<html><head></head><body> <div dir="auto">Hi Emmanuel,</div><div><br></div> <div id="protonmail_mobile_signature_block"><div dir="auto"><span style="color: var(--text-color); background: var(--bg-color);" dir="auto">On Mon, Mar 27, 2023 at 10:51, Emmanuel Fusté <</span><a class="" href="mailto:manu.fuste@gmail.com">manu.fuste@gmail.com</a><span style="color: var(--text-color); background: var(--bg-color);">> wrote:</span><br></div></div><blockquote type="cite" class="protonmail_quote" dir="auto">Cloudflare start to return TYPE65283 in their NSEC records for "compact<br>DNSSEC denial of existence"/"minimal lies" for NXDOMAINs.<br>It actually break "minimal lies" NXDOMAIN established decoding<br>implementations.<br>Does someone know the TYPE65283 usage/purpose in this context ?</blockquote><div dir="auto"><br></div><div dir="auto"><span style="color: var(--text-color); background: var(--bg-color);" dir="auto">If a compact negative response includes an NSEC RR </span><caret style="color: var(--text-color);"></caret><span style="color: var(--text-color); background: var(--bg-color);" dir="auto">whose type bitmap only includes NSEC and RRSIG, the response is is indistuishable from the case where the name exists but is an empty non-terminal. Adding a special entry in the type bitmap avoids that ambiguity and as a bonus provides an NXDOMAINish signal as a kind of compromise to those consumers who are all pitchforky about the RCODE. The spec currently calls that special type NXNAME.<caret></caret></span><br></div><div dir="auto"><caret></caret></div><div dir="auto"><br></div><a href="https://www.ietf.org/archive/id/draft-huque-dnsop-compact-lies-01.txt" dir="auto"><caret></caret>https://www.ietf.org/archive/id/draft-huque-dnsop-compact-lies-01.txt</a><div dir="auto"><br></div><div dir="auto">The spec is still a work in progress and the NXNAME type does not have a codepoint. I believe TYPE65283 is being used as a placeholder. I think Christian made a comment to that effect on this list last week, although I think <caret></caret>he may not have mentioned the specific RRTYPE that was to be used.<caret></caret></div><div dir="auto"><br></div><div dir="auto">If this <caret></caret>has caused something to break, more details would be good to hear!</div><div dir="auto"><br></div><div dir="auto"><div dir="auto"><div dir="auto"><br></div><div dir="auto">Joe</div><blockquote type="cite" class="protonmail_quote" dir="auto"></blockquote></div></div></body></html>