John R. Levine writes: > On Mon, 6 Jul 2026, Roy Arends wrote: > > https://datatracker.ietf.org/doc/draft-ietf-dnsop-delext/08/ > > Section 4 says > > When the value of the EDNS(0) DE flag is 0, the server behaves as a > server that does not implement this specification, i.e., Delegation > Types are treated as Data Types. > > Let's say I have this in my .EXAMPLE zone file: > > foo.example. deleg server-ipv4=1.2.3.4 > > Then my dusty web server does an A request for foo.example. There's > no NS so there's no referral. But there's a DELEG record so it > returns NOERROR. That can't be right.
I don't really understand why you're saying that can't be right. That a legacy client should just get service like it is talking to a legacy server seems like a reasonably conservative position to take, and 4.1 goes on to clarify what this means if there's no NS. Imagine if the server itself was not DELEG / delext aware. Such a server would just see a TYPE61440 (or whatever rrtype) record that it doesn't recognize as a delegation. If that's the only record at that owner name then TYPE1 or TYPE28 (A or AAAA) getting ANCOUNT=0/NOERROR seems apt. What's the alternative you are proposing? I did see: > I think it needs to say something like when the DE flag is 0, > delegation types are ignored in queries other than explicit ones for > the delegation type itself and maybe ANY. ... but it isn't clear for me what you're suggesting the message resulting from the "are ignored" is for your example. The way I'm reading what you've said here, it seems to be close to what's in the draft -- delegation types are ignored so "there is no referral from the perspective of a non-Delegation-Extension-aware resolver". Does it make it clearer to explicitly state the implication in 4.1's second paragraph that other records at the same owner name are not occluded? If I were implementing 4.1 as-is for DE=0, I'd return a ANCOUNT=0 for an address request, and ANCOUNT=1 for DELEG or ANY queries. If there was also a foo.example A record, I'd answer it for your dusty web server's request. In all of those cases I would also include the Delegation Extension Required EDE. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
