<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-15"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi,<br>
<br>
thank you very much. This helps us to solve our problems.<br>
<br>
Best regards,<br>
Irenäus<br>
<br>
<blockquote cite="mid:20070613224605.GA24241@denics7.denic.de"
type="cite">
<blockquote type="cite">
<pre wrap="">Nic.at now checks all nameserver for existing entries for affected zone.
If all nameservers return a NXDOMAIN (Bind) everything is fine.
Our NSD nameservers return the status SERVFAIL. Nic.at interprets this
return-code as an error and does not finish this transaction completely.
</pre>
</blockquote>
<pre wrap=""><!---->
I haven't checked your view of nic.at's policies and/or procedures and would
appreciate a comment from AT. That said, ...
</pre>
<blockquote type="cite">
<pre wrap="">Is it possible to return a NXDOMAIN instead of a SERVFAIL? Are there
</pre>
</blockquote>
<pre wrap=""><!---->
... SERVFAIL is probably the more protocolly correct response but not the only
possible one.
Some scenarios are listed in <draft-koch-dns-unsolicited-queries-01.txt>
</pre>
<blockquote type="cite">
<pre wrap="">different possibilities how this point can be resolved?
</pre>
</blockquote>
<pre wrap=""><!---->
If you really need to respond NXDOMAIN (and again, I'm not saying you do),
one approach is to define an empty (lest the served delegations) parent TLD
(here: AT) zone on your server(s). But careful: there may be side effects
and you should make sure not to leak false information. The bottom line is:
if the problem exists, it can be solved by configuration, not by teaching
nsd to violate the protocol.
-Peter
</pre>
</blockquote>
<br>
</body>
</html>