Empty non-terminals and NSEC records

[Erik Rozendaal <erik@NLnetLabs.nl>]

The example zone in the draft-ietf-dnsext-dnssec-protocol-03.txt document 
contains the following records (among others and excluding RRSIG records):

   ns2.example.   3600 IN A   192.0.2.2
                  3600 NSEC   *.w.example. A RRSIG NSEC
   *.w.example.   3600 IN MX  1 ai.example.
                  3600 NSEC   x.w.example. MX RRSIG NSEC

Notice there are no RRs for the w.example. domain, making it an empty 
non-terminal.  According to the original DNS RFCs empty non-terminals do 
exist (in other words, querying for w.example. will not result in NXDOMAIN 
but in NODATA).

However, the signed version does not include proper NSEC records for 
w.example.  Is this intentional and expected behaviour?

Erik


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>