RFC 6604

RFC 6604: xNAME RCODE and Status Bits Clarification 💅

okay bestie, this is RFC 6604 📜 and it's giving clarification energy. It was written by D. Eastlake 3rd from Huawei, dated April 2012, and it's a Standards Track doc, so it's official IETF spec and not just vibes. It updates RFC 1035, RFC 2308, and RFC 2672 (it's basically fixing their homework 🙈). The ISSN is 2070-1721 if you want to look it up.

Abstract ✨

okay so the DNS has had redirect tools forever, like the CNAME (Canonical Name), that let a query get sent to a different name 🦋. The DNS response header has an RCODE (Response Code) field for flagging errors, plus some status bits. This doc clears up, for those redirected queries, how the RCODE and status bits match up with the first query cycle (where the CNAME or similar was spotted) and with the later or final query cycles. slay 💖

Status of This Memo

This is an Internet Standards Track document ✨

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, received public review, and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on Internet Standards, check Section 2 of RFC 5741 🌸

Info about the current status of this document, any errata, and how to give feedback is at http://www.rfc-editor.org/info/rfc6604 🎀

Copyright Notice

Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. 💜

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Read these carefully, bestie, because they spell out your rights and restrictions for this document 🫶 Any Code Components pulled out of this document must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes.

Table of Contents

   1. Introduction ....................................................2
      1.1. Conventions Used in This Document ..........................3
   2. Restatement of Status Bits and What They Mean ...................3
      2.1. The Authoritative Answer Bit ...............................3
      2.2. The Authentic Data Bit .....................................3
   3. RCODE Clarification .............................................3
   4. Security Considerations .........................................4
   5. References ......................................................4
      5.1. Normative References .......................................4
      5.2. Informative References .....................................5

1. Introduction ✨

okay so DNS has long had redirect tools like the CNAME (Canonical Name [RFC1035]) and the DNAME [RFC2672] RRs (Resource Records), which let a DNS query get redirected to a different name 🦋 A CNAME normally redirects a query aimed at its owner name, while a DNAME normally redirects a query aimed at any lower-level name. There's also been a proposal for another redirection RR. Plus, as [RFC2672] lays out, a DNAME redirect also makes a CNAME RR show up in the response (that's the synthesized CNAME, iconic 💅). In this doc, all RRs that cause this kind of redirection get called xNAME RRs.

You can ask for xNAME RRs directly by querying for the xNAME type. When someone asks for a different type and an xNAME RR shows up, the xNAME RR (and maybe a synthesized CNAME) gets added to the answer. DNS Security Extensions (DNSSEC) [RFC4035] RRs that apply to the xNAME RR may get added to the response too, and then the query restarts with the name it was redirected to ✨

An xNAME can redirect a query to a name that has another xNAME, and so on. This doc uses "xNAME chain" for a series of one or more xNAMEs where each one points to another xNAME, except the last one, which points to a non-xNAME or ends in an error 🔗

A DNS response header has an RCODE (Response Code) field for indicating errors, and status bits that show whether an answer is authoritative and/or authentic. This doc clears up, for redirected queries, how the RCODE and status bits line up with the initial query cycle (where the first xNAME was detected) and with the later or final query cycles 💖

1.1. Conventions Used in This Document

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. These are the BCP 14 words, so they're the ones with real weight here 🍓

2. Restatement of Status Bits and What They Mean 🌈

There are two status bits in query responses where you might wonder how they relate to the first, any intermediate, and/or last queries in an xNAME chain. Here's the lowdown. The following is unchanged from [RFC1035] and [RFC4035]. We're just restating what these bits mean because some released implementations didn't follow those meanings, and that's a whole mood 🙈

2.1. The Authoritative Answer Bit

The AA, or Authoritative Answer bit, in the DNS response header says the answer came from a DNS server that's authoritative for the zone containing that answer. For an xNAME chain, this "authoritative" status can be different for each answer in the chain 🦋

[RFC1035] says the AA bit gets set based on whether the server giving the answer for the first owner name in the answer section is authoritative. This spec for the AA bit hasn't changed ✨

2.2. The Authentic Data Bit

The AD, or Authentic Data bit, says the response is authentic according to DNSSEC [RFC4035]. [RFC4035] is super clear that the AD bit only goes in a DNS response header if the DNSSEC-enabled server believes all RRs in the answer and authority sections of that response are authentic. This spec for the AD bit hasn't changed either 💅

3. RCODE Clarification 🎀

The RCODE field in a DNS query response header is non-zero to indicate an error. Section 4.3.2 of [RFC1034] has a resolution algorithm with CNAME processing, but it was found to be unclear about the final setting of RCODE in redirection cases. Section 2.1 of [RFC2308] kind of implies that the RCODE should be set based on the last query cycle for an xNAME chain, but Section 2.2.1 of [RFC2308] says some servers don't do that, which is wild 😭 So when there's an xNAME chain, the RCODE field gets set like this:

When an xNAME chain is followed, all but the last query cycle necessarily had no error. The RCODE in the ultimate DNS response MUST BE set based on the final query cycle leading to that response. If the xNAME chain was terminated by an error, it will be that error code. If the xNAME chain terminated without error, it will be zero.

4. Security Considerations 🔐

Okay, this part is seriously important, so pay attention bestie 😭 The AA header flag bit is not protected by DNSSEC [RFC4033]. To secure it, you need secure communication between the querying resolver and the DNS server. That security can come from DNS transaction security, either TSIG [RFC2845] or SIG(0) [RFC2931].

The AD header flag bit and the RCODE in a response generally aren't protected by DNSSEC either, so the same conditions from the paragraph above usually apply to them. But it's not always true 👀 Specifically, if the following all apply, then the AD bit and an NXDOMAIN RCODE are protected by DNSSEC, in the sense that the querier can calculate whether they're correct:

1. The zone where an NXDOMAIN RCODE occurs, or all the zones where the data whose authenticity would be indicated by the AD flag bit are signed zones.
2. The query or queries involved indicate that DNSSEC RRs are OK in responses.
3. The responses providing these indications come from servers that include the additional DNSSEC RRs required by DNSSEC.
4. The querier has appropriate trust anchor(s) and appropriately validates and processes the DNSSEC RRs in the response.

5. References 📚

5.1. Normative References

• [RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, November 1987.
• [RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, November 1987.
• [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
• [RFC2672] Crawford, M., "Non-Terminal DNS Name Redirection", RFC 2672, August 1999.
• [RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Protocol Modifications for the DNS Security Extensions", RFC 4035, March 2005.

5.2. Informative References

• [RFC2308] Andrews, M., "Negative Caching of DNS Queries (DNS NCACHE)", RFC 2308, March 1998.
• [RFC2845] Vixie, P., Gudmundsson, O., Eastlake 3rd, D., and B. Wellington, "Secret Key Transaction Authentication for DNS (TSIG)", RFC 2845, May 2000.
• [RFC2931] Eastlake 3rd, D., "DNS Request and Transaction Signatures ( SIG(0)s )", RFC 2931, September 2000.
• [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "DNS Security Introduction and Requirements", RFC 4033, March 2005.

Author's Address 🧚

   Donald E. Eastlake 3rd
   Huawei R&D USA
   155 Beaver Street
   Milford, MA  01757

   Phone: +1-508-333-2270
   EMail: d3e3e3@gmail.com

---