draft-ietf-dnsext-dns-name-p-s-00.txt revision 1d24d9f5c9239f60414d1eb78cde8755650b1bed
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob HalleyDNS Extensions Working Group G. Sisson
f2016fcecf098726740507a5522dca04c49aeb82Tinderbox UserInternet-Draft B. Laurie
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark AndrewsExpires: January 11, 2006 Nominet
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein July 10, 2005
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley Derivation of DNS Name Predecessor and Successor
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein draft-ietf-dnsext-dns-name-p-s-00
8a66318e41ed14c5a88130e8c362610e8faa2121Mark AndrewsStatus of this Memo
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews By submitting this Internet-Draft, each author represents that any
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews applicable patent or other IPR claims of which he or she is aware
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews have been or will be disclosed, and any of which he or she becomes
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews aware will be disclosed, in accordance with Section 6 of BCP 79.
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User Internet-Drafts are working documents of the Internet Engineering
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Task Force (IETF), its areas, and its working groups. Note that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein other groups may also distribute working documents as Internet-
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews Internet-Drafts are draft documents valid for a maximum of six months
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and may be updated, replaced, or obsoleted by other documents at any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time. It is inappropriate to use Internet-Drafts as reference
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews material or to cite them other than as "work in progress."
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The list of current Internet-Drafts can be accessed at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The list of Internet-Draft Shadow Directories can be accessed at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This Internet-Draft will expire on January 11, 2006.
d3ddafd7469d1f3430ccd1b0fe0d13ccbbaf5debTinderbox UserCopyright Notice
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Copyright (C) The Internet Society (2005).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This document describes two methods for deriving the canonically-
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ordered predecessor and successor of a DNS name. These methods may
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be used for dynamic NSEC resource record synthesis, enabling
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein security-aware name servers to provide authenticated denial of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein existence without disclosing other owner names in a DNSSEC-secured
b2f07642fd712c8fda81a116bcdde229ab291f33Tinderbox UserSisson & Laurie Expires January 11, 2006 [Page 1]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinInternet-Draft DNS Name Predecessor and Successor July 2005
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinTable of Contents
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 2. Notational Conventions . . . . . . . . . . . . . . . . . . . . 3
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 3. Absolute Method . . . . . . . . . . . . . . . . . . . . . . . 4
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 3.1. Derivation of DNS Name Predecessor . . . . . . . . . . . . 4
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 3.2. Derivation of DNS Name Successor . . . . . . . . . . . . . 4
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 4. Modified Method . . . . . . . . . . . . . . . . . . . . . . . 5
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 4.1. Derivation of DNS Name Predecessor . . . . . . . . . . . . 6
d3ddafd7469d1f3430ccd1b0fe0d13ccbbaf5debTinderbox User 4.2. Derivation of DNS Name Successor . . . . . . . . . . . . . 6
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 5. Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 5.1. Case Considerations . . . . . . . . . . . . . . . . . . . 7
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 5.2. Choice of Range . . . . . . . . . . . . . . . . . . . . . 7
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 5.3. Wild Card Considerations . . . . . . . . . . . . . . . . . 8
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 5.4. Possible Modifications . . . . . . . . . . . . . . . . . . 8
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 5.4.1. Restriction of Effective Maximum DNS Name Length . . . 8
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 5.4.2. Use of Modified Method With Zones Containing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein SRV RRs . . . . . . . . . . . . . . . . . . . . . . . 9
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 6. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 6.1. Examples of Immediate Predecessors Using Absolute
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Method . . . . . . . . . . . . . . . . . . . . . . . . . . 10
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 6.2. Examples of Immediate Successors Using Absolute Method . . 13
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 6.3. Examples of Predecessors Using Modified Method . . . . . . 19
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 6.4. Examples of Successors Using Modified Method . . . . . . . 20
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 7. Security Considerations . . . . . . . . . . . . . . . . . . . 21
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 21
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 22
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 10.1. Normative References . . . . . . . . . . . . . . . . . . . 22
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 10.2. Informative References . . . . . . . . . . . . . . . . . . 22
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 21
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Appendix A. Change History . . . . . . . . . . . . . . . . . . . 22
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A.1. Changes from sisson-02 to ietf-00 . . . . . . . . . . . . 22
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A.2. Changes from sisson-01 to sisson-02 . . . . . . . . . . . 23
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A.3. Changes from sisson-00 to sisson-01 . . . . . . . . . . . 23
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 24
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Intellectual Property and Copyright Statements . . . . . . . . . . 25
d3ddafd7469d1f3430ccd1b0fe0d13ccbbaf5debTinderbox UserSisson & Laurie Expires January 11, 2006 [Page 2]
d3ddafd7469d1f3430ccd1b0fe0d13ccbbaf5debTinderbox UserInternet-Draft DNS Name Predecessor and Successor July 2005
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein1. Introduction
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein One of the proposals for avoiding the exposure of zone information
c247e3f281613fabe1af362e9f3157e35ebbe52cMark Andrews during the deployment DNSSEC is dynamic NSEC resource record (RR)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein synthesis. This technique is described in [I-D.ietf-dnsext-dnssec-
c247e3f281613fabe1af362e9f3157e35ebbe52cMark Andrews trans] and [I-D.ietf-dnsext-dnssec-online-signing], and involves the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein generation of NSEC RRs that just span the query name for non-existent
c247e3f281613fabe1af362e9f3157e35ebbe52cMark Andrews owner names. In order to do this, the DNS names which would occur
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein just prior to and just following a given query name must be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein calculated in real time, as maintaining a list of all possible owner
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein names that might occur in a zone would be impracticable.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Section 6.1 of [RFC4034] defines canonical DNS name order. This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein document does not amend or modify this definition. However, the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein derivation of immediate predecessor and successor, while trivial, is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein non-obvious. Accordingly, several methods are described here as an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein aid to implementors and a reference to other interested parties.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This document describes two methods:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 1. An ``absolute method'', which returns the immediate predecessor
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or successor of a domain name such that no valid DNS name could
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User exist between that DNS name and the predecessor or successor.
d3ddafd7469d1f3430ccd1b0fe0d13ccbbaf5debTinderbox User 2. A ``modified method'', which returns a predecessor and successor
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which are more economical in size and computation. This method
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User is restricted to use with zones consisting only of single-label
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User owner names where a maximum-length owner name would not result in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a DNS name exceeding the maximum DNS name length. This is,
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User however, the type of zone for which the technique of online-
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User signing is most likely to be used.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User2. Notational Conventions
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User The following notational conventions are used in this document for
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User economy of expression:
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User N: An unspecified DNS name.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User P(N): Immediate predecessor to N (absolute method).
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User S(N): Immediate successor to N (absolute method).
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User P'(N): Predecessor to N (modified method).
4f9cb7bd58e2c0a7407fee3758ea265aee329ac6Tinderbox UserSisson & Laurie Expires January 11, 2006 [Page 3]
4f9cb7bd58e2c0a7407fee3758ea265aee329ac6Tinderbox UserInternet-Draft DNS Name Predecessor and Successor July 2005
4f9cb7bd58e2c0a7407fee3758ea265aee329ac6Tinderbox User S'(N): Successor to N (modified method).
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User3. Absolute Method
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User These derivations assume that all uppercase US-ASCII letters in N
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User have already been replaced by their corresponding lowercase
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User equivalents. Unless otherwise specified, processing stops after the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User first step in which a condition is met.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User3.1. Derivation of DNS Name Predecessor
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User To derive P(N):
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 1. If N is the same as the owner name of the zone apex, prepend N
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User repeatedly with labels of the maximum length possible consisting
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User of octets of the maximum sort value (e.g. 0xff) until N is the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User maximum length possible; otherwise continue to the next step.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 2. If the least significant (left-most) label of N consists of a
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User single octet of the minimum sort value (e.g. 0x00), remove that
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User label; otherwise continue to the next step.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 3. If the least significant (right-most) octet in the least
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User significant (left-most) label of N is the minimum sort value,
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User remove the least significant octet and continue with step 5.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 4. Decrement the value of the least significant (right-most) octet,
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User skipping any values that correspond to uppercase US-ASCII
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User letters, and then append the label with as many octets as
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User possible of the maximum sort value. Continue to the next step.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 5. Prepend N repeatedly with labels of as long a length as possible
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User consisting of octets of the maximum sort value until N is the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User maximum length possible.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User3.2. Derivation of DNS Name Successor
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User To derive S(N):
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 1. If N is two or more octets shorter than the maximum DNS name
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User length, prepend N with a label containing a single octet of the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User minimum sort value (e.g. 0x00); otherwise continue to the next
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 2. If N is one or more octets shorter than the maximum DNS name
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User length and the least significant (left-most) label is one or more
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User octets shorter than the maximum label length, append an octet of
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserSisson & Laurie Expires January 11, 2006 [Page 4]
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserInternet-Draft DNS Name Predecessor and Successor July 2005
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User the minimum sort value to the least significant label; otherwise
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User continue to the next step.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 3. Increment the value of the least significant (right-most) octet
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User in the least significant (left-most) label that is less than the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User maximum sort value (e.g. 0xff), skipping any values that
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User correspond to uppercase US-ASCII letters, and then remove any
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User octets to the right of that one. If all octets in the label are
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User the maximum sort value, then continue to the next step.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 4. Remove the least significant (left-most) label. If N is now the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User same as the owner name of the zone apex, do nothing. (This will
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User occur only if N is the maximum possible name in canonical DNS
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User name order, and thus has wrapped to the owner name of zone apex.)
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User Otherwise repeat starting at step 2.
f2016fcecf098726740507a5522dca04c49aeb82Tinderbox User4. Modified Method
f2016fcecf098726740507a5522dca04c49aeb82Tinderbox User This method is for use with zones consisting only of single-label
f2016fcecf098726740507a5522dca04c49aeb82Tinderbox User owner names where an owner name consisting of label of maximum length
f2016fcecf098726740507a5522dca04c49aeb82Tinderbox User would not result in a DNS name which exceeded the maximum DNS name
f2016fcecf098726740507a5522dca04c49aeb82Tinderbox User length. This method is computationally simpler and returns values
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User which are more economical in size than the absolute method. It
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User differs from the absolute method detailed above in the following
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 1. Step 1 of the derivation P(N) has been omitted as the existence
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User of the owner name of the zone apex never requires denial.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 2. A new step 1 has been introduced which removes unnecessary
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 3. Step 4 of the derivation P(N) has been omitted as it is only
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User necessary for zones containing owner names consisting of more
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User than one label. This omission generally results in a significant
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User reduction of the length of derived predecessors.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 4. Step 1 of the derivation S(N) had been omitted as it is only
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User necessary for zones containing owner names consisting of more
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User than one label. This omission results in a tiny reduction of the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User length of derived successors, and maintains consistency with the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User modification of step 4 of the derivation P(N) described above.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 5. Steps 2 and 4 of the derivation S(N) have been modified to
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User eliminate checks for maximum DNS name length, as it is an
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User assumption of this method that no DNS name in the zone can exceed
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User the maximum DNS name length.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserSisson & Laurie Expires January 11, 2006 [Page 5]
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserInternet-Draft DNS Name Predecessor and Successor July 2005
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User These derivations assume that all uppercase US-ASCII letters in N
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User have already been replaced by their corresponding lowercase
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User equivalents. Unless otherwise specified, processing stops after the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User first step in which a condition is met.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User4.1. Derivation of DNS Name Predecessor
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User To derive P'(N):
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 1. If N has more labels than the number of labels in the owner name
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User of the apex + 1, repeatedly remove the least significant (left-
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User most) label until N has no more labels than the number of labels
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User in the owner name of the apex + 1; otherwise continue to next
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 2. If the least significant (left-most) label of N consists of a
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User single octet of the minimum sort value (e.g. 0x00), remove that
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User label; otherwise continue to the next step.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 3. If the least significant (right-most) octet in the least
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User significant (left-most) label of N is the minimum sort value,
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User remove the least significant octet.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 4. Decrement the value of the least significant (right-most) octet,
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User skipping any values which correspond to uppercase US-ASCII
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User letters, and then append the label with as many octets as
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User possible of the maximum sort value.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User4.2. Derivation of DNS Name Successor
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User To derive S'(N):
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 1. If N has more labels than the number of labels in the owner name
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User of the apex + 1, repeatedly remove the least significant (left-
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User most) label until N has no more labels than the number of labels
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User in the owner name of the apex + 1. Continue to next step.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 2. If the least significant (left-most) label of N is one or more
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User octets shorter than the maximum label length, append an octet of
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User the minimum sort value to the least significant label; otherwise
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User continue to the next step.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 3. Increment the value of the least significant (right-most) octet
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User in the least significant (left-most) label that is less than the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User maximum sort value (e.g. 0xff), skipping any values which
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User correspond to uppercase US-ASCII letters, and then remove any
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User octets to the right of that one. If all octets in the label are
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User the maximum sort value, then continue to the next step.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserSisson & Laurie Expires January 11, 2006 [Page 6]
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserInternet-Draft DNS Name Predecessor and Successor July 2005
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 4. Remove the least significant (left-most) label. (This will occur
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User only if the least significant label is the maximum label length
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User and consists entirely of octets of the maximum sort value, and
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User thus has wrapped to the owner name of the zone apex.)
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User5.1. Case Considerations
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User Section 3.5 of [RFC1034] specifies that "while upper and lower case
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User letters are allowed in [DNS] names, no significance is attached to
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User the case". Additionally, Section 6.1 of [RFC4034] states that when
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User determining canonical DNS name order, "uppercase US-ASCII letters are
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User treated as if they were lowercase US-ASCII letters". Consequently,
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User values corresponding to US-ASCII uppercase letters must be skipped
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User when decrementing and incrementing octets in the derivations
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User described in Section 3.1 and Section 3.2.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User The following pseudo-code is illustrative:
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User Decrement the value of an octet:
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User if (octet == '[') // '[' is just after uppercase 'Z'
94479b38340a00f0daf0ae0e1d3d673f845609ffTinderbox User octet = '@'; // '@' is just prior to uppercase 'A'
ccee3948124ab4c8bc3afa4369177913edb1fca2Tinderbox User Increment the value of an octet:
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User if (octet == '@') // '@' is just prior to uppercase 'A'
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User octet = '['; // '[' is just after uppercase 'Z'
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User5.2. Choice of Range
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User [RFC2181] makes the clarification that "any binary string whatever
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User can be used as the label of any resource record". Consequently the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User minimum sort value may be set as 0x00 and the maximum sort value as
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 0xff, and the range of possible values will be any DNS name which
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User contains octets of any value other than those corresponding to
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User uppercase US-ASCII letters.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User However, if all owner names in a zone are in the letter-digit-hyphen,
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User or LDH, format specified in [RFC1034], it may be desirable to
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User restrict the range of possible values to DNS names containing only
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User LDH values. This has the effect of:
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserSisson & Laurie Expires January 11, 2006 [Page 7]
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox UserInternet-Draft DNS Name Predecessor and Successor July 2005
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User 1. making the output of tools such as `dig' and `nslookup' less
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User subject to confusion;
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User 2. minimising the impact that NSEC RRs containing DNS names with
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User non-LDH values (or non-printable values) might have on faulty DNS
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User resolver implementations; and
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User 3. preventing the possibility of results which are wildcard DNS
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User names (see Section 5.3).
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User This may be accomplished by using a minimum sort value of 0x1f (US-
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User ASCII character `-') and a maximum sort value of 0x7a (US-ASCII
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User character lowercase `z'), and then skipping non-LDH, non-lowercase
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User values when incrementing or decrementing octets.
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User5.3. Wild Card Considerations
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User Neither derivation avoids the possibility that the result may be a
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User DNS name containing a wildcard label, i.e. a label containing a
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User single octet with the value 0x2a (US-ASCII character `*'). With
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User additional tests, wildcard DNS names may be explicitly avoided;
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User alternatively, if the range of octet values can be restricted to
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User those corresponding to letter-digit-hyphen, or LDH, characters (see
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User Section 5.2), such DNS names will not occur.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User Note that it is improbable that a result which is a wildcard DNS name
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User will occur unintentionally; even if one does occur either as the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User owner name of, or in the RDATA of an NSEC RR, it is treated as a
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User literal DNS name with no special meaning.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User5.4. Possible Modifications
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User5.4.1. Restriction of Effective Maximum DNS Name Length
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User [RFC1034] specifies that "the total number of octets that represent a
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User [DNS] name (i.e., the sum of all label octets and label lengths) is
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User limited to 255", including the null (zero-length) label which
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User represents the root. For the purpose of deriving predecessors and
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User successors during NSEC RR synthesis, the maximum DNS name length may
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User be effectively restricted to the length of the longest DNS name in
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User the zone. This will minimise the size of responses containing
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User synthesised NSEC RRs but, especially in the case of the modified
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User method, may result in some additional computational complexity.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User Note that this modification will have the effect of revealing
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User information about the longest name in the zone. Moreover, when the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User contents of the zone changes, e.g. during dynamic updates and zone
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User transfers, care must be taken to ensure that the effective maximum
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserSisson & Laurie Expires January 11, 2006 [Page 8]
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserInternet-Draft DNS Name Predecessor and Successor July 2005
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User DNS name length agrees with the new contents.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User5.4.2. Use of Modified Method With Zones Containing SRV RRs
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User Normally the modified method cannot be used in zones that contain
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User SRV RRs [RFC2782], as SRV RRs have owner names which contain multiple
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User labels. However the use of SRV RRs can be accommodated by various
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User techniques. There are at least four possible ways to do this:
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 1. Use conventional NSEC RRs for the region of the zone that
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User contains first-level labels beginning with the underscore (`_')
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User character. For the purposes of generating these NSEC RRs, the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User existence of (possibly fictional) ownernames `9{63}' and `a'
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User could be assumed, providing a lower and upper bound for this
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User region. Then all queries where the QNAME doesn't exist but
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User contains a first-level label beginning with an underscore could
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User be handled using the normal DNSSEC protocol.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User This approach would make it possible to enumerate all DNS names
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User in the zone containing a first-level label beginning with
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User underscore, including all SRV RRs, but this may be of less a
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User concern to the zone administrator than incurring the overhead of
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User the absolute method or of the following variants of the modified
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 2. The absolute method could be used for synthesising NSEC RRs for
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User all queries where the QNAME contains a leading underscore.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User However this re-introduces the susceptibility of the absolute
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User method to denial of service activity, as an attacker could send
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User queries for an effectively inexhaustible supply of domain names
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User beginning with a leading underscore.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 3. A variant of the modified method could be used for synthesising
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User NSEC RRs for all queries where the QNAME contains a leading
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User underscore. This variant would assume that all predecessors and
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User successors to queries where the QNAME contains a leading
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User underscore may consist of two lablels rather than only one. This
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User introduces a little additional complexity without incurring the
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User full increase in response size and computational complexity as
74ae031d9d7780015c11242b71cecca905ada695Tinderbox User the absolute method.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User 4. Finally, a variant the modified method which assumes that all
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User owner names in the zone consist of one or two labels could be
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User used. However this negates much of the reduction in response
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User size of the modified method and may be nearly as computationally
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User complex as the absolute method.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserSisson & Laurie Expires January 11, 2006 [Page 9]
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox UserInternet-Draft DNS Name Predecessor and Successor July 2005
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User In the following examples:
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User the owner name of the zone apex is "example.com.";
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User the range of octet values is 0x00 - 0xff excluding values
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User corresponding to uppercase US-ASCII letters; and
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User non-printable octet values are expressed as three-digit decimal
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User numbers preceded by a backslash (as specified in Section 5.1 of
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User6.1. Examples of Immediate Predecessors Using Absolute Method
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User Example of typical case:
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
3c7b4ac4517ac9d78c9bf3e0e790cedce10ddc18Tinderbox User \255.\255\255\255\255\255\255\255\255\255\255
3c7b4ac4517ac9d78c9bf3e0e790cedce10ddc18Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
3c7b4ac4517ac9d78c9bf3e0e790cedce10ddc18Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
3c7b4ac4517ac9d78c9bf3e0e790cedce10ddc18Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255.\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255.fon\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255\255\255\255\255\255\255\255\255\255.example.com.
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User or, in alternate notation:
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User \255{49}.\255{63}.\255{63}.fon\255{60}.example.com.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein where {n} represents the number of repetitions of an octet.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinSisson & Laurie Expires January 11, 2006 [Page 10]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinInternet-Draft DNS Name Predecessor and Successor July 2005
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User Example where least significant (left-most) label of DNS name
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein consists of a single octet of the minimum sort value:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Example where least significant (right-most) octet of least
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein significant (left-most) label has the minimum sort value:
f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42Tinderbox User \255\255\255\255\255\255\255\255\255\255\255\255
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein \255\255\255\255\255\255\255\255\255\255\255\255
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein \255\255\255\255\255\255\255\255\255\255\255\255
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein \255\255\255\255\255\255\255\255\255.\255\255
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein \255\255\255\255\255\255\255\255\255\255\255\255
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein \255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255.foo.example.com.
\255{45}.\255{63}.\255{63}.\255{63}.foo.example.com.
P(fo\[.example.com.) =
\255\255\255\255\255\255\255\255\255.fo\@\255
\255\255\255\255\255\255\255\255\255\255\255.example.com.
\255{49}.\255{63}.\255{63}.fo\@\255{60}.example.com.
P(example.com.) =
\255{49}.\255{63}.\255{63}.\255{63}.example.com.
fo{47}.o{63}.o{63}.o{63}.example.com.
fo{48}.o{63}.o{63}.o{63}.example.com.
\255{49}.o{63}.o{63}.o{63}.example.com.
\255\255\255\255\255\255\255.ooooooooooooooooooo
fo{40}\255{8}.o{63}.o{63}.o{63}.example.com.
fo{47}\@.o{63}.o{63}.o{63}.example.com.
fo{47}\[.o{63}.o{63}.o{63}.example.com.
\255{49}.\255{63}.\255{63}.\255{63}.example.com.
S(N) = example.com.
P'(foo.example.com.) =
fon\255{60}.example.com.
P'(example.com.) =
\255\255\255.example.com.
\255{63}.example.com.
\255\255\255.example.com.
\255{63}.example.com.
S'(N) = example.com.
The derivation of some predecessors/successors requires the testing
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS