nsd users - Jun 2007 - SERVFAIL <=> NXDOMAIN

Hello,

we encountered a problem with registry nic.at for tld .at and their 
transaction "BillWithDraw". This transaction allows an registrar to 
delegate authority back to registry.
For a successful use of this transaction all nameserver-entries for the 
zone will be deleted by our application before nic-order will be sent to 
nic.at.
Nic.at now checks all nameserver for existing entries for affected zone. 
If all nameservers return a NXDOMAIN (Bind) everything is fine.
Our NSD nameservers return the status SERVFAIL. Nic.at interprets this 
return-code as an error and does not finish this transaction completely.

Is it possible to return a NXDOMAIN instead of a SERVFAIL? Are there 
different  possibilities how this point can be resolved?
Nic.at will not change their behaviour before Q4!

Best regards,
Iren?us Becker

-- 
_____________________________________________________________
         Iren?us Becker * Team Leader Customer Care

DSS Gesellschaft fuer Digitale Sicherheit mbH * HRB Bonn 7907
   Servatiusweg 19-23, 53332 Bornheim, phone +49 2222 990-0
     Gesch?ftsf?hrer: Thomas Reiners, Sven-Holger Wabnitz

                     http://www.dominic.de

On Wed, Jun 13, 2007 at 06:26:00PM +0200, Iren?us Becker wrote:
> Nic.at now checks all nameserver for existing entries for affected zone. 
> If all nameservers return a NXDOMAIN (Bind) everything is fine.
> Our NSD nameservers return the status SERVFAIL. Nic.at interprets this 
> return-code as an error and does not finish this transaction completely.
I haven't checked your view of nic.at's policies and/or procedures and
would
appreciate a comment from AT. That said, ...
> Is it possible to return a NXDOMAIN instead of a SERVFAIL? Are there 
... SERVFAIL is probably the more protocolly correct response but not the only
possible one.
Some scenarios are listed in <draft-koch-dns-unsolicited-queries-01.txt>
> different  possibilities how this point can be resolved?
If you really need to respond NXDOMAIN (and again, I'm not saying you do),
one approach is to define an empty (lest the served delegations) parent TLD
(here: AT) zone on your server(s). But careful: there may be side effects
and you should make sure not to leak false information.  The bottom line is:
if the problem exists, it can be solved by configuration, not by teaching
nsd to violate the protocol.

-Peter