (draft-ietf-dnsext-rfc2672bis-dname-26) -------------------------------------- Title : DNAME Redirection in the DNS Publication Date : June 2012 Author(s) : S. Rose, W. Wijngaards Category : PROPOSED STANDARD Source : DNS Extensions Area : Internet Stream : IETF Verifying Party : IESG _______________________________________________ dnsext mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsext