PowerPoint Presentation

-32

$ORIGIN ripe.net.

@SOA É..

NSNS.ripe.net.

KEY É..

NXT mailbox.ripe.net. SOA NS NXT KEY SIG

mailboxA192.168.10.2

NXT www.ripe.net. A NXT SIG

WWWA192.168.10.3

NXT ripe.net. A NXT SIG

Fquery for popserver.ripe.net would return:

aa bit set RCODE=NXDOMAIN

authority: mailbox.ripe.net. NXT www.ripe.net. A NXT SIG

Fquery for www.ripe.net MX would return: an empty answer section and the www NXT record in the authority section

NXT Record

ÔpopserverŐ is missing


	In the above example the SIG RRs are left out for clarity.

	The NXT record is circular over the zone. The next label after www.ripe.net. Is ripe.net Once signed the RR that are available with label www.bla.foo are A SIG and NXT.

	Using the NXT record, one can do a zone walk. Some people find this undesirable. However, the DNS is a public database. (One can use views to block your ÔinternalŐ naming scheme from external eyes.)