[DNSOP] return code on RD=0 queries with no answer

Hi all,

A recent change in the BIND 9 development branch makes the resolver answer
SERVFAIL on RD=0 queries if the answer isn't in the cache or other local data.

Behavior of different implementations varies:

- Google DNS returns SERVFAIL;
- Quad9 returns REFUSED;
- CloudFlare returns SERVFAIL (with EDE 0 "no local cache to fulfill non
  recursion (RD=0) request");
- CZ.NIC ODVR returns REFUSED (with EDE 20);
- BIND >= 9.21.26 now returns SERVFAIL;
- older BIND returned a referral to the closest available zone cut in
  cache/local data, or to the root.

Thinking about this, REFUSED makes sense because the server could answer by
recursing, and it refused to do that. However, the reason it isn't recursing
is because the client specified RD=0, not because of a locally configured
policy. Alternatively, SERVFAIL makes sense because the server isn't able to
answer this query with the data it has available.

Any thoughts about what would be the more "correct" return code here? 

If this is not already specified in an RFC, should it be?

Thanks!

-- 
Colin Vidal -- [email protected]
Internet Systems Consortium

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]