[Errata Verified] RFC6672 (5297)
RFC Errata System <[email protected]> Mon, 26 Mar 2018 08:32:21 -0700 (PDT)
| Newsgroups | gmane.ietf.dnsext |
|---|---|
| Message-ID | <[email protected]> |
The following errata report has been verified for RFC6672, "DNAME Redirection in the DNS". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5297 -------------------------------------- Status: Verified Type: Editorial Reported by: Pieter Lexis <[email protected]> Date Reported: 2018-03-23 Verified by: Warren Kumari (Ops AD) (IESG) Section: 5.3.4.1 Original Text ------------- ;; Header: QR AA RCODE=3(NXDOMAIN) ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; Question foo.bar.example.com. IN A ;; Authority bar.example.com. NSEC dub.example.com. A DNAME bar.example.com. RRSIG NSEC [valid signature] Corrected Text -------------- ;; Header: QR AA RCODE=3(NXDOMAIN) ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; Question foo.bar.example.com. IN A ;; Authority bar.example.com. NSEC dub.example.com. A DNAME RRSIG NSEC bar.example.com. RRSIG NSEC [valid signature] Notes ----- The NSEC record in the original text would in no case be valid as it denies it's own existence and the existence of the RRSIG, while the text indicates that " the validator can see that it is a BOGUS reply from an attacker that collated existing records from the DNS to create a confusing reply". This indicates that NSEC and RRSIG should be set in the NSEC bitmap. Edit: Thread: https://www.ietf.org/mail-archive/web/dnsext/current/msg13879.html -------------------------------------- RFC6672 (draft-ietf-dnsext-rfc2672bis-dname-26) -------------------------------------- Title : DNAME Redirection in the DNS Publication Date : June 2012 Author(s) : S. Rose, W. Wijngaards Category : PROPOSED STANDARD Source : DNS Extensions Area : Internet Stream : IETF Verifying Party : IESG _______________________________________________ dnsext mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsext