> On Jun 18, 2026, at 13:37, Olafur Gudmundsson <[email protected]> wrote: > > > >> On Jun 16, 2026, at 10:44, John Levine <[email protected]> wrote: >> >> If you gratuitously turn NXDOMAIN into NODATA you're going to break a >> lot of software. I am astonished everyone here isn't already aware of >> that. > > _______________________________________________ > DNSOP mailing list -- [email protected] > To unsubscribe send an email to [email protected]
Sorry this message escaped my email client before I started writing the body. In the 10 years that “X lies” have been in use there has only been minimal set of complaints all all of them from end-user tools, no complaints about behavior of resolvers or forwarders, as they only care about one thing: “Does the record being asked about exist?” full stop. The existence of the name is a wider scope that only end-user-tools may care about. “X lies” are an alternative to the monstrosity of NSEC3 to protect the contents of zones (that some people think is important). Both NSEC3 and “X lies” can be used to hide existence of names in ways that end-user-tools find `confusing`. “X lies” are enabled by on-line signing which is has nice operational properties that statically signed zones do not have. So one can not just pick on one “tool” in dealing with the operational realities DNS today, without looking at the bigger picture! Adding new functionality to DNS takes a long time (for the long tail), so during the transition there are always going to be some that complain that the new functionality broke their setup, but the alternative is to freeze DNS protocol, no more changes, no more records, etc. Ólafur PS: in many cases the same user tools that are complaining about lack of NXDOMAIN can not deal with ENT (Empty Non-Terminal) names.
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
