From dnsext-archive@ietf.org Sat May 1 02:26:53 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C9343A69C8 for ; Sat, 1 May 2010 02:26:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -93.959 X-Spam-Level: X-Spam-Status: No, score=-93.959 tagged_above=-999 required=5 tests=[BAYES_99=3.5, HELO_EQ_RU=0.595, HOST_EQ_RU=0.875, MIME_8BIT_HEADER=0.3, RCVD_IN_SORBS_WEB=0.619, SARE_SUB_ENC_UTF8=0.152, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aFK0ZhyyRdNo for ; Sat, 1 May 2010 02:26:53 -0700 (PDT) Received: from mail.ivcomm.ru (mail.ivcomm.ru [217.174.188.40]) by core3.amsl.com (Postfix) with ESMTP id F3CE43A6AC7 for ; Sat, 1 May 2010 02:26:45 -0700 (PDT) X-Spam-Yversion: Spamooborona-2.3 Received: from [127.0.0.1] (HELO ASSP.ivcomm.ru) by mail.ivcomm.ru (CommuniGate Pro SMTP 5.2.18) with ESMTP id 4994539 for dnsext-archive@ietf.org; Sat, 01 May 2010 04:30:06 +0400 Received: from ngs.ru ([217.8.236.160] helo=ngs.ru) with IPv4:25 by ASSP.ivcomm.ru; 1 May 2010 04:04:04 +0400 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="windows-1251" From: To: Subject: =?utf-8?B?0KHQvtCx0LXRgNC10Lwg0LTQu9GPINCS0LDRgSDQv9C+INGB0LXRgtC4INC40L3RgmXRgNC90LXRgiDQsdCw0LfRgyDQtNCw0L3QvdGL0YUg0L/QvtGC0LXQvdGG0Lhh0LvRjNC90YvRhSDQutC70LjQtdC90YJv0LIg0LTQu9GPINCS0LDRiNC10LPQviDQkdC40LfQvWXRgdCwICjQvdCw0LfQstCw0L3QuGUsINGC0LXQu9C10YTQvtC9LCBlbWFpbCwgd3d3LCDQuNC8ZdC9YSAsINGA0L7QtGEg0LRl0Y/RgmXQu9GM0L3QvmPRgtC4LCDRgm/QstCwcNGLLCDRg9GB0LvRg9Cz0Lgg0LjRgtC0KSDQoW/QsWXRgNC10Lwg0JzQvdC+0LPQviwg0JHRi9GB0YLRgG8sINCdZdC0b9GAb9CzbyDQn9C+0LTRgG/QsdC9ZWUgedC30L3QsNC50YJlINC/byDQotC10Ls6ICs3OTEzMzkxMzgzNyBFbWFpbDogcHJvZGF3ZXpAbWl4bWFpbC5jb20gSUNROiA2Mjg4ODYyIFNreXBlOiBiYXNlZGFubml4?= X-Assp-ID: ASSP.ivcomm.ru (73806-04974) X-Assp-Version: 1.7.1.1(1.0.00) Date: Sat, 01 May 2010 04:30:07 +0400 Message-ID: Ñîáåðåì äëÿ Âàñ ïî ñåòè èíòeðíåò áàçó äàííûõ ïîòåíöèaëüíûõ êëèåíòoâ äëÿ Âàøåãî Áèçíeñà (íàçâàíèe, òåëåôîí, email, www, èìeía , ðîäa äeÿòeëüíîcòè, òoâàpû, óñëóãè èòä) Ñoáeðåì Ìíîãî, Áûñòðo, Íeäoðoão Ïîäðoáíee yçíàéòe ïo Òåë: +79133913837 Email: prodawez@mixmail.com ICQ: 6288862 Skype: basedannix From mail@air.simfi.net Sat May 1 15:20:58 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1349C3A6981 for ; Sat, 1 May 2010 15:20:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -28.815 X-Spam-Level: X-Spam-Status: No, score=-28.815 tagged_above=-999 required=5 tests=[AWL=2.329, BAYES_99=3.5, FH_RELAY_NODNS=1.451, GB_I_LETTER=-2, GB_PHARMACY=1, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.097, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, RELAY_IS_203=0.994, SARE_FORGED_AMAZON=3, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4CJRSeFoC0jl for ; Sat, 1 May 2010 15:20:55 -0700 (PDT) Received: from af-ct.com (unknown [203.192.154.122]) by core3.amsl.com (Postfix) with SMTP id CA2543A6920 for ; Sat, 1 May 2010 15:20:47 -0700 (PDT) From: "Amazon.com Email Subscriptions" To: "dnsext-archive@ietf.org" Subject: Amazon.com Deal of the Day X-AMAZON-MAIL-RELAY-TYPE: subscription X-AMAZON-RTE-VERSION: 2.0 MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100501222050.CA2543A6920@core3.amsl.com> Date: Sat, 1 May 2010 15:20:47 -0700 (PDT)
Please click here if the e-mail below is not displayed correctly.
amazon.com
Free Two-Day Shipping with   › Amazon Prime
Your Amazon.com Today's Deals See All Departments
Tiffen Dfx Digital Filter Software V2
$149.95 $79.99 (47% off)
4.28571428571429
This Tiffen Dfx digital filter suite is a powerful but user-friendly stand alone application for still images. It offers a definitive set of digital optical filters, including simulations of many popular award-winning Tiffen glass filters, specialized lenses, optical lab processes, film grain, exacting color correction plus natural light and photographic effects, all in a controlled digital environment. Whether you are an amateur or professional photographer, a video or film editor, or graphic designer, Dfx's visual workflow and easy to use tools will help you create stunning images. Windows XP, Vista or Macintosh v10.4.6 and higher required for use.
Explore Other Great Gold Box Deals
Save $20 on Adobe Photoshop Elements 8
Great gift for Mom! Dbest Quick Cart
Lunar: Silver Star Harmony Limited Edition for $25.98
100 Albums for $5 Each
Save $20 on Adobe Photoshop Elements 8
$99.99 $59.99 (40% off)
 
 
Great gift for Mom! Dbest Quick Cart
$34.95 $29.99 (14% off)
 
 
Lunar: Silver Star Harmony Limited Edition for $25.98
$39.99 $25.98 (35% off)
 
 
100 Albums for $5 Each
 
Save up to $500 off the combined purchase of select Canon cameras and printers
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
Save $10 on "Alice in Wonderland Combo Pack"
Save up to 40% on Our Bestselling Fitness Products
Save up to $500 off the combined purchase of select Canon cameras and printers
 
 
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
 
 
Save $10 on "Alice in Wonderland Combo Pack"
 
 
Save up to 40% on Our Bestselling Fitness Products
 


This message was sent to the following e-mail address: dnsext-archive@ietf.org

You're receiving this e-mail because you subscribed to Gold Box Deals. If you do not want any more e-mails of this kind, it's easy to unsubscribe.

Please note that product prices and availability are subject to change. Prices and availability were accurate at the time this newsletter was sent; however, they may differ from those you see when you visit Amazon.com. The List Price represents the full retail price listed on the product itself, suggested by the manufacturer or supplier, or estimated in accordance with standard industry practice. For items offered as a set, List Price may represent open-stock prices.

© 2010 Amazon.com. All rights reserved.
Amazon.com is a registered trademark of Amazon.com, Inc.
Amazon.com, 1200 12th Ave. S., Suite 1200, Seattle, WA 98144-2734.
Reference: 15067840
From ljohnson@alternativeclaims.com Sat May 1 18:54:59 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 37F843A69C6 for ; Sat, 1 May 2010 18:54:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.372 X-Spam-Level: X-Spam-Status: No, score=-1.372 tagged_above=-999 required=5 tests=[BAYES_99=3.5, GB_I_LETTER=-2, GB_PHARMACY=1, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.097, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, SARE_FORGED_AMAZON=3, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_RHS_DOB=1.083, URIBL_SBL=20, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jqurOPigldro for ; Sat, 1 May 2010 18:54:57 -0700 (PDT) Received: from nas-02.ktb.ua (nas-02.ktb.ua [212.115.225.47]) by core3.amsl.com (Postfix) with SMTP id 915923A68E9 for ; Sat, 1 May 2010 18:54:38 -0700 (PDT) From: "Amazon.com Email Subscriptions" To: "dnsext-archive@ietf.org" Subject: Amazon.com Deal of the Day X-AMAZON-MAIL-RELAY-TYPE: subscription X-AMAZON-RTE-VERSION: 2.0 MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100502015441.915923A68E9@core3.amsl.com> Date: Sat, 1 May 2010 18:54:38 -0700 (PDT)
Please click here if the e-mail below is not displayed correctly.
amazon.com
Free Two-Day Shipping with   › Amazon Prime
Your Amazon.com Today's Deals See All Departments
Tiffen Dfx Digital Filter Software V2
$149.95 $79.99 (47% off)
4.28571428571429
This Tiffen Dfx digital filter suite is a powerful but user-friendly stand alone application for still images. It offers a definitive set of digital optical filters, including simulations of many popular award-winning Tiffen glass filters, specialized lenses, optical lab processes, film grain, exacting color correction plus natural light and photographic effects, all in a controlled digital environment. Whether you are an amateur or professional photographer, a video or film editor, or graphic designer, Dfx's visual workflow and easy to use tools will help you create stunning images. Windows XP, Vista or Macintosh v10.4.6 and higher required for use.
Explore Other Great Gold Box Deals
Save $20 on Adobe Photoshop Elements 8
Great gift for Mom! Dbest Quick Cart
Lunar: Silver Star Harmony Limited Edition for $25.98
100 Albums for $5 Each
Save $20 on Adobe Photoshop Elements 8
$99.99 $59.99 (40% off)
 
 
Great gift for Mom! Dbest Quick Cart
$34.95 $29.99 (14% off)
 
 
Lunar: Silver Star Harmony Limited Edition for $25.98
$39.99 $25.98 (35% off)
 
 
100 Albums for $5 Each
 
Save up to $500 off the combined purchase of select Canon cameras and printers
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
Save $10 on "Alice in Wonderland Combo Pack"
Save up to 40% on Our Bestselling Fitness Products
Save up to $500 off the combined purchase of select Canon cameras and printers
 
 
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
 
 
Save $10 on "Alice in Wonderland Combo Pack"
 
 
Save up to 40% on Our Bestselling Fitness Products
 


This message was sent to the following e-mail address: dnsext-archive@ietf.org

You're receiving this e-mail because you subscribed to Gold Box Deals. If you do not want any more e-mails of this kind, it's easy to unsubscribe.

Please note that product prices and availability are subject to change. Prices and availability were accurate at the time this newsletter was sent; however, they may differ from those you see when you visit Amazon.com. The List Price represents the full retail price listed on the product itself, suggested by the manufacturer or supplier, or estimated in accordance with standard industry practice. For items offered as a set, List Price may represent open-stock prices.

© 2010 Amazon.com. All rights reserved.
Amazon.com is a registered trademark of Amazon.com, Inc.
Amazon.com, 1200 12th Ave. S., Suite 1200, Seattle, WA 98144-2734.
Reference: 15067840
From dnsext-archive@ietf.org Sun May 2 00:34:02 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5F8B63A67B6 for ; Sun, 2 May 2010 00:34:02 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Non-encoded 8-bit data (char A9 hex): From: Official \251 VIAGRA ; Sun, 2 May 2010 00:34:01 -0700 (PDT) Received: from 114-41-214-237.dynamic.hinet.net (114-41-214-237.dynamic.hinet.net [114.41.214.237]) by core3.amsl.com (Postfix) with SMTP id E0A2D3A6767 for ; Sun, 2 May 2010 00:34:00 -0700 (PDT) Received: 20100502153346.2379.qmail@114-41-214-237.dynamic.hinet.net Date: Sun, 02 May 2010 10:49:28 +0400 Message-ID: <20100502153346.2379.qmail@114-41-214-237.dynamic.hinet.net> To: dnsext-archive@ietf.org Subject: dnsext-archive@ietf.org Discount 8674 From: Official © VIAGRA MIME-Version: 1.0 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit
Click here to view as a web page.

View image in browser now
To dnsext-archive@ietf.org | Privacy Policy | Contact Us

Copyright © 2010 All rights reserved.
From owner-namedroppers@ops.ietf.org Sun May 2 02:58:20 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BAB7E3A686C; Sun, 2 May 2010 02:58:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.792 X-Spam-Level: X-Spam-Status: No, score=-7.792 tagged_above=-999 required=5 tests=[AWL=-1.982, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, RCVD_IN_DNSWL_HI=-8, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQTCB0XWrs4b; Sun, 2 May 2010 02:58:19 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5570C3A67F5; Sun, 2 May 2010 02:58:18 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O8VoB-0003h4-Kw for namedroppers-data0@psg.com; Sun, 02 May 2010 09:49:55 +0000 Received: from [213.248.199.23] (helo=mx3.nominet.org.uk) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O8Vo5-0003gS-J3 for namedroppers@ops.ietf.org; Sun, 02 May 2010 09:49:49 +0000 DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:Received:From:To:CC:Subject: Thread-Topic:Thread-Index:Date:Message-ID:In-Reply-To: Accept-Language:Content-Language:X-MS-Has-Attach: X-MS-TNEF-Correlator:Content-Type:Content-ID: Content-Transfer-Encoding:MIME-Version; b=7N/d8LJye96E2F6Re/X1Z3FmAoswJBeMQ18MH06tc4EsX+Ma9BV8Jgu3 G7sgK2Riq+hVXMs7L20BTCMKTyicQ9Xx/Fydg8Xcdh0/o0yBLW1A6M84a IxKovWceCGJyo0L; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=Ray.Bellis@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1272793789; x=1304329789; h=from:sender:reply-to:subject:date:message-id:to:cc: mime-version:content-transfer-encoding:content-id: content-description:resent-date:resent-from:resent-sender: resent-to:resent-cc:resent-message-id:in-reply-to: references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:list-owner:list-archive; z=From:=20Ray=20Bellis=20 |Subject:=20Re:=20[dnsext]=20WGLC-Summary:=20TCP-requirem ents=20|Date:=20Sun,=202=20May=202010=2009:49:43=20+0000 |Message-ID:=20 |To:=20Paul=20Vixie=20|CC:=20namedroppers =20|MIME-Version:=201.0 |Content-Transfer-Encoding:=20quoted-printable |Content-ID:=20<13fad044-e96c-40e7-b75e-f391d3038714> |In-Reply-To:=20<98804.1272647896@nsa.vix.com>; bh=EoF5cO063AMe6bh2sCwUoYmW9AMQeuC0w4hNmXWgENM=; b=kaNTuzGmYnb57kGMlmcK2kT+WSFvHsrJQFghh3EcHQHZz40rY9FuvtMK dZZEFCjhe7c1aGQoHksMnmHMoZc9ysJnmuJuB8k4WVrRZMIBAQdr1QcHl WeTGstrbbJywKbd; X-IronPort-AV: E=Sophos;i="4.52,312,1270422000"; d="scan'208";a="23936461" Received: from host-213-248-197-145.nominet.org.uk (HELO wds-exc2.okna.nominet.org.uk) ([213.248.197.145]) by mx3.nominet.org.uk with ESMTP; 02 May 2010 10:49:47 +0100 Received: from WDS-EXC1.okna.nominet.org.uk ([fe80::1593:1394:a91f:8f5f]) by wds-exc2.okna.nominet.org.uk ([fe80::7577:eaca:5241:25d4%20]) with mapi; Sun, 2 May 2010 10:49:46 +0100 From: Ray Bellis To: Paul Vixie CC: namedroppers Subject: Re: [dnsext] WGLC-Summary: TCP-requirements Thread-Topic: [dnsext] WGLC-Summary: TCP-requirements Thread-Index: AQHK6It587XJ/oSX10y4YIQCMPn6gpI96H2A Date: Sun, 2 May 2010 09:49:43 +0000 Message-ID: In-Reply-To: <98804.1272647896@nsa.vix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="us-ascii" Content-ID: <13fad044-e96c-40e7-b75e-f391d3038714> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: =20 > no. that would be new work, not a clarification. FWIW, that's my position too, but as Editor I'm at the whim of the WG... > since the server can close based on connection congestion or other need, > the client should leave the connection open unless it has a reason to > close it, such as exiting an application or context, or for reasons > similar to the server's possible reasons (congestion). if streams of > queries from a client to a server are able to reuse a tcp session it'll > be great for everybody. i'd go further: if you have to open a tcp/53 > session you should make all possible attempts to reuse it for as long as > practical. Curiously, MarkA previously told me BIND does the opposite - it closes TCP connections just as soon as it's done with them (which is usually straight away). Ray From justforyou@053.silvermailings.com Sun May 2 14:00:17 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 33D033A6A2F for ; Sun, 2 May 2010 14:00:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.899 X-Spam-Level: **** X-Spam-Status: No, score=4.899 tagged_above=-999 required=5 tests=[AWL=0.181, BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, GB_I_LETTER=-2, GB_PHARMACY=1, HELO_DYNAMIC_IPADDR=2.426, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.097, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_FORGED_AMAZON=3, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_SBL=20, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 79qQ1-PaOEzc for ; Sun, 2 May 2010 14:00:12 -0700 (PDT) Received: from h-96-13-24-108.ip.alltel.net (h-96-13-24-108.ip.alltel.net [96.13.24.108]) by core3.amsl.com (Postfix) with SMTP id AC02D3A6ACA for ; Sun, 2 May 2010 13:59:52 -0700 (PDT) From: "Amazon.com Email Subscriptions" To: "dnsext-archive@lists.ietf.org" Subject: Amazon.com Deal of the Day X-AMAZON-MAIL-RELAY-TYPE: subscription X-AMAZON-RTE-VERSION: 2.0 MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100502210000.AC02D3A6ACA@core3.amsl.com> Date: Sun, 2 May 2010 13:59:52 -0700 (PDT)
Please click here if the e-mail below is not displayed correctly.
amazon.com
Free Two-Day Shipping with   › Amazon Prime
Your Amazon.com Today's Deals See All Departments
Tiffen Dfx Digital Filter Software V2
$149.95 $79.99 (47% off)
4.28571428571429
This Tiffen Dfx digital filter suite is a powerful but user-friendly stand alone application for still images. It offers a definitive set of digital optical filters, including simulations of many popular award-winning Tiffen glass filters, specialized lenses, optical lab processes, film grain, exacting color correction plus natural light and photographic effects, all in a controlled digital environment. Whether you are an amateur or professional photographer, a video or film editor, or graphic designer, Dfx's visual workflow and easy to use tools will help you create stunning images. Windows XP, Vista or Macintosh v10.4.6 and higher required for use.
Explore Other Great Gold Box Deals
Save $20 on Adobe Photoshop Elements 8
Great gift for Mom! Dbest Quick Cart
Lunar: Silver Star Harmony Limited Edition for $25.98
100 Albums for $5 Each
Save $20 on Adobe Photoshop Elements 8
$99.99 $59.99 (40% off)
 
 
Great gift for Mom! Dbest Quick Cart
$34.95 $29.99 (14% off)
 
 
Lunar: Silver Star Harmony Limited Edition for $25.98
$39.99 $25.98 (35% off)
 
 
100 Albums for $5 Each
 
Save up to $500 off the combined purchase of select Canon cameras and printers
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
Save $10 on "Alice in Wonderland Combo Pack"
Save up to 40% on Our Bestselling Fitness Products
Save up to $500 off the combined purchase of select Canon cameras and printers
 
 
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
 
 
Save $10 on "Alice in Wonderland Combo Pack"
 
 
Save up to 40% on Our Bestselling Fitness Products
 


This message was sent to the following e-mail address: dnsext-archive@lists.ietf.org

You're receiving this e-mail because you subscribed to Gold Box Deals. If you do not want any more e-mails of this kind, it's easy to unsubscribe.

Please note that product prices and availability are subject to change. Prices and availability were accurate at the time this newsletter was sent; however, they may differ from those you see when you visit Amazon.com. The List Price represents the full retail price listed on the product itself, suggested by the manufacturer or supplier, or estimated in accordance with standard industry practice. For items offered as a set, List Price may represent open-stock prices.

© 2010 Amazon.com. All rights reserved.
Amazon.com is a registered trademark of Amazon.com, Inc.
Amazon.com, 1200 12th Ave. S., Suite 1200, Seattle, WA 98144-2734.
Reference: 15067840
From jscott01l@alsde.edu Sun May 2 22:38:54 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F02BE3A6C14 for ; Sun, 2 May 2010 22:38:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -19.072 X-Spam-Level: X-Spam-Status: No, score=-19.072 tagged_above=-999 required=5 tests=[AWL=-9.884, BAYES_99=3.5, FH_RELAY_NODNS=1.451, GB_I_LETTER=-2, GB_PHARMACY=1, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.097, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, SARE_FORGED_AMAZON=3, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hk+aLlAbFX-J for ; Sun, 2 May 2010 22:38:45 -0700 (PDT) Received: from amacalert.com (unknown [122.167.43.201]) by core3.amsl.com (Postfix) with SMTP id 0AA993A6C11 for ; Sun, 2 May 2010 22:38:12 -0700 (PDT) From: "Amazon.com Email Subscriptions" To: "dnsext-archive@ietf.org" Subject: Amazon.com Deal of the Day X-AMAZON-MAIL-RELAY-TYPE: subscription X-AMAZON-RTE-VERSION: 2.0 MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100503053814.0AA993A6C11@core3.amsl.com> Date: Sun, 2 May 2010 22:38:12 -0700 (PDT)
Please click here if the e-mail below is not displayed correctly.
amazon.com
Free Two-Day Shipping with   › Amazon Prime
Your Amazon.com Today's Deals See All Departments
Tiffen Dfx Digital Filter Software V2
$149.95 $79.99 (47% off)
4.28571428571429
This Tiffen Dfx digital filter suite is a powerful but user-friendly stand alone application for still images. It offers a definitive set of digital optical filters, including simulations of many popular award-winning Tiffen glass filters, specialized lenses, optical lab processes, film grain, exacting color correction plus natural light and photographic effects, all in a controlled digital environment. Whether you are an amateur or professional photographer, a video or film editor, or graphic designer, Dfx's visual workflow and easy to use tools will help you create stunning images. Windows XP, Vista or Macintosh v10.4.6 and higher required for use.
Explore Other Great Gold Box Deals
Save $20 on Adobe Photoshop Elements 8
Great gift for Mom! Dbest Quick Cart
Lunar: Silver Star Harmony Limited Edition for $25.98
100 Albums for $5 Each
Save $20 on Adobe Photoshop Elements 8
$99.99 $59.99 (40% off)
 
 
Great gift for Mom! Dbest Quick Cart
$34.95 $29.99 (14% off)
 
 
Lunar: Silver Star Harmony Limited Edition for $25.98
$39.99 $25.98 (35% off)
 
 
100 Albums for $5 Each
 
Save up to $500 off the combined purchase of select Canon cameras and printers
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
Save $10 on "Alice in Wonderland Combo Pack"
Save up to 40% on Our Bestselling Fitness Products
Save up to $500 off the combined purchase of select Canon cameras and printers
 
 
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
 
 
Save $10 on "Alice in Wonderland Combo Pack"
 
 
Save up to 40% on Our Bestselling Fitness Products
 


This message was sent to the following e-mail address: dnsext-archive@ietf.org

You're receiving this e-mail because you subscribed to Gold Box Deals. If you do not want any more e-mails of this kind, it's easy to unsubscribe.

Please note that product prices and availability are subject to change. Prices and availability were accurate at the time this newsletter was sent; however, they may differ from those you see when you visit Amazon.com. The List Price represents the full retail price listed on the product itself, suggested by the manufacturer or supplier, or estimated in accordance with standard industry practice. For items offered as a set, List Price may represent open-stock prices.

© 2010 Amazon.com. All rights reserved.
Amazon.com is a registered trademark of Amazon.com, Inc.
Amazon.com, 1200 12th Ave. S., Suite 1200, Seattle, WA 98144-2734.
Reference: 15067840
From jep@afo.net Mon May 3 02:30:42 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 54CED28C0DC for ; Mon, 3 May 2010 02:30:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.862 X-Spam-Level: X-Spam-Status: No, score=-4.862 tagged_above=-999 required=5 tests=[AWL=-5.864, BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, GB_I_LETTER=-2, GB_PHARMACY=1, HELO_DYNAMIC_IPADDR2=4.395, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.097, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_FORGED_AMAZON=3, SARE_UNI=0.591, TVD_RCVD_IP=1.931, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ik2UnZTXF9FQ for ; Mon, 3 May 2010 02:30:34 -0700 (PDT) Received: from 87-97-192-91.2073266125.ddns-catv.pl.ekk.bg (87-97-192-91.2073266125.ddns-catv.pl.ekk.bg [87.97.192.91]) by core3.amsl.com (Postfix) with SMTP id 7D5833A6C5F for ; Mon, 3 May 2010 02:29:57 -0700 (PDT) From: "Amazon.com Email Subscriptions" To: "dnsext-archive@ietf.org" Subject: Amazon.com Deal of the Day X-AMAZON-MAIL-RELAY-TYPE: subscription X-AMAZON-RTE-VERSION: 2.0 MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100503092959.7D5833A6C5F@core3.amsl.com> Date: Mon, 3 May 2010 02:29:57 -0700 (PDT)
Please click here if the e-mail below is not displayed correctly.
amazon.com
Free Two-Day Shipping with   › Amazon Prime
Your Amazon.com Today's Deals See All Departments
Tiffen Dfx Digital Filter Software V2
$149.95 $79.99 (47% off)
4.28571428571429
This Tiffen Dfx digital filter suite is a powerful but user-friendly stand alone application for still images. It offers a definitive set of digital optical filters, including simulations of many popular award-winning Tiffen glass filters, specialized lenses, optical lab processes, film grain, exacting color correction plus natural light and photographic effects, all in a controlled digital environment. Whether you are an amateur or professional photographer, a video or film editor, or graphic designer, Dfx's visual workflow and easy to use tools will help you create stunning images. Windows XP, Vista or Macintosh v10.4.6 and higher required for use.
Explore Other Great Gold Box Deals
Save $20 on Adobe Photoshop Elements 8
Great gift for Mom! Dbest Quick Cart
Lunar: Silver Star Harmony Limited Edition for $25.98
100 Albums for $5 Each
Save $20 on Adobe Photoshop Elements 8
$99.99 $59.99 (40% off)
 
 
Great gift for Mom! Dbest Quick Cart
$34.95 $29.99 (14% off)
 
 
Lunar: Silver Star Harmony Limited Edition for $25.98
$39.99 $25.98 (35% off)
 
 
100 Albums for $5 Each
 
Save up to $500 off the combined purchase of select Canon cameras and printers
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
Save $10 on "Alice in Wonderland Combo Pack"
Save up to 40% on Our Bestselling Fitness Products
Save up to $500 off the combined purchase of select Canon cameras and printers
 
 
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
 
 
Save $10 on "Alice in Wonderland Combo Pack"
 
 
Save up to 40% on Our Bestselling Fitness Products
 


This message was sent to the following e-mail address: dnsext-archive@ietf.org

You're receiving this e-mail because you subscribed to Gold Box Deals. If you do not want any more e-mails of this kind, it's easy to unsubscribe.

Please note that product prices and availability are subject to change. Prices and availability were accurate at the time this newsletter was sent; however, they may differ from those you see when you visit Amazon.com. The List Price represents the full retail price listed on the product itself, suggested by the manufacturer or supplier, or estimated in accordance with standard industry practice. For items offered as a set, List Price may represent open-stock prices.

© 2010 Amazon.com. All rights reserved.
Amazon.com is a registered trademark of Amazon.com, Inc.
Amazon.com, 1200 12th Ave. S., Suite 1200, Seattle, WA 98144-2734.
Reference: 15067840
From lxw@acoulab.com Mon May 3 06:47:20 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CEC4828C1A8 for ; Mon, 3 May 2010 06:47:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -25.285 X-Spam-Level: X-Spam-Status: No, score=-25.285 tagged_above=-999 required=5 tests=[AWL=-2.555, BAYES_99=3.5, FH_RELAY_NODNS=1.451, GB_I_LETTER=-2, GB_PHARMACY=1, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.097, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RDNS_NONE=0.1, SARE_FORGED_AMAZON=3, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_RHS_DOB=1.083, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RcX-ZDTyb9au for ; Mon, 3 May 2010 06:47:18 -0700 (PDT) Received: from aachen.de (unknown [95.78.99.94]) by core3.amsl.com (Postfix) with SMTP id 773523A6CD9 for ; Mon, 3 May 2010 06:47:03 -0700 (PDT) From: "Amazon.com Email Subscriptions" To: "dnsext-archive@ietf.org" Subject: Amazon.com Deal of the Day X-AMAZON-MAIL-RELAY-TYPE: subscription X-AMAZON-RTE-VERSION: 2.0 MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100503134706.773523A6CD9@core3.amsl.com> Date: Mon, 3 May 2010 06:47:03 -0700 (PDT)
Please click here if the e-mail below is not displayed correctly.
amazon.com
Free Two-Day Shipping with   › Amazon Prime
Your Amazon.com Today's Deals See All Departments
Tiffen Dfx Digital Filter Software V2
$149.95 $79.99 (47% off)
4.28571428571429
This Tiffen Dfx digital filter suite is a powerful but user-friendly stand alone application for still images. It offers a definitive set of digital optical filters, including simulations of many popular award-winning Tiffen glass filters, specialized lenses, optical lab processes, film grain, exacting color correction plus natural light and photographic effects, all in a controlled digital environment. Whether you are an amateur or professional photographer, a video or film editor, or graphic designer, Dfx's visual workflow and easy to use tools will help you create stunning images. Windows XP, Vista or Macintosh v10.4.6 and higher required for use.
Explore Other Great Gold Box Deals
Save $20 on Adobe Photoshop Elements 8
Great gift for Mom! Dbest Quick Cart
Lunar: Silver Star Harmony Limited Edition for $25.98
100 Albums for $5 Each
Save $20 on Adobe Photoshop Elements 8
$99.99 $59.99 (40% off)
 
 
Great gift for Mom! Dbest Quick Cart
$34.95 $29.99 (14% off)
 
 
Lunar: Silver Star Harmony Limited Edition for $25.98
$39.99 $25.98 (35% off)
 
 
100 Albums for $5 Each
 
Save up to $500 off the combined purchase of select Canon cameras and printers
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
Save $10 on "Alice in Wonderland Combo Pack"
Save up to 40% on Our Bestselling Fitness Products
Save up to $500 off the combined purchase of select Canon cameras and printers
 
 
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
 
 
Save $10 on "Alice in Wonderland Combo Pack"
 
 
Save up to 40% on Our Bestselling Fitness Products
 


This message was sent to the following e-mail address: dnsext-archive@ietf.org

You're receiving this e-mail because you subscribed to Gold Box Deals. If you do not want any more e-mails of this kind, it's easy to unsubscribe.

Please note that product prices and availability are subject to change. Prices and availability were accurate at the time this newsletter was sent; however, they may differ from those you see when you visit Amazon.com. The List Price represents the full retail price listed on the product itself, suggested by the manufacturer or supplier, or estimated in accordance with standard industry practice. For items offered as a set, List Price may represent open-stock prices.

© 2010 Amazon.com. All rights reserved.
Amazon.com is a registered trademark of Amazon.com, Inc.
Amazon.com, 1200 12th Ave. S., Suite 1200, Seattle, WA 98144-2734.
Reference: 15067840
From mary.wehrer@americancrew.com Mon May 3 07:01:15 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 09A8228C1D2 for ; Mon, 3 May 2010 07:01:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.277 X-Spam-Level: X-Spam-Status: No, score=-6.277 tagged_above=-999 required=5 tests=[AWL=-4.700, BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, GB_I_LETTER=-2, GB_PHARMACY=1, HELO_DYNAMIC_IPADDR2=4.395, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.097, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_FORGED_AMAZON=3, SARE_UNI=0.591, TVD_RCVD_IP=1.931, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MxSpQ1A1k6DI for ; Mon, 3 May 2010 07:01:05 -0700 (PDT) Received: from 29-199-124-91.pool.ukrtel.net (29-199-124-91.pool.ukrtel.net [91.124.199.29]) by core3.amsl.com (Postfix) with SMTP id 8648E28C197 for ; Mon, 3 May 2010 07:00:40 -0700 (PDT) From: "Amazon.com Email Subscriptions" To: "dnsext-archive@ietf.org" Subject: Amazon.com Deal of the Day X-AMAZON-MAIL-RELAY-TYPE: subscription X-AMAZON-RTE-VERSION: 2.0 MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100503140042.8648E28C197@core3.amsl.com> Date: Mon, 3 May 2010 07:00:40 -0700 (PDT)
Please click here if the e-mail below is not displayed correctly.
amazon.com
Free Two-Day Shipping with   › Amazon Prime
Your Amazon.com Today's Deals See All Departments
Tiffen Dfx Digital Filter Software V2
$149.95 $79.99 (47% off)
4.28571428571429
This Tiffen Dfx digital filter suite is a powerful but user-friendly stand alone application for still images. It offers a definitive set of digital optical filters, including simulations of many popular award-winning Tiffen glass filters, specialized lenses, optical lab processes, film grain, exacting color correction plus natural light and photographic effects, all in a controlled digital environment. Whether you are an amateur or professional photographer, a video or film editor, or graphic designer, Dfx's visual workflow and easy to use tools will help you create stunning images. Windows XP, Vista or Macintosh v10.4.6 and higher required for use.
Explore Other Great Gold Box Deals
Save $20 on Adobe Photoshop Elements 8
Great gift for Mom! Dbest Quick Cart
Lunar: Silver Star Harmony Limited Edition for $25.98
100 Albums for $5 Each
Save $20 on Adobe Photoshop Elements 8
$99.99 $59.99 (40% off)
 
 
Great gift for Mom! Dbest Quick Cart
$34.95 $29.99 (14% off)
 
 
Lunar: Silver Star Harmony Limited Edition for $25.98
$39.99 $25.98 (35% off)
 
 
100 Albums for $5 Each
 
Save up to $500 off the combined purchase of select Canon cameras and printers
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
Save $10 on "Alice in Wonderland Combo Pack"
Save up to 40% on Our Bestselling Fitness Products
Save up to $500 off the combined purchase of select Canon cameras and printers
 
 
Save up to 25% on Sport Watches from Casio, Timex, and Armitron
 
 
Save $10 on "Alice in Wonderland Combo Pack"
 
 
Save up to 40% on Our Bestselling Fitness Products
 


This message was sent to the following e-mail address: dnsext-archive@ietf.org

You're receiving this e-mail because you subscribed to Gold Box Deals. If you do not want any more e-mails of this kind, it's easy to unsubscribe.

Please note that product prices and availability are subject to change. Prices and availability were accurate at the time this newsletter was sent; however, they may differ from those you see when you visit Amazon.com. The List Price represents the full retail price listed on the product itself, suggested by the manufacturer or supplier, or estimated in accordance with standard industry practice. For items offered as a set, List Price may represent open-stock prices.

© 2010 Amazon.com. All rights reserved.
Amazon.com is a registered trademark of Amazon.com, Inc.
Amazon.com, 1200 12th Ave. S., Suite 1200, Seattle, WA 98144-2734.
Reference: 15067840
From owner-namedroppers@ops.ietf.org Mon May 3 08:24:58 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 22B8B3A69A0; Mon, 3 May 2010 08:24:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.869 X-Spam-Level: X-Spam-Status: No, score=-0.869 tagged_above=-999 required=5 tests=[AWL=-0.870, BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0yGR8NrjYDA0; Mon, 3 May 2010 08:24:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3B60528C219; Mon, 3 May 2010 08:24:48 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O8xNV-000Abj-6o for namedroppers-data0@psg.com; Mon, 03 May 2010 15:16:13 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O8xNP-000Aay-C2 for namedroppers@ops.ietf.org; Mon, 03 May 2010 15:16:07 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 622F4A42CA for ; Mon, 3 May 2010 15:16:06 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers Subject: Re: [dnsext] WGLC-Summary: TCP-requirements In-Reply-To: Your message of "Sun, 02 May 2010 09:49:43 GMT." References: X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Mon, 03 May 2010 15:16:06 +0000 Message-ID: <78571.1272899766@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Ray Bellis > Date: Sun, 2 May 2010 09:49:43 +0000 > > Curiously, MarkA previously told me BIND does the opposite - it closes TCP > connections just as soon as it's done with them (which is usually straight > away). sorry, i was being pithy when i wrote: > the client should leave the connection open unless it has a reason to > close it, such as exiting an application or context, or for reasons > similar to the server's possible reasons (congestion). bind's context for an outbound tcp connection is very short lived. the work of keeping a connection pool and using them in a longer lived way isn't done but could be done. right now the rfc's don't make a recommendation in this area but if they did then bind would certainly comply with those. it's also possible that bind will try this out, since no rfc prohibits or discommends. From owner-namedroppers@ops.ietf.org Mon May 3 17:01:17 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 94F6E3A6AD1; Mon, 3 May 2010 17:01:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.027 X-Spam-Level: X-Spam-Status: No, score=-2.027 tagged_above=-999 required=5 tests=[AWL=0.573, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i8TE-I8ljs-v; Mon, 3 May 2010 17:01:17 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C361A3A69B1; Mon, 3 May 2010 17:01:16 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O95SV-0002xr-4s for namedroppers-data0@psg.com; Mon, 03 May 2010 23:53:55 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O95SP-0002xJ-I0 for namedroppers@ops.ietf.org; Mon, 03 May 2010 23:53:49 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 8FC30EA7BD; Mon, 3 May 2010 23:53:48 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o43NrYVX043903; Tue, 4 May 2010 09:53:35 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005032353.o43NrYVX043903@drugs.dv.isc.org> To: "George Barwood" Cc: "Olafur Gudmundsson" , "Andrew Sullivan" , namedroppers@ops.ietf.org From: Mark Andrews References: <20100409145117.GH3595@shinkuro.com> <4BC24639.7000202@ucd.ie> <2A18C28A42314CF4822ECCDD8E34B7D4@ics.forth.gr> <4BCF39D9.9090905@mail-abuse.org> <201004212314.o3LNEQKl069128@drugs.dv.isc.org> <20100422171521.GK1362@shinkuro.com> <201004230447.o3N4lsSv071899@drugs.dv.isc.org> <4BD21125.70307@ogud.com> <81C06DA3344D4876A4F95D818F5128BF@local> Subject: Re: [dnsext] Side effect of DNS control plane changes Re: BNAME, Synthesized CNAME, and DNSSEC In-reply-to: Your message of "Mon, 03 May 2010 16:59:56 +0100." <81C06DA3344D4876A4F95D818F5128BF@local> Date: Tue, 04 May 2010 09:53:34 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Setting AD on authoritative answers is a LOCAL POLICY decision. Accepting AD requires you to understand the LOCAL POLICY of the server that is sending the response. There is no security problem here. You either accept the LOCAL POLICY or you do your own validation. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From outplaysl6@omsk.avangard.ru Mon May 3 17:46:27 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 97D433A6D3D; Mon, 3 May 2010 17:46:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.145 X-Spam-Level: X-Spam-Status: No, score=-4.145 tagged_above=-999 required=5 tests=[AWL=-9.042, BAYES_99=3.5, FB_INCREASE_VOL=3.629, HELO_EQ_BR=0.955, HOST_EQ_BR=1.295, IMPOTENCE=1.886, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, SARE_SXLIFE=1.07, STOX_REPLY_TYPE=0.001, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_SBL=20, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7JG9I-Mw23jT; Mon, 3 May 2010 17:46:26 -0700 (PDT) Received: from 20151219215.user.veloxzone.com.br (20151219215.user.veloxzone.com.br [201.51.219.215]) by core3.amsl.com (Postfix) with ESMTP id 529FB3A6899; Mon, 3 May 2010 17:46:25 -0700 (PDT) Received: from 201.51.219.215 by mail.omsk.avangard.ru; Mon, 3 May 2010 21:45:24 -0300 Date: Mon, 3 May 2010 21:45:24 -0300 From: dnsext-archive@lists.ietf.org Subject: It's the only 100% natural sex pill that has no cardiovascular or physical side effects To: Message-ID: <000d01caeb23$151c9d60$6400a8c0@outplaysl6> MIME-Version: 1.0 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Mailer: Microsoft Outlook Express 6.00.2900.2180 Content-type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-transfer-encoding: 7bit X-Priority: 3 X-MSMail-priority: Normal Stop premature ejaculation & increase sperm volume – Impress your partner by shooting that sperm with more power and precision that ever before. http://helewehus.cn From dnsop-bounces@ietf.org Mon May 3 17:46:29 2010 Return-Path: X-Original-To: dnsext-archive@lists.ietf.org Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 567173A6D41 for ; Mon, 3 May 2010 17:46:29 -0700 (PDT) Subject: The results of your email commands From: dnsop-bounces@ietf.org To: dnsext-archive@lists.ietf.org MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0910439231==" Message-ID: Date: Mon, 03 May 2010 17:46:28 -0700 Precedence: bulk X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.9 List-Id: IETF DNSOP WG mailing list X-List-Administrivia: yes Sender: dnsop-bounces@ietf.org Errors-To: dnsop-bounces@ietf.org --===============0910439231== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit The results of your email command are provided below. Attached is your original message. No commands were found in this message. To obtain instructions, send a message containing just the word "help". - Done. --===============0910439231== Content-Type: message/rfc822 MIME-Version: 1.0 Return-Path: X-Original-To: dnsop-request@core3.amsl.com Delivered-To: dnsop-request@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 97D433A6D3D; Mon, 3 May 2010 17:46:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.145 X-Spam-Level: X-Spam-Status: No, score=-4.145 tagged_above=-999 required=5 tests=[AWL=-9.042, BAYES_99=3.5, FB_INCREASE_VOL=3.629, HELO_EQ_BR=0.955, HOST_EQ_BR=1.295, IMPOTENCE=1.886, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, SARE_SXLIFE=1.07, STOX_REPLY_TYPE=0.001, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_SBL=20, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7JG9I-Mw23jT; Mon, 3 May 2010 17:46:26 -0700 (PDT) Received: from 20151219215.user.veloxzone.com.br (20151219215.user.veloxzone.com.br [201.51.219.215]) by core3.amsl.com (Postfix) with ESMTP id 529FB3A6899; Mon, 3 May 2010 17:46:25 -0700 (PDT) Received: from 201.51.219.215 by mail.omsk.avangard.ru; Mon, 3 May 2010 21:45:24 -0300 Date: Mon, 3 May 2010 21:45:24 -0300 From: dnsext-archive@lists.ietf.org Subject: It's the only 100% natural sex pill that has no cardiovascular or physical side effects To: Message-ID: <000d01caeb23$151c9d60$6400a8c0@outplaysl6> MIME-Version: 1.0 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Mailer: Microsoft Outlook Express 6.00.2900.2180 Content-type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-transfer-encoding: 7bit X-Priority: 3 X-MSMail-priority: Normal Stop premature ejaculation & increase sperm volume – Impress your partner by shooting that sperm with more power and precision that ever before. http://helewehus.cn --===============0910439231==-- From outplaysl6@omsk.avangard.ru Mon May 3 17:46:27 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 97D433A6D3D; Mon, 3 May 2010 17:46:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.145 X-Spam-Level: X-Spam-Status: No, score=-4.145 tagged_above=-999 required=5 tests=[AWL=-9.042, BAYES_99=3.5, FB_INCREASE_VOL=3.629, HELO_EQ_BR=0.955, HOST_EQ_BR=1.295, IMPOTENCE=1.886, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, SARE_SXLIFE=1.07, STOX_REPLY_TYPE=0.001, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_SBL=20, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7JG9I-Mw23jT; Mon, 3 May 2010 17:46:26 -0700 (PDT) Received: from 20151219215.user.veloxzone.com.br (20151219215.user.veloxzone.com.br [201.51.219.215]) by core3.amsl.com (Postfix) with ESMTP id 529FB3A6899; Mon, 3 May 2010 17:46:25 -0700 (PDT) Received: from 201.51.219.215 by mail.omsk.avangard.ru; Mon, 3 May 2010 21:45:24 -0300 Date: Mon, 3 May 2010 21:45:24 -0300 From: dnsext-archive@lists.ietf.org Subject: It's the only 100% natural sex pill that has no cardiovascular or physical side effects To: Message-ID: <000d01caeb23$151c9d60$6400a8c0@outplaysl6> MIME-Version: 1.0 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Mailer: Microsoft Outlook Express 6.00.2900.2180 Content-type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-transfer-encoding: 7bit X-Priority: 3 X-MSMail-priority: Normal Stop premature ejaculation & increase sperm volume – Impress your partner by shooting that sperm with more power and precision that ever before. http://helewehus.cn From owner-namedroppers@ops.ietf.org Tue May 4 00:07:25 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5B47D3A67D1; Tue, 4 May 2010 00:07:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.047 X-Spam-Level: X-Spam-Status: No, score=-2.047 tagged_above=-999 required=5 tests=[AWL=0.552, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aPTqbcNYTMUC; Tue, 4 May 2010 00:07:24 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 31B8E3A67A2; Tue, 4 May 2010 00:07:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9C8G-000M7Q-KP for namedroppers-data0@psg.com; Tue, 04 May 2010 07:01:28 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9C8A-000M6d-Bc for namedroppers@ops.ietf.org; Tue, 04 May 2010 07:01:22 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 4CDC1EA862; Tue, 4 May 2010 07:01:20 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4471Cep054294; Tue, 4 May 2010 17:01:12 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005040701.o4471Cep054294@drugs.dv.isc.org> To: "George Barwood" Cc: namedroppers@ops.ietf.org, =?iso-8859-1?Q?=D3lafur_Gu=F0mundsson_/DNSEXT__chair?= , "Andrew Sullivan" From: Mark Andrews References: <2ADB0ACEB9554760821CE5B271B3505C@local> Subject: Re: [dnsext] RFC 4035 section 3.1.6 In-reply-to: Your message of "Tue, 04 May 2010 07:19:54 +0100." <2ADB0ACEB9554760821CE5B271B3505C@local> Date: Tue, 04 May 2010 17:01:12 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <2ADB0ACEB9554760821CE5B271B3505C@local>, "George Barwood" writes: > [ Apologies for my last message being posted on the wrong thread ...] > > ----- Original Message ----- > From: "Mark Andrews" > To: "George Barwood" > Cc: "Olafur Gudmundsson" ; "Andrew Sullivan" ; > Sent: Tuesday, May 04, 2010 12:53 AM > Subject: Re: [dnsext] Side effect of DNS control plane changes Re: BNAME, Synthesized CNAME, and DNSSEC > > > > > > Setting AD on authoritative answers is a LOCAL POLICY decision. > > Accepting AD requires you to understand the LOCAL POLICY of the > > server that is sending the response. > > > > There is no security problem here. You either accept the LOCAL > > POLICY or you do your own validation. > > But the standard should be specifying the default behavior for a validating > implementation. > > Do we agree that the default behavior for a slave zone obtained by AXFR is > that DNSSEC authentication MUST be performed using configured trust anchors > when responding to recursive queries? No, I don't agree. > And if that's so, surely the standard should make this clear? ( I say it doesn't ) > > George -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue May 4 00:50:20 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 081D53A68E6; Tue, 4 May 2010 00:50:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.066 X-Spam-Level: X-Spam-Status: No, score=-2.066 tagged_above=-999 required=5 tests=[AWL=0.533, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2OJkAA0WMt1i; Tue, 4 May 2010 00:50:19 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0A0FF3A67AE; Tue, 4 May 2010 00:50:19 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9Cq2-00022r-IZ for namedroppers-data0@psg.com; Tue, 04 May 2010 07:46:42 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9Cpw-00022B-DM for namedroppers@ops.ietf.org; Tue, 04 May 2010 07:46:36 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 76459EA86E; Tue, 4 May 2010 07:46:35 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o447kWdH054589; Tue, 4 May 2010 17:46:32 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005040746.o447kWdH054589@drugs.dv.isc.org> To: "George Barwood" Cc: namedroppers@ops.ietf.org, =?iso-8859-1?Q?=D3lafur_Gu=F0mundsson_/DNSEXT__chair?= , "Andrew Sullivan" From: Mark Andrews References: <2ADB0ACEB9554760821CE5B271B3505C@local> <201005040701.o4471Cep054294@drugs.dv.isc.org> <8ACD3C15A81A41ADABF7ED33436D68F3@local> Subject: Re: [dnsext] RFC 4035 section 3.1.6 In-reply-to: Your message of "Tue, 04 May 2010 08:30:57 +0100." <8ACD3C15A81A41ADABF7ED33436D68F3@local> Date: Tue, 04 May 2010 17:46:32 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <8ACD3C15A81A41ADABF7ED33436D68F3@local>, "George Barwood" writes: > > ----- Original Message ----- > From: "Mark Andrews" > To: "George Barwood" > Cc: ; "Ólafur Guðmundsson /DNSEXT chair" ; "Andrew Sullivan" > Sent: Tuesday, May 04, 2010 8:01 AM > Subject: Re: [dnsext] RFC 4035 section 3.1.6 > > > > > > In message <2ADB0ACEB9554760821CE5B271B3505C@local>, "George Barwood" writes: > >> [ Apologies for my last message being posted on the wrong thread ...] > >> > >> ----- Original Message ----- > >> From: "Mark Andrews" > >> To: "George Barwood" > >> Cc: "Olafur Gudmundsson" ; "Andrew Sullivan" ; > >> Sent: Tuesday, May 04, 2010 12:53 AM > >> Subject: Re: [dnsext] Side effect of DNS control plane changes Re: BNAME, Synthesized CNAME, and DNSSEC > >> > >> > >> > > >> > Setting AD on authoritative answers is a LOCAL POLICY decision. > >> > Accepting AD requires you to understand the LOCAL POLICY of the > >> > server that is sending the response. > >> > > >> > There is no security problem here. You either accept the LOCAL > >> > POLICY or you do your own validation. > >> > >> But the standard should be specifying the default behavior for a validating > >> implementation. > >> > >> Do we agree that the default behavior for a slave zone obtained by AXFR is > >> that DNSSEC authentication MUST be performed using configured trust anchors > >> when responding to recursive queries? > > > > No, I don't agree. > > Doesn't that allow unpleasant, unpredictable side-effects for applications > depending on DNSSEC for security? No. Applications that are depending on DNSSEC for security should be validating their own answers. This has always been the goal from day one. Validation in the recursive server is primarly there to protect the server itself. The secondary benefit is that it protects non-DNSSEC aware clients. > Suppose I configure a server to use it's own DNS service for resolving local > queries. > > An application running on that server may have DNSSEC as a requirement > ( looking forward to the days when DNSSEC is universally available ). > > Now when an administrator adds a new AXFR slave zone, that zone is no > longer secure for the application. Either the DNS service returns AD=1 > "lies" (so there is an illusion of security), or it stops setting AD=1, > and the application fails ( because it is depending on AD=1 to proceed ). > > To allow this possibility seems a very bad idea to me. > > Regards, > George -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue May 4 02:36:26 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 72A3D3A69E6; Tue, 4 May 2010 02:36:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.084 X-Spam-Level: X-Spam-Status: No, score=-2.084 tagged_above=-999 required=5 tests=[AWL=0.515, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RvH3nCGdGd2W; Tue, 4 May 2010 02:36:25 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6669C3A69CB; Tue, 4 May 2010 02:36:25 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9ESV-000Gyy-8F for namedroppers-data0@psg.com; Tue, 04 May 2010 09:30:31 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9ESP-000GxP-DQ for namedroppers@ops.ietf.org; Tue, 04 May 2010 09:30:25 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id C40A5EA88F for ; Tue, 4 May 2010 09:30:24 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o449UH0O055474 for ; Tue, 4 May 2010 19:30:22 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005040930.o449UH0O055474@drugs.dv.isc.org> To: namedroppers@ops.ietf.org From: Mark Andrews References: <2ADB0ACEB9554760821CE5B271B3505C@local> <201005040701.o4471Cep054294@drugs.dv.isc.org> <8ACD3C15A81A41ADABF7ED33436D68F3@local> <201005040746.o447kWdH054589@drugs.dv.isc.org> <1DA3B92B08DF4E0EB4264FBE8090C2BC@local> Subject: Re: [dnsext] RFC 4035 section 3.1.6 In-reply-to: Your message of "Tue, 04 May 2010 09:32:09 +0100." <1DA3B92B08DF4E0EB4264FBE8090C2BC@local> Date: Tue, 04 May 2010 19:30:17 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <1DA3B92B08DF4E0EB4264FBE8090C2BC@local>, "George Barwood" writes: > That's a valid configuration. However the standard makes it clear > ( http://tools.ietf.org/html/rfc4035#section-4.9 ) that depending > on a trusted security-aware recursive name server via a secure channel > is also a valid configuation. Indeed this is precisely why the AD bit exists. And if you choose to use AD then you need to understand its limitations or configure the recursive server to always validate. There is no MUST here. Accept "aa" or "ad" is a reasonable policy for a DNSSEC aware client. Remember authoritative servers and caches have very different temporal behaviours and trying to force DNSSEC validation constraints, which are essentially cache constraints, onto a authoritative data space is a bad idea. You can't just validate the authoritatve data and set a flag. The validation times out. named has match-recursive as one of the view selection criteria just because it is such a bad idea. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue May 4 04:51:53 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 52B5D3A6B3B; Tue, 4 May 2010 04:51:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.105 X-Spam-Level: ** X-Spam-Status: No, score=2.105 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tl3a8EzRF-Z7; Tue, 4 May 2010 04:51:52 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5C5943A6BEE; Tue, 4 May 2010 04:45:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9GUe-0008R8-TE for namedroppers-data0@psg.com; Tue, 04 May 2010 11:40:52 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9GUY-0008QY-Cq for namedroppers@ops.ietf.org; Tue, 04 May 2010 11:40:46 +0000 Received: from dhcp-24-128.ripemtg.ripe.net (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o44BeWx3043011; Tue, 4 May 2010 07:40:34 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [193.0.24.128] by dhcp-24-128.ripemtg.ripe.net (PGP Universal service); Tue, 04 May 2010 13:40:41 +0200 X-PGP-Universal: processed; by dhcp-24-128.ripemtg.ripe.net on Tue, 04 May 2010 13:40:41 +0200 Mime-Version: 1.0 Message-Id: In-Reply-To: <50A0A4E878F14CABA5A0DCE4B87A2ABF@local> References: <2ADB0ACEB9554760821CE5B271B3505C@local> <201005040701.o4471Cep054294@drugs.dv.isc.org> <8ACD3C15A81A41ADABF7ED33436D68F3@local> <201005040746.o447kWdH054589@drugs.dv.isc.org> <1DA3B92B08DF4E0EB4264FBE8090C2BC@local> <201005040930.o449UH0O055474@drugs.dv.isc.org> <50A0A4E878F14CABA5A0DCE4B87A2ABF@local> Date: Tue, 4 May 2010 13:40:30 +0200 To: From: Edward Lewis Subject: Re: [dnsext] RFC 4035 section 3.1.6 Cc: ed.lewis@neustar.biz Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 12:09 +0100 5/4/10, George Barwood wrote: >My point is that a server MUST (IMO, by default at least) either >offer validated resolution, or not. Let me replay something: At 23:05 +0100 4/20/10, George Barwood wrote: >----- Original Message ----- >From: "Edward Lewis" >To: "George Barwood" >Cc: >Sent: Tuesday, April 20, 2010 7:59 PM >Subject: Re: [dnsext] RFC 4035 section 3.1.6 - security hole? > >> I'd encourage you to look at this page: >> http://www.ops.ietf.org/lists/namedroppers/namedroppers.2001/threads.html >> >> and pull up all of the messages with this in the subject line: >> I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt >> >> There are 80 of them. > >I looked at about 20 or so quickly. >Obviously this was a contentious issue for some reason that I cannot fathom. >It's quite bizarre to have end-to-end security with unpredictable exceptions. >Hopefully no actual implementations do this, I'd certainly classify it >as a major security bug. I didn't reply to that message because I there was no logical response that I felt was within the rules and bounds of the charter of this WG. But since you continue to bring this up, I'll reply to that by saying, you only read maybe 25% of the background material by your estimate. From that you can hardly be expected to have gotten sufficient background. You've been given a pointer to information - follow it. Secondly, you say "for some reason I cannot fathom" and then go on to "certainly classify is as a major security bug." I don't want to make this personal at all, but that sort of logic is hard to respond to in a rational way. If you cannot grasp the issue, then how can you come to a conclusion? The point is, in the past (year 2001) the WG debated this point at length and consensus was reached to have authoritative servers not DNSSEC validate data on input yet allow them to set the AD bit. It would be reasonable to question the decision, and possibly reverse it based on new information. However, you are saying that you ignored exploring all of the archive material and declare this to be the wrong decision. To have any sway on this, demonstrate that you understand why it is the way it is, and what has happened in the past 9 years that should change the consensus. You are only saying that the documents do not support your thought. That is with the good reason that the current consensus, which hasn't changed in nearly a decade, disagrees with your claim. You are not going to see documents changed without changing consensus, and you are not even on that road. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Wouldn't it be nice if all of the definitions of equivalence were the same? From owner-namedroppers@ops.ietf.org Tue May 4 04:58:59 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 556033A6B61; Tue, 4 May 2010 04:58:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.85 X-Spam-Level: X-Spam-Status: No, score=-0.85 tagged_above=-999 required=5 tests=[AWL=-0.851, BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qbZejdg83HFv; Tue, 4 May 2010 04:58:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B13BD3A6BF0; Tue, 4 May 2010 04:57:07 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9Gfo-000A3P-TY for namedroppers-data0@psg.com; Tue, 04 May 2010 11:52:25 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9Gfj-000A2p-7C for namedroppers@ops.ietf.org; Tue, 04 May 2010 11:52:19 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id F2C93A4466; Tue, 4 May 2010 11:52:17 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: "George Barwood" cc: namedroppers@ops.ietf.org, "Mark Andrews" Subject: Re: [dnsext] RFC 4035 section 3.1.6 In-Reply-To: Your message of "Tue, 04 May 2010 12:09:57 +0100." <50A0A4E878F14CABA5A0DCE4B87A2ABF@local> References: <2ADB0ACEB9554760821CE5B271B3505C@local> <201005040701.o4471Cep054294@drugs.dv.isc.org> <8ACD3C15A81A41ADABF7ED33436D68F3@local> <201005040746.o447kWdH054589@drugs.dv.isc.org> <1DA3B92B08DF4E0EB4264FBE8090C2BC@local> <201005040930.o449UH0O055474@drugs.dv.isc.org> <50A0A4E878F14CABA5A0DCE4B87A2ABF@local> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Tue, 04 May 2010 11:52:17 +0000 Message-ID: <30368.1272973937@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: "George Barwood" > Date: Tue, 4 May 2010 12:09:57 +0100 > > My point is that a server MUST (IMO, by default at least) either offer > validated resolution, or not. i disagree. > Having configurations where validation sometimes occurs (relative to the > configured trust anchors) but not for all zones, is asking for trouble - > it's confusing and dangerous. i agree but the point is irrelevant. > A proper implementation will keep the recursive and authoritative > services logically separate, so there is no externally visible > interaction between them. that's not the issue. > Regards, > - George the definition of the relationship between a stub and recursive does not include security other than dnssec itself. while many stubs will ask for and many recursives will provide other forms of security, such as TSIG to protect the channel and AA/AD to signal certitude, that's not in the spec and so, the setting and checking and meaning of the AD bit is unspec'd. if you want to define that AD means a given certitude when set by a validating recursive in a response to a stub, then you'll also have to require some channel security to protect this bit from spoofers. that's new work, not part of the dnssec effort to date. marka has tried for about the last 36 hours to explain this to you and i wish you would read what he's telling you. dnssec applications should be doing their own validation because their recursive and stub resolvers should be dnssec-aware and all the metadata should be available end-to-end. note, there are weaknesses in the model, and but not the one you've been questioning in this thread. the real weaknesses are that dnssec-unaware recursives obstruct stub/application layer validation, and separately, per dan kaminsky who first told me this, we need a way to ask for the full certification chain in one message, so that stub/recursive RTT does not become a barrier to stub/application validation. From owner-namedroppers@ops.ietf.org Tue May 4 07:33:24 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8236C28C16E; Tue, 4 May 2010 07:33:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.699 X-Spam-Level: X-Spam-Status: No, score=-0.699 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VoO7HBTa0Lht; Tue, 4 May 2010 07:33:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 02CC828C184; Tue, 4 May 2010 07:30:28 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9J3v-0006Nq-UX for namedroppers-data0@psg.com; Tue, 04 May 2010 14:25:27 +0000 Received: from [131.111.8.133] (helo=ppsw-33.csi.cam.ac.uk) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9J3q-0006MY-1V for namedroppers@ops.ietf.org; Tue, 04 May 2010 14:25:22 +0000 X-Cam-AntiVirus: no malware found X-Cam-SpamDetails: not scanned X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/ Received: from hermes-2.csi.cam.ac.uk ([131.111.8.54]:38844) by ppsw-33.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.159]:25) with esmtpa (EXTERNAL:cet1) id 1O9J3o-0008LC-BN (Exim 4.70) (return-path ); Tue, 04 May 2010 15:25:20 +0100 Received: from prayer by hermes-2.csi.cam.ac.uk (hermes.cam.ac.uk) with local (PRAYER:cet1) id 1O9J3o-0003ER-Gf (Exim 4.67) (return-path ); Tue, 04 May 2010 15:25:20 +0100 Received: from [131.111.11.47] by webmail.hermes.cam.ac.uk with HTTP (Prayer-1.3.2); 04 May 2010 15:25:19 +0100 Date: 04 May 2010 15:25:19 +0100 From: Chris Thompson To: Paul Vixie Cc: namedroppers@ops.ietf.org Reply-To: cet1@cam.ac.uk Subject: Re: [dnsext] RFC 4035 section 3.1.6 Message-ID: In-Reply-To: <30368.1272973937@nsa.vix.com> References: <2ADB0ACEB9554760821CE5B271B3505C@local> <201005040701.o4471Cep054294@drugs.dv.isc.org> <8ACD3C15A81A41ADABF7ED33436D68F3@local> <201005040746.o447kWdH054589@drugs.dv.isc.org> <1DA3B92B08DF4E0EB4264FBE8090C2BC@local> <201005040930.o449UH0O055474@drugs.dv.isc.org> <50A0A4E878F14CABA5A0DCE4B87A2ABF@local> <30368.1272973937@nsa.vix.com> X-Mailer: Prayer v1.3.2 Mime-Version: 1.0 Content-Type: text/plain; format=flowed; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 4 2010, Paul Vixie wrote: >[...] and separately, >per dan kaminsky who first told me this, we need a way to ask for the full >certification chain in one message, so that stub/recursive RTT does not >become a barrier to stub/application validation. Shouldn't that be *a* (rather than *the*) full certification chain? The stub/application might have different ideas about what constitutes an acceptable trust anchor than the recursive server does. -- Chris Thompson University of Cambridge Computing Service, Email: cet1@ucs.cam.ac.uk New Museums Site, Cambridge CB2 3QH, Phone: +44 1223 334715 United Kingdom. From owner-namedroppers@ops.ietf.org Tue May 4 07:53:57 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DE1ED3A6C77; Tue, 4 May 2010 07:53:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.832 X-Spam-Level: X-Spam-Status: No, score=-1.832 tagged_above=-999 required=5 tests=[AWL=0.167, BAYES_00=-2.599, J_CHICKENPOX_31=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id paZwlX-QP6Xq; Tue, 4 May 2010 07:53:56 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 550733A6940; Tue, 4 May 2010 07:53:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9JQg-0009qM-Ry for namedroppers-data0@psg.com; Tue, 04 May 2010 14:48:58 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9JQa-0009oN-Sa for namedroppers@ops.ietf.org; Tue, 04 May 2010 14:48:52 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 72A5DA449C for ; Tue, 4 May 2010 14:48:52 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] RFC 4035 section 3.1.6 In-Reply-To: Your message of "04 May 2010 15:25:19 +0100." References: <2ADB0ACEB9554760821CE5B271B3505C@local> <201005040701.o4471Cep054294@drugs.dv.isc.org> <8ACD3C15A81A41ADABF7ED33436D68F3@local> <201005040746.o447kWdH054589@drugs.dv.isc.org> <1DA3B92B08DF4E0EB4264FBE8090C2BC@local> <201005040930.o449UH0O055474@drugs.dv.isc.org> <50A0A4E878F14CABA5A0DCE4B87A2ABF@local> <30368.1272973937@nsa.vix.com> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Tue, 04 May 2010 14:48:52 +0000 Message-ID: <37887.1272984532@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: 04 May 2010 15:25:19 +0100 > From: Chris Thompson > > Shouldn't that be *a* (rather than *the*) full certification chain? The > stub/application might have different ideas about what constitutes an > acceptable trust anchor than the recursive server does. there's no way for the responder to know what this would be. i think we should have a way to send all metadata that can be used to validate the answer, so for example if there are two keys in .COM that sign VIX.COM DS, and two keys in .VIX.COM that sign WWW.VIX.COM AAAA, then the stub/app ought to have a way to request, in one round trip, a security blob having: . DNSKEY ;KSK . DNSKEY ;ZSK . RRSIG(DNSKEY) ;ZSK by KSK COM DS COM RRSIG(DS) COM DNSKEY ;KSK COM DNSKEY ;ZSK#1 COM DNSKEY ;ZSK#2 COM RRSIG(DNSKEY) ;ZSK#1 by KSK COM RRSIG(DNSKEY) ;ZSK#2 by KSK VIX.COM DS VIX.COM RRSIG(DS) VIX.COM DNSKEY ;KSK VIX.COM DNSKEY ;ZSK#1 VIX.COM DNSKEY ;ZSK#2 VIX.COM RRSIG(DNSKEY) ;ZSK#1 by KSK VIX.COM RRSIG(DNSKEY) ;ZSK#2 by KSK WWW.VIX.COM RRSIG(AAAA) ;by ZSK#1 WWW.VIX.COM RRSIG(AAAA) ;by ZSK#2 we'd expect an EDNS buffer size of 32K or 64K to be nec'y, or even TCP, to carry all this in one transaction. but it's otherwise a whole lot of separate transactions to pull that stuff in one metadata-rrset at a time, only to have the noncaching stub throw it all away before the start of its next work unit. From owner-namedroppers@ops.ietf.org Tue May 4 08:17:50 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A830728C155; Tue, 4 May 2010 08:17:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.437 X-Spam-Level: X-Spam-Status: No, score=-4.437 tagged_above=-999 required=5 tests=[AWL=0.011, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, J_CHICKENPOX_31=0.6, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8ojHQ1GTuZkf; Tue, 4 May 2010 08:17:49 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id EDBD028C162; Tue, 4 May 2010 08:15:48 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9Jn4-000DM9-Da for namedroppers-data0@psg.com; Tue, 04 May 2010 15:12:06 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9Jmy-000DLZ-Op for namedroppers@ops.ietf.org; Tue, 04 May 2010 15:12:00 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id o44FBfsO015785; Tue, 4 May 2010 08:11:41 -0700 (PDT) References: <2ADB0ACEB9554760821CE5B271B3505C@local> <201005040701.o4471Cep054294@drugs.dv.isc.org> <8ACD3C15A81A41ADABF7ED33436D68F3@local> <201005040746.o447kWdH054589@drugs.dv.isc.org> <1DA3B92B08DF4E0EB4264FBE8090C2BC@local> <201005040930.o449UH0O055474@drugs.dv.isc.org> <50A0A4E878F14CABA5A0DCE4B87A2ABF@local> <30368.1272973937@nsa.vix.com> <37887.1272984532@nsa.vix.com> In-Reply-To: <37887.1272984532@nsa.vix.com> Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii Message-Id: <7D7CC5E9-DD2F-4A2C-8EB4-E324FAEC70A2@icsi.berkeley.edu> Content-Transfer-Encoding: quoted-printable Cc: Nicholas Weaver , namedroppers@ops.ietf.org From: Nicholas Weaver Subject: Re: [dnsext] RFC 4035 section 3.1.6 Date: Tue, 4 May 2010 08:11:41 -0700 To: Paul Vixie X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 4, 2010, at 7:48 AM, Paul Vixie wrote: > we'd expect an EDNS buffer size of 32K or 64K to be nec'y, or even = TCP, to > carry all this in one transaction. but it's otherwise a whole lot of = separate > transactions to pull that stuff in one metadata-rrset at a time, only = to have > the noncaching stub throw it all away before the start of its next = work unit. Stupid question: Who cares if its spread across multiple transactions if = the stub fetches the transactions in parallel? From owner-namedroppers@ops.ietf.org Tue May 4 08:39:00 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E17B728C106; Tue, 4 May 2010 08:39:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.206 X-Spam-Level: X-Spam-Status: No, score=-1.206 tagged_above=-999 required=5 tests=[AWL=-0.466, BAYES_20=-0.74] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kAnO7oDevm87; Tue, 4 May 2010 08:39:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DE4AD3A6C7B; Tue, 4 May 2010 08:38:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9K6S-000G36-79 for namedroppers-data0@psg.com; Tue, 04 May 2010 15:32:08 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9K6M-000G2S-KZ for namedroppers@ops.ietf.org; Tue, 04 May 2010 15:32:02 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 621AEA44AC for ; Tue, 4 May 2010 15:32:02 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] RFC 4035 section 3.1.6 In-Reply-To: Your message of "Tue, 04 May 2010 08:11:41 MST." <7D7CC5E9-DD2F-4A2C-8EB4-E324FAEC70A2@icsi.berkeley.edu> References: <2ADB0ACEB9554760821CE5B271B3505C@local> <201005040701.o4471Cep054294@drugs.dv.isc.org> <8ACD3C15A81A41ADABF7ED33436D68F3@local> <201005040746.o447kWdH054589@drugs.dv.isc.org> <1DA3B92B08DF4E0EB4264FBE8090C2BC@local> <201005040930.o449UH0O055474@drugs.dv.isc.org> <50A0A4E878F14CABA5A0DCE4B87A2ABF@local> <30368.1272973937@nsa.vix.com> <37887.1272984532@nsa.vix.com> <7D7CC5E9-DD2F-4A2C-8EB4-E324FAEC70A2@icsi.berkeley.edu> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Tue, 04 May 2010 15:32:02 +0000 Message-ID: <39761.1272987122@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Nicholas Weaver > Date: Tue, 4 May 2010 08:11:41 -0700 > > Stupid question: Who cares if its spread across multiple transactions if > the stub fetches the transactions in parallel? well, i don't know if it's a stupid question or not. many stubs are in embedded systems that don't allow a lot of parallelism, and the per-packet cost may be notable compared to the per-octet cost of transporting it, and the opportunity to cause congestion is better with asynchronous responses than a single big response. (i'm thinking about WRED here.) but the most important reason why i can't expect to parallelize these fetches is that a stub/app might not know to look in DLV unless the server can mention DLV in a full-chain answer. (DLV isn't part of the standard so it won't affect this WG's deliberations, but it does affect my own thinking.) From owner-namedroppers@ops.ietf.org Tue May 4 09:05:10 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2473A3A6C92; Tue, 4 May 2010 09:05:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.105 X-Spam-Level: ** X-Spam-Status: No, score=2.105 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a+OEmUeZKxYx; Tue, 4 May 2010 09:05:09 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 656D93A6C98; Tue, 4 May 2010 09:05:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9KXi-000Jz3-4M for namedroppers-data0@psg.com; Tue, 04 May 2010 16:00:18 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9KXc-000Jxu-3J for namedroppers@ops.ietf.org; Tue, 04 May 2010 16:00:12 +0000 Received: from dhcp-24-128.ripemtg.ripe.net (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o44G02BL045282; Tue, 4 May 2010 12:00:03 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [193.0.24.128] by dhcp-24-128.ripemtg.ripe.net (PGP Universal service); Tue, 04 May 2010 18:00:08 +0200 X-PGP-Universal: processed; by dhcp-24-128.ripemtg.ripe.net on Tue, 04 May 2010 18:00:08 +0200 Mime-Version: 1.0 Message-Id: In-Reply-To: <39761.1272987122@nsa.vix.com> References: <2ADB0ACEB9554760821CE5B271B3505C@local> <201005040701.o4471Cep054294@drugs.dv.isc.org> <8ACD3C15A81A41ADABF7ED33436D68F3@local> <201005040746.o447kWdH054589@drugs.dv.isc.org> <1DA3B92B08DF4E0EB4264FBE8090C2BC@local> <201005040930.o449UH0O055474@drugs.dv.isc.org> <50A0A4E878F14CABA5A0DCE4B87A2ABF@local> <30368.1272973937@nsa.vix.com> <37887.1272984532@nsa.vix.com> <7D7CC5E9-DD2F-4A2C-8EB4-E324FAEC70A2@icsi.berkeley.edu> <39761.1272987122@nsa.vix.com> Date: Tue, 4 May 2010 17:59:59 +0200 To: namedroppers@ops.ietf.org From: Edward Lewis Subject: Proving a validation was Re: [dnsext] RFC 4035 section 3.1.6 Cc: ed.lewis@neustar.biz Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 15:32 +0000 5/4/10, Paul Vixie wrote: >> From: Nicholas Weaver >> Date: Tue, 4 May 2010 08:11:41 -0700 >> >> Stupid question: Who cares if its spread across multiple transactions if >> the stub fetches the transactions in parallel? > >well, i don't know if it's a stupid question or not. If I read correctly, somewhere someone suggested that a resolver be able to return the list of RR's that went into validating a particular piece of data. Actually, I kind of like that idea, even if the consequences aren't what some might anticipate. For one, if a cache responds from a "hit" and is asked for the rationale, the result would include all the records used to "admit" the data into the cache upon arrival (to an earlier query). It's conceivable that the list contain now expired signatures (like the signature of the DS record owned by the TLD authored by the root), so the list is no longer "valid." And of course, if the validator's system clock is off, it might permit stale signatures to be considered fresh and vice versa. And this would be seen. OTOH, This would be a good way to see the trust anchors configured in the resolver. And it could bolster NXDOMAIN rewriting. (The NXDOMAIN was verified but I'm returning to you this instead.) This could be an EDNS0 option - albeit one gi-mong-ous[0] option on return - because it's a hop-by-hop thing. And the implementation could be specific to the code base. [0] made the word up. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Wouldn't it be nice if all of the definitions of equivalence were the same? From owner-namedroppers@ops.ietf.org Tue May 4 09:12:27 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 83DF73A6CA1; Tue, 4 May 2010 09:12:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.993 X-Spam-Level: X-Spam-Status: No, score=-3.993 tagged_above=-999 required=5 tests=[AWL=-0.434, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6Zzr-3wLZ1wO; Tue, 4 May 2010 09:12:25 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BAC063A6CAF; Tue, 4 May 2010 09:11:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9KeO-000L3x-IN for namedroppers-data0@psg.com; Tue, 04 May 2010 16:07:12 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1O9KeI-000L3D-IO for namedroppers@ops.ietf.org; Tue, 04 May 2010 16:07:06 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id o44G6uG5023261; Tue, 4 May 2010 09:06:56 -0700 (PDT) References: <2ADB0ACEB9554760821CE5B271B3505C@local> <201005040701.o4471Cep054294@drugs.dv.isc.org> <8ACD3C15A81A41ADABF7ED33436D68F3@local> <201005040746.o447kWdH054589@drugs.dv.isc.org> <1DA3B92B08DF4E0EB4264FBE8090C2BC@local> <201005040930.o449UH0O055474@drugs.dv.isc.org> <50A0A4E878F14CABA5A0DCE4B87A2ABF@local> <30368.1272973937@nsa.vix.com> <37887.1272984532@nsa.vix.com> <7D7CC5E9-DD2F-4A2C-8EB4-E324FAEC70A2@icsi.berkeley.edu> <39761.1272987122@nsa.vix.com> In-Reply-To: <39761.1272987122@nsa.vix.com> Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii Message-Id: <57A230D0-C7C0-4414-963F-F25ADA185DE1@icsi.berkeley.edu> Content-Transfer-Encoding: quoted-printable Cc: Nicholas Weaver , namedroppers@ops.ietf.org From: Nicholas Weaver Subject: Re: [dnsext] RFC 4035 section 3.1.6 Date: Tue, 4 May 2010 09:06:56 -0700 To: Paul Vixie X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 4, 2010, at 8:32 AM, Paul Vixie wrote: >> From: Nicholas Weaver >> Date: Tue, 4 May 2010 08:11:41 -0700 >>=20 >> Stupid question: Who cares if its spread across multiple transactions = if >> the stub fetches the transactions in parallel? >=20 > well, i don't know if it's a stupid question or not. many stubs are = in > embedded systems that don't allow a lot of parallelism, and the = per-packet > cost may be notable compared to the per-octet cost of transporting it, = and > the opportunity to cause congestion is better with asynchronous = responses > than a single big response. (i'm thinking about WRED here.) Well, what embedded system will be validating DNSSEC and couldn't be = modified for a bit more parallelism? The packet overhead is non-trivial, but is it really that bad? DNS is = such in the noise on network traffic compared with everything else out = there that its an Amdahl's law situtaion. Additionally, DNS requests are relatively short, even with DNSSEC and = full chains of trust, so would WRED or similar come into play at all = here? I'd hope that everything would be fitting in an initial window if = under TCP on a modern TCP stack. > but the most important reason why i can't expect to parallelize these = fetches > is that a stub/app might not know to look in DLV unless the server can = mention > DLV in a full-chain answer. (DLV isn't part of the standard so it = won't > affect this WG's deliberations, but it does affect my own thinking.) If you want to use DLV, why not speculatively fetch it always, or fetch = it when necessary initiated by the stub? If the latter, you'd have to = hit the latency hit or traffic hit anyway if its either the recursive = resolver or the stub thats doing the fetch subsequently or = speculatively. From dnsext-archive@ietf.org Tue May 4 13:36:39 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7EF9628C4A2 for ; Tue, 4 May 2010 13:36:39 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Non-encoded 8-bit data (char A9 hex): From: Official \251 VIAGRA ; Tue, 4 May 2010 13:36:38 -0700 (PDT) Received: from c86-201.icpnet.pl (c86-201.icpnet.pl [62.21.86.201]) by core3.amsl.com (Postfix) with SMTP id 17C0028C4A6 for ; Tue, 4 May 2010 12:50:36 -0700 (PDT) Received: (qmail 2936 by uid 632); Tue, 04 May 2010 23:50:12 +0400 Date: Tue, 04 May 2010 23:50:12 +0400 Message-ID: <000301caebc3$157d2f9a$d9e6a8c0@c.icpnet.pl> To: dnsext-archive@ietf.org Subject: dnsext-archive@ietf.org Discount 8617200 From: Official © VIAGRA MIME-Version: 1.0 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit X-Antivirus: avast! (VPS 100504-1, 2010-05-04), Outbound message X-Antivirus-Status: Clean
Click here to view as a web page.

View image in browser now
To dnsext-archive@ietf.org | Privacy Policy | Contact Us

Copyright © 2010 All rights reserved.
From dnsext-archive@lists.ietf.org Tue May 4 13:36:46 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2E25F28C4A1 for ; Tue, 4 May 2010 13:36:46 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Non-encoded 8-bit data (char A9 hex): From: Official \251 VIAGRA ; Tue, 4 May 2010 13:36:39 -0700 (PDT) Received: from c86-201.icpnet.pl (c86-201.icpnet.pl [62.21.86.201]) by core3.amsl.com (Postfix) with SMTP id 64ACA28C5FC for ; Tue, 4 May 2010 12:50:37 -0700 (PDT) Received: (qmail 2936 by uid 632); Tue, 04 May 2010 23:50:12 +0400 Date: Tue, 04 May 2010 23:50:12 +0400 Message-ID: <000301caebc3$16110166$d251a8c0@c.icpnet.pl> To: dnsext-archive@lists.ietf.org Subject: dnsext-archive@lists.ietf.org Discount 8617200 From: Official © VIAGRA MIME-Version: 1.0 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit X-Antivirus: avast! (VPS 100504-1, 2010-05-04), Outbound message X-Antivirus-Status: Clean
Click here to view as a web page.

View image in browser now
To dnsext-archive@lists.ietf.org | Privacy Policy | Contact Us

Copyright © 2010 All rights reserved.
From dnsext-archive@ietf.org Wed May 5 00:30:50 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 35A653A6893 for ; Wed, 5 May 2010 00:30:50 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Non-encoded 8-bit data (char A9 hex): From: Official \251 VIAGRA ; Wed, 5 May 2010 00:30:49 -0700 (PDT) Received: from 89.189.133.13.static.ufanet.ru (89.189.133.13.static.ufanet.ru [89.189.133.13]) by core3.amsl.com (Postfix) with SMTP id 68BD23A6B17 for ; Wed, 5 May 2010 00:29:59 -0700 (PDT) Received: (qmail 2264 by uid 414); Wed, 05 May 2010 11:24:57 +0400 Date: Wed, 05 May 2010 11:24:57 +0400 Message-ID: <20100505132955.2838.qmail@89.189.133.13.static.ufanet.ru> To: dnsext-archive@ietf.org Subject: dnsext-archive@ietf.org Discount 9452929154 From: Official © VIAGRA MIME-Version: 1.0 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit
Click here to view as a web page.

View image in browser now
To dnsext-archive@ietf.org | Privacy Policy | Contact Us

Copyright © 2010 All rights reserved.
From dnsext-archive@ietf.org Wed May 5 09:15:55 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E0AE28C269 for ; Wed, 5 May 2010 09:15:55 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Non-encoded 8-bit data (char A9 hex): From: Official \251 VIAGRA ; Wed, 5 May 2010 09:15:54 -0700 (PDT) Received: from dyn-89.136.54.43.cj.upcnet.ro (dyn-89.136.54.43.cj.upcnet.ro [89.136.54.43]) by core3.amsl.com (Postfix) with SMTP id 5926128C215 for ; Wed, 5 May 2010 09:10:31 -0700 (PDT) Received: (qmail 2988 by uid 177); Wed, 05 May 2010 18:55:12 +0400 Date: Wed, 05 May 2010 18:55:12 +0400 Message-ID: <20100505191021.2799.qmail@dyn-89.136.54.43.cj.upcnet.ro> To: dnsext-archive@ietf.org Subject: dnsext-archive@ietf.org Discount 523866 From: Official © VIAGRA MIME-Version: 1.0 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit
Click here to view as a web page.

View image in browser now
To dnsext-archive@ietf.org | Privacy Policy | Contact Us

Copyright © 2010 All rights reserved.
From dnsext-archive@ietf.org Fri May 7 04:44:23 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D70F43A693D for ; Fri, 7 May 2010 04:44:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -22.429 X-Spam-Level: X-Spam-Status: No, score=-22.429 tagged_above=-999 required=5 tests=[BAYES_99=3.5, HTML_IMAGE_ONLY_20=1.546, HTML_IMAGE_RATIO_02=0.383, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_3=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, SARE_FROM_DRUGS=1.666, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xWtjLdWg17vu for ; Fri, 7 May 2010 04:44:17 -0700 (PDT) Received: from ns4.so-col.com (ns4.so-col.com [80.73.0.197]) by core3.amsl.com (Postfix) with SMTP id 37B303A69A5 for ; Fri, 7 May 2010 04:43:27 -0700 (PDT) Received: (qmail 2361 by uid 105); Fri, 07 May 2010 15:26:12 +0400 Date: Fri, 07 May 2010 15:26:12 +0400 Message-ID: <20100507144255.2096.qmail@ns4.so-col.com> To: dnsext-archive@ietf.org Subject: dnsext-archive@ietf.org Order 222110 From: Canadian Viagra MIME-Version: 1.0 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit
Click here to view as a web page.

View image in browser now
To dnsext-archive@ietf.org | Privacy Policy | Contact Us

Copyright © 2010 All rights reserved.
From dnsext-archive@ietf.org Fri May 7 06:47:49 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 67B323A6BA9 for ; Fri, 7 May 2010 06:47:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.258 X-Spam-Level: X-Spam-Status: No, score=-3.258 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR2=4.395, HTML_IMAGE_ONLY_24=1.552, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I37ci+PsnrSt for ; Fri, 7 May 2010 06:47:43 -0700 (PDT) Received: from 100-63-133-95.pool.ukrtel.net (160-247-133-95.pool.ukrtel.net [95.133.247.160]) by core3.amsl.com (Postfix) with SMTP id DD16B3A6B52 for ; Fri, 7 May 2010 06:44:56 -0700 (PDT) From: RX-Store Subject: Special Discount 77% for dnsext-archive@ietf.org To: MIME-Version: 1.0 Content-Type: text/html X-Antivirus: avast! (VPS 100406-2, 06.04.2010), Outbound message X-Antivirus-Status: Clean Message-Id: <20100507134456.DD16B3A6B52@core3.amsl.com> Date: Fri, 7 May 2010 06:44:56 -0700 (PDT)
Delivery department work across the Globe.
Please click here if the e-mail below is not displayed correctly.

This feature will help you stay in touch with friends and family. We will continually work to add new services over time.
http://sheengine.ru/ Stay Connected with Family and Friends!

ABRA LLC. All Rights Reserved
ABRA Inc. does not authorize the use of its proprietary computers and computer network (the 03270 Network") to accept, transmit or distribute unsolicited bulk e-mail sent from the Internet to ASDuuq members. In addition, Internet e-mail sent, or caused to be sent, to or through the 06155 that makes use of or contains invalid or forged headers, invalid or non-existent domain names or other means of deceptive addressing will be deemed to be counterfeit. Any attempt to send or cause such counterfeit e-mail to be sent to or through the 23893 is unauthorized. 75455

From dnsext-archive@ietf.org Fri May 7 11:19:18 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 503563A65A5 for ; Fri, 7 May 2010 11:19:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.443 X-Spam-Level: X-Spam-Status: No, score=-7.443 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HOST_EQ_D_D_D_D=0.765, HELO_DYNAMIC_DHCP=1.398, HELO_EQ_DSL=1.129, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, HTML_IMAGE_ONLY_24=1.552, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nrdiuhGVLFVN for ; Fri, 7 May 2010 11:19:12 -0700 (PDT) Received: from adsl-ull-30-58.49-151.net24.it (adsl-ull-30-58.49-151.net24.it [151.49.58.30]) by core3.amsl.com (Postfix) with SMTP id 193033A6923 for ; Fri, 7 May 2010 11:14:17 -0700 (PDT) From: RX-Store Subject: Please Read To: MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100507181419.193033A6923@core3.amsl.com> Date: Fri, 7 May 2010 11:14:17 -0700 (PDT)
Delivery department work across the Globe.
Please click here if the e-mail below is not displayed correctly.

This feature will help you stay in touch with friends and family. We will continually work to add new services over time.
http://sheengine.ru/ Stay Connected with Family and Friends!

ABRA LLC. All Rights Reserved
ABRA Inc. does not authorize the use of its proprietary computers and computer network (the 12498 Network") to accept, transmit or distribute unsolicited bulk e-mail sent from the Internet to ASDuuq members. In addition, Internet e-mail sent, or caused to be sent, to or through the 80934 that makes use of or contains invalid or forged headers, invalid or non-existent domain names or other means of deceptive addressing will be deemed to be counterfeit. Any attempt to send or cause such counterfeit e-mail to be sent to or through the 12142 is unauthorized. 72659

From dmanet@ietf.org Fri May 7 18:29:15 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7C27F3A687B for ; Fri, 7 May 2010 18:29:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -27.191 X-Spam-Level: X-Spam-Status: No, score=-27.191 tagged_above=-999 required=5 tests=[BAYES_99=3.5, HELO_DYNAMIC_HCC=4.295, HELO_EQ_DSL=1.129, HTML_IMAGE_ONLY_24=1.552, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z9+ndEUNm8Qs for ; Fri, 7 May 2010 18:29:09 -0700 (PDT) Received: from a243-153.adsl.paltel.net (a243-153.adsl.paltel.net [213.6.243.153]) by core3.amsl.com (Postfix) with SMTP id 2D7743A6A55 for ; Fri, 7 May 2010 18:24:40 -0700 (PDT) From: RX-Store Subject: Electronic Discount Code 72% for dnsext-archive@ietf.org To: MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100508012442.2D7743A6A55@core3.amsl.com> Date: Fri, 7 May 2010 18:24:40 -0700 (PDT)
Delivery department work across the Globe.
Please click here if the e-mail below is not displayed correctly.

This feature will help you stay in touch with friends and family. We will continually work to add new services over time.
http://famoussudden.ru/ Stay Connected with Family and Friends!

ABRA LLC. All Rights Reserved
ABRA Inc. does not authorize the use of its proprietary computers and computer network (the 52890 Network") to accept, transmit or distribute unsolicited bulk e-mail sent from the Internet to ASDuuq members. In addition, Internet e-mail sent, or caused to be sent, to or through the 68692 that makes use of or contains invalid or forged headers, invalid or non-existent domain names or other means of deceptive addressing will be deemed to be counterfeit. Any attempt to send or cause such counterfeit e-mail to be sent to or through the 95497 is unauthorized. 66045

From btv1==744e6c7f6c0==Kevin.Gill@cit.ie Sat May 8 09:13:11 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 19BD23A6987 for ; Sat, 8 May 2010 09:13:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.159 X-Spam-Level: **** X-Spam-Status: No, score=4.159 tagged_above=-999 required=5 tests=[AWL=-0.999, BAYES_80=2, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, MISSING_SUBJECT=1.762] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id slJ2NgKW974A for ; Sat, 8 May 2010 09:13:10 -0700 (PDT) Received: from mx-1.cit.ie (mx-1.cit.ie [157.190.3.45]) by core3.amsl.com (Postfix) with ESMTP id B7B7D3A6887 for ; Sat, 8 May 2010 09:13:09 -0700 (PDT) X-ASG-Debug-ID: 1273275945-771089cd0001-TTt7OP Received: from CITMAIL.cit.ie (exc-btc-01.cit.ie [157.190.22.71]) by mx-1.cit.ie with ESMTP id 3sFAUZmgL9evEmtH; Sat, 08 May 2010 00:45:45 +0100 (IST) X-Barracuda-Envelope-From: Kevin.Gill@cit.ie X-ASG-Whitelist: Client Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01CAEE3E.EB57CEA7" x-mimeole: Produced By Microsoft Exchange V6.5 X-ASG-Orig-Subj: Subject: Date: Sat, 8 May 2010 00:42:13 +0100 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Index: AcruPusBU1Hhi6zIRDuRwHqPHxTNtQ== From: "Kevin Gill" X-Barracuda-Connect: exc-btc-01.cit.ie[157.190.22.71] X-Barracuda-Start-Time: 1273275945 X-Barracuda-URL: http://157.190.3.45:8000/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at cit.ie To: undisclosed-recipients:; This is a multi-part message in MIME format. ------_=_NextPart_001_01CAEE3E.EB57CEA7 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, I am Dr. Ali Said from Saudi Arabia , I was an oil Business man, = suffering from a long time lungs cancer. From all indications my condition is = really deteriorating and it's quite obvious that I won't live more than 2 = months according to my doctors. This is because the cancer stage has gotten to = a very bad stage. I have deposited some funds with a Storage Firm in = Europe some years ago and I will want you to help me collect this money and dispatched it to charity organizations before I die. 30% of this money will be for your time and effort, while 70% goes to charity.Reply me earliest for more details you can reach me with the following email: dr.alisaid@rdwang.com Best Regards Dr. Ali Said=20 ------_=_NextPart_001_01CAEE3E.EB57CEA7 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =0A= =0A= =0A= =0A=
Hello,
=0A=
I am Dr. Ali Said from = Saudi Arabia , I was an oil Business man, suffering
from a long time = lungs cancer. From all indications my condition is = really
deteriorating and it's quite obvious that I won't live more = than 2 months
according to my doctors. This is because the cancer = stage has gotten to a
very bad stage. I have deposited some funds = with a Storage Firm in Europe
some years ago and I will want you to = help me collect this money and
dispatched it to charity organizations = before I die. 30% of this money
will be for your time and effort, = while 70% goes to charity.Reply me
earliest for more details you can = reach me with the following email:
dr.alisaid@rdwang.com=0A=
Best Regards
Dr. Ali = Said
------_=_NextPart_001_01CAEE3E.EB57CEA7-- From info@webmaster.com Sun May 9 23:04:30 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C2B813A6B02 for ; Sun, 9 May 2010 23:04:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.305 X-Spam-Level: **** X-Spam-Status: No, score=4.305 tagged_above=-999 required=5 tests=[AWL=0.353, BAYES_99=3.5, MIME_8BIT_HEADER=0.3, SARE_SUB_ENC_UTF8=0.152] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XXDAq8w3tY+D for ; Sun, 9 May 2010 23:04:30 -0700 (PDT) Received: from mail.xmgd.com (mail.xmgd.com [211.156.95.230]) by core3.amsl.com (Postfix) with ESMTP id 7E4753A68C3 for ; Sun, 9 May 2010 23:04:30 -0700 (PDT) Received: from xmgd.com (localhost [127.0.0.1]) by mail.xmgd.com (Postfix) with ESMTP id A739111BC51; Mon, 10 May 2010 13:57:07 +0800 (CST) From: "Webmaster Departamento Admin." Reply-To: customercarewebdept210@hotmail.com Subject: Confirma Tu Cuenta=?UTF-8?Q?_Webmail=E2=80=8F?= Date: Mon, 10 May 2010 01:57:07 -0400 Message-Id: <20100510055233.M22242@webmaster.com> X-Mailer: OpenWebMail 2.53 X-OriginatingIP: 41.138.181.72 (lx2069@xmgd.com) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 To: undisclosed-recipients:; webmail Estimado / E-mail del usuario Notificación de correo web mantenimiento del usuario Dependencia, Estamos llevando a cabo una actualización en nuestro sitio ya que había llegado a nuestro conocimiento que algunos de nuestros suscriptores están introduciendo un virus en nuestro sitio y está afectando a nuestra red. Estamos tratando de averiguar el suscriptor específico. Por esta razón todos los los abonados a proporcionar sus datos como Nombre, Apellido Nombre, Cuenta de usuario y contraseña para que podamos verificar y hacer que se despejado contra este virus. Adviértase que la falta de respuesta a esto conducirá a suscriptores Cancelación de cuenta en las próximas 48 horas. Por lo tanto, como un usuario de nuestro sitio, es necesario que nos envíe su correo electrónico detalles de la cuenta para que podamos reconocer Actividad cuenta Por otra parte, se informó de que vamos a eliminar todas las cuentas de correo que no se activa para crear más espacio para los nuevos usuarios. Por lo tanto, son consejos que nos envíe los datos de su cuenta de correo Como se solicita a continuación: Información a enviar; Nombre: guillermo Apellido: ayala Nombre de usuario: drgayala Contraseña: gmo6653014 Todos los usuarios se aconsejan para completar la actualización. Un cordial saludo. 2010 Webmaster Departamento Admin. © Todos los derechos reservados From info@webmaster.com Mon May 10 06:46:35 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA6923A68E6 for ; Mon, 10 May 2010 06:46:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.273 X-Spam-Level: **** X-Spam-Status: No, score=4.273 tagged_above=-999 required=5 tests=[AWL=0.321, BAYES_99=3.5, MIME_8BIT_HEADER=0.3, SARE_SUB_ENC_UTF8=0.152] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bcgYwr-ty5Re for ; Mon, 10 May 2010 06:46:35 -0700 (PDT) Received: from mail.xmgd.com (mail.xmgd.com [211.156.95.230]) by core3.amsl.com (Postfix) with ESMTP id 8B1233A6948 for ; Mon, 10 May 2010 06:46:35 -0700 (PDT) Received: from xmgd.com (localhost [127.0.0.1]) by mail.xmgd.com (Postfix) with ESMTP id C4C7211AC17; Mon, 10 May 2010 21:39:54 +0800 (CST) From: "Webmaster Departamento Admin." Reply-To: customercarewebdept210@hotmail.com Subject: Confirma Tu Cuenta=?UTF-8?Q?_Webmail=E2=80=8F?= Date: Mon, 10 May 2010 09:39:54 -0400 Message-Id: <20100510133454.M5833@webmaster.com> X-Mailer: OpenWebMail 2.53 X-OriginatingIP: 41.138.190.190 (lx2069@xmgd.com) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 To: undisclosed-recipients:; webmail Estimado / E-mail del usuario Notificación de correo web mantenimiento del usuario Dependencia, Estamos llevando a cabo una actualización en nuestro sitio ya que había llegado a nuestro conocimiento que algunos de nuestros suscriptores están introduciendo un virus en nuestro sitio y está afectando a nuestra red. Estamos tratando de averiguar el suscriptor específico. Por esta razón todos los los abonados a proporcionar sus datos como Nombre, Apellido Nombre, Cuenta de usuario y contraseña para que podamos verificar y hacer que se despejado contra este virus. Adviértase que la falta de respuesta a esto conducirá a suscriptores Cancelación de cuenta en las próximas 48 horas. Por lo tanto, como un usuario de nuestro sitio, es necesario que nos envíe su correo electrónico detalles de la cuenta para que podamos reconocer Actividad cuenta Por otra parte, se informó de que vamos a eliminar todas las cuentas de correo que no se activa para crear más espacio para los nuevos usuarios. Por lo tanto, son consejos que nos envíe los datos de su cuenta de correo Como se solicita a continuación: Información a enviar; Nombre: Apellido: Nombre de usuario: Contraseña: Todos los usuarios se aconsejan para completar la actualización. Un cordial saludo. 2010 Webmaster Departamento Admin. © Todos los derechos reservados From owner-namedroppers@ops.ietf.org Tue May 11 08:36:55 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 027083A69B0; Tue, 11 May 2010 08:36:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.314 X-Spam-Level: X-Spam-Status: No, score=-0.314 tagged_above=-999 required=5 tests=[AWL=0.181, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LOLosNgnBTuN; Tue, 11 May 2010 08:36:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5F8E63A67F0; Tue, 11 May 2010 08:36:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OBrPL-000MGP-0U for namedroppers-data0@psg.com; Tue, 11 May 2010 15:30:07 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OBrPH-000MFq-Ik for namedroppers@ops.ietf.org; Tue, 11 May 2010 15:30:04 +0000 Received: from [IPv6:::1] (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4BFSXV1004761; Tue, 11 May 2010 11:28:33 -0400 (EDT) (envelope-from ogud@ogud.com) Message-ID: <4BE9779E.9000706@ogud.com> Date: Tue, 11 May 2010 11:28:30 -0400 From: Olafur Gudmundsson User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Ralph Droms CC: namedroppers Subject: [dnsext] Document advancement notice : DNS Transport over TCP Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Title: DNS Transport over TCP - Implementation Requirements Draft: draft-ietf-dnsext-dns-tcp-requirements-03 (1.a) Who is the Document Shepherd for this document? Has the Document Shepherd personally reviewed this version of the document and, in particular, does he or she believe this version is ready for forwarding to the IESG for publication? Olafur Gudmundsson DNSEXT co-chair I have reviewed this version and prior versions, and this one is ready for publication. (1.b) Has the document had adequate review both from key WG members and from key non-WG members? Does the Document Shepherd have any concerns about the depth or breadth of the reviews that have been performed? The document has had extensive review by the working group, over 30 people have send in comments or opinions on this document. (1.c) Does the Document Shepherd have concerns that the document needs more review from a particular or broader perspective, e.g., security, operational complexity, someone familiar with AAA, internationalization or XML? No (1.d) Does the Document Shepherd have any specific concerns or issues with this document that the Responsible Area Director and/or the IESG should be aware of? For example, perhaps he or she is uncomfortable with certain parts of the document, or has concerns whether there really is a need for it. In any event, if the WG has discussed those issues and has indicated that it still wishes to advance the document, detail those concerns here. Has an IPR disclosure related to this document been filed? If so, please include a reference to the disclosure and summarize the WG discussion and conclusion on this issue. This document was started after RFC5625, as the IESG review exposed that prior DNS documentation is not as clear as was intended on TCP query support by DNS protocol elements. This document addresses that. The document explicitly does not prescribe how TCP is used by DNS software. (1.e) How solid is the WG consensus behind this document? Does it represent the strong concurrence of a few individuals, with others being silent, or does the WG as a whole understand and agree with it? We have strong consensus with vocal opposition. The working group understands the document and the issues. (1.f) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email messages to the Responsible Area Director. (It should be in a separate email because this questionnaire is entered into the ID Tracker.) No (1.g) Has the Document Shepherd personally verified that the document satisfies all ID nits? (See the Internet-Drafts Checklist and http://tools.ietf.org/tools/idnits/). Boilerplate checks are not enough; this check needs to be thorough. Has the document met all formal review criteria it needs to, such as the MIB Doctor, media type and URI type reviews? Yes, there are no nits. The document does not contain MIB's or URI's or any other components that need extra review. (1.h) Has the document split its references into normative and informative? Are there normative references to documents that are not ready for advancement or are otherwise in an unclear state? If such normative references exist, what is the strategy for their completion? Are there normative references that are downward references, as described in [RFC3967]? If so, list these downward references to support the Area Director in the Last Call procedure for them [RFC3967]. Yes, references are in order. (1.i) Has the Document Shepherd verified that the document IANA consideration section exists and is consistent with the body of the document? If the document specifies protocol extensions, are reservations requested in appropriate IANA registries? Are the IANA registries clearly identified? If the document creates a new registry, does it define the proposed initial contents of the registry and an allocation procedure for future registrations? Does it suggest a reasonable name for the new registry? See [RFC5226]. If the document describes an Expert Review process has Shepherd conferred with the Responsible Area Director so that the IESG can appoint the needed Expert during the IESG Evaluation? There are no IANA actions (1.j) Has the Document Shepherd verified that sections of the document that are written in a formal language, such as XML code, BNF rules, MIB definitions, etc., validate correctly in an automated checker? does not apply (1.k) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up? Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections: Technical Summary Relevant content can frequently be found in the abstract and/or introduction of the document. If not, this may be an indication that there are deficiencies in the abstract or introduction. Working Group Summary Was there anything in WG process that is worth noting? For example, was there controversy about particular points or were there decisions where the consensus was particularly rough? Document Quality Are there existing implementations of the protocol? Have a significant number of vendors indicated their plan to implement the specification? Are there any reviewers that merit special mention as having done a thorough review, e.g., one that resulted in important changes or a conclusion that the document had no substantive issues? If there was a MIB Doctor, Media Type or other expert review, what was its course (briefly)? In the case of a Media Type review, on what date was the request posted? Technical Summary: This document expresses in clearly that general purpose DNS software needs to be able to to perform DNS queries over TCP. Working Group Summary: The discussion in the working centered on following issues: Is TCP required for some queries: Answer in general yes How should TCP connections be handled: The document states that DNS servers can terminate open TCP connections when they want/need to. Is the document requiring DNS operators to provide TCP query service: Answer: No. Such specification is outside the working group's scope and it is an decision for each DNS Operator. Document Quality: The document is well written and expresses the issues clearly. The actions are clearly marked and the text that is being updated is quoted. From dnsext-archive@ietf.org Thu May 13 09:26:38 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 048223A6C61 for ; Thu, 13 May 2010 09:26:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.951 X-Spam-Level: X-Spam-Status: No, score=-15.951 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_RELAY_NODNS=1.451, HTML_IMAGE_ONLY_24=1.552, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RDNS_NONE=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E+3hbO8xlWWD for ; Thu, 13 May 2010 09:26:36 -0700 (PDT) Received: from amclub.org.sg (unknown [94.181.120.39]) by core3.amsl.com (Postfix) with SMTP id 6264E3A6C8E for ; Thu, 13 May 2010 09:24:32 -0700 (PDT) From: RX-Store Subject: Please Read To: MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100513162434.6264E3A6C8E@core3.amsl.com> Date: Thu, 13 May 2010 09:24:32 -0700 (PDT)
Delivery department work across the Globe.
Please click here if the e-mail below is not displayed correctly.

This feature will help you stay in touch with friends and family. We will continually work to add new services over time.
http://rosebreak.com/ Stay Connected with Family and Friends!

ABRA LLC. All Rights Reserved
ABRA Inc. does not authorize the use of its proprietary computers and computer network (the 58952 Network") to accept, transmit or distribute unsolicited bulk e-mail sent from the Internet to ASDuuq members. In addition, Internet e-mail sent, or caused to be sent, to or through the 86675 that makes use of or contains invalid or forged headers, invalid or non-existent domain names or other means of deceptive addressing will be deemed to be counterfeit. Any attempt to send or cause such counterfeit e-mail to be sent to or through the 53158 is unauthorized. 54932

From owner-namedroppers@ops.ietf.org Thu May 13 12:11:40 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 15C8D3A6CDC; Thu, 13 May 2010 12:11:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.319 X-Spam-Level: X-Spam-Status: No, score=-0.319 tagged_above=-999 required=5 tests=[AWL=0.176, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WGU91xPX6VXH; Thu, 13 May 2010 12:11:39 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1B2D73A6BC2; Thu, 13 May 2010 12:11:15 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCdg2-000Dky-TK for namedroppers-data0@psg.com; Thu, 13 May 2010 19:02:34 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCdfy-000Djk-GK for namedroppers@ops.ietf.org; Thu, 13 May 2010 19:02:30 +0000 Received: from [IPv6:::1] (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4DJ2TJ6026362 for ; Thu, 13 May 2010 15:02:29 -0400 (EDT) (envelope-from ogud@ogud.com) Message-ID: <4BEC4CC1.3090606@ogud.com> Date: Thu, 13 May 2010 15:02:25 -0400 From: Olafur Gudmundsson User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: namedroppers Subject: [dnsext] DNSEXT @ IETF-78 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At this point the chairs are not aware of any reason to schedule a meeting. If you have items that you think justify a session please contact us as soon a possible. We will make final decision by June 1'st. Olafur & Andrew From owner-namedroppers@ops.ietf.org Thu May 13 19:28:27 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0FB2F3A69F2; Thu, 13 May 2010 19:28:27 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Duplicate header field: "Message-ID" X-Spam-Flag: NO X-Spam-Score: 3.59 X-Spam-Level: *** X-Spam-Status: No, score=3.59 tagged_above=-999 required=5 tests=[AWL=-0.559, BAYES_50=0.001, FH_RELAY_NODNS=1.451, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K1vA38hqzG4c; Thu, 13 May 2010 19:28:26 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id AEE6D3A6995; Thu, 13 May 2010 19:28:25 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCkXA-0005h6-I6 for namedroppers-data0@psg.com; Fri, 14 May 2010 02:21:52 +0000 Received: from [159.226.7.146] (helo=cnnic.cn) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCkX7-0005gQ-Gs for namedroppers@ops.ietf.org; Fri, 14 May 2010 02:21:49 +0000 Received: (eyou send program); Fri, 14 May 2010 10:21:47 +0800 Message-ID: <473803707.18980@cnnic.cn> X-EYOUMAIL-SMTPAUTH: yaojk@cnnic.cn Received: from unknown (HELO lenovo47e041cf) (127.0.0.1) by 127.0.0.1 with SMTP; Fri, 14 May 2010 10:21:47 +0800 Message-ID: From: "Jiankang YAO" To: "Olafur Gudmundsson" , "namedroppers" References: <473778789.26681@cnnic.cn> Subject: Re: [dnsext] DNSEXT @ IETF-78 Date: Fri, 14 May 2010 10:21:52 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5931 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQpJIHN1Z2dlc3QgdG8gZGlzY3VzcyB0aGUgZHJhZnRzIiBibmFtZSBhbmQgem9uZSBjbG9uZSAi IGluIElFVEYtNzgNCg0KDQpKaWFua2FuZyBZYW8NCg0KDQotLS0tLSBPcmlnaW5hbCBNZXNzYWdl IC0tLS0tIA0KRnJvbTogIk9sYWZ1ciBHdWRtdW5kc3NvbiIgPG9ndWRAb2d1ZC5jb20+DQpUbzog Im5hbWVkcm9wcGVycyIgPG5hbWVkcm9wcGVyc0BvcHMuaWV0Zi5vcmc+DQpTZW50OiBGcmlkYXks IE1heSAxNCwgMjAxMCAzOjAyIEFNDQpTdWJqZWN0OiBbZG5zZXh0XSBETlNFWFQgQCBJRVRGLTc4 DQoNCg0KPiANCj4gQXQgdGhpcyBwb2ludCB0aGUgY2hhaXJzIGFyZSBub3QgYXdhcmUgb2YgYW55 IHJlYXNvbiB0byBzY2hlZHVsZSBhIA0KPiBtZWV0aW5nLiBJZiB5b3UgaGF2ZSBpdGVtcyB0aGF0 IHlvdSB0aGluayBqdXN0aWZ5IGEgc2Vzc2lvbiBwbGVhc2UNCj4gY29udGFjdCB1cyBhcyBzb29u IGEgcG9zc2libGUuDQo+IA0KPiBXZSB3aWxsIG1ha2UgZmluYWwgZGVjaXNpb24gYnkgSnVuZSAx J3N0Lg0KPiANCj4gT2xhZnVyICYgQW5kcmV3DQo+IA0KPiANCj4= From info@webmaster.com Fri May 14 00:13:45 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 767943A6993 for ; Fri, 14 May 2010 00:13:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.207 X-Spam-Level: **** X-Spam-Status: No, score=4.207 tagged_above=-999 required=5 tests=[AWL=0.255, BAYES_99=3.5, MIME_8BIT_HEADER=0.3, SARE_SUB_ENC_UTF8=0.152] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LRKanr0g5O6q for ; Fri, 14 May 2010 00:13:45 -0700 (PDT) Received: from mail.xmgd.com (smtp.xmgd.com [211.156.95.230]) by core3.amsl.com (Postfix) with ESMTP id 37B5D3A659C for ; Fri, 14 May 2010 00:13:45 -0700 (PDT) Received: from xmgd.com (localhost [127.0.0.1]) by mail.xmgd.com (Postfix) with ESMTP id 961D111EF5F; Fri, 14 May 2010 14:05:04 +0800 (CST) From: "Webmaster Departamento Admin" Reply-To: customercarewebdept210@hotmail.com Subject: Confirma Tu Cuenta=?UTF-8?Q?_Webmail=E2=80=8F?= Date: Fri, 14 May 2010 02:05:04 -0400 Message-Id: <20100514060107.M38093@webmaster.com> X-Mailer: OpenWebMail 2.53 X-OriginatingIP: 41.138.186.34 (lx2069@xmgd.com) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 To: undisclosed-recipients:; webmail Estimado / E-mail del usuario Notificación de correo web mantenimiento del usuario Dependencia, Estamos llevando a cabo una actualización en nuestro sitio ya que había llegado a nuestro conocimiento que algunos de nuestros suscriptores están introduciendo un virus en nuestro sitio y está afectando a nuestra red. Estamos tratando de averiguar el suscriptor específico. Por esta razón todos los los abonados a proporcionar sus datos como Nombre, Apellido Nombre, Cuenta de usuario y contraseña para que podamos verificar y hacer que se despejado contra este virus. Adviértase que la falta de respuesta a esto conducirá a suscriptores Cancelación de cuenta en las próximas 48 horas. Por lo tanto, como un usuario de nuestro sitio, es necesario que nos envíe su correo electrónico detalles de la cuenta para que podamos reconocer Actividad cuenta Por otra parte, se informó de que vamos a eliminar todas las cuentas de correo que no se activa para crear más espacio para los nuevos usuarios. Por lo tanto, son consejos que nos envíe los datos de su cuenta de correo Como se solicita a continuación: Información a enviar; Nombre: Apellido: Nombre de usuario: Contraseña: Todos los usuarios se aconsejan para completar la actualización. Un cordial saludo. 2010 Webmaster Departamento Admin. © Todos los derechos reservados From owner-namedroppers@ops.ietf.org Fri May 14 06:13:16 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 943BC3A6B08; Fri, 14 May 2010 06:13:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.195 X-Spam-Level: X-Spam-Status: No, score=-2.195 tagged_above=-999 required=5 tests=[AWL=0.253, BAYES_50=0.001, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8AjLuVhh-vp8; Fri, 14 May 2010 06:13:15 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id AC2B13A6B3B; Fri, 14 May 2010 06:13:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCuat-0000fy-G6 for namedroppers-data0@psg.com; Fri, 14 May 2010 13:06:23 +0000 Received: from [139.91.1.2] (helo=mailgate.ics.forth.gr) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCuaq-0000fV-7F for namedroppers@ops.ietf.org; Fri, 14 May 2010 13:06:20 +0000 X-DNSBL-MILTER: Passed Received: from av1.ics.forth.gr ([139.91.157.71]) by mailgate.ics.forth.gr (8.14.3/ICS-FORTH/V10-1.8-GATE) with ESMTP id o4ED56Yd027985; Fri, 14 May 2010 16:05:50 +0300 (EEST) X-AuditID: 8b5b9d47-b7b65ae000001d2f-69-4bed4a8a9bb1 Received: from enigma.ics.forth.gr (webmail.ics.forth.gr [139.91.1.30]) by av1.ics.forth.gr (SMTP Outbound / FORTH / ICS) with SMTP id 58.85.07471.A8A4DEB4; Fri, 14 May 2010 16:05:14 +0300 (EEST) Received: from Thanatos (thanatos.ics.forth.gr [139.91.88.160]) (authenticated bits=0) by enigma.ics.forth.gr (8.14.3//ICS-FORTH/V10.3.0C-EXTNULL-SSL-SASL) with ESMTP id o4ED5Dg4028352 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Fri, 14 May 2010 16:05:14 +0300 From: "Vaggelis Segredakis" To: "'Jiankang YAO'" , "'Olafur Gudmundsson'" , "'namedroppers'" References: <473778789.26681@cnnic.cn> <473803707.18980@cnnic.cn> Subject: RE: [dnsext] DNSEXT @ IETF-78 Date: Fri, 14 May 2010 16:05:03 +0300 Message-ID: <918B5C5943914332B4BED71C35DF5FAD@ics.forth.gr> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 11 In-Reply-To: <473803707.18980@cnnic.cn> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Thread-Index: AcrzEEqYIJ6octPOSei3MgTM4TV9OAAVREVg X-Brightmail-Tracker: AAAAAA== X-j-chkmail-Score: MSGID : 4BED4A82.001 on mailgate : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-ICS-JCHK-SCL: Ham Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: I second Yao's proposal. Kind Regards, Vaggelis Segredakis -----Original Message----- From: owner-namedroppers@ops.ietf.org [mailto:owner-namedroppers@ops.ietf.org] On Behalf Of Jiankang YAO Sent: Friday, May 14, 2010 5:22 AM To: Olafur Gudmundsson; namedroppers Subject: Re: [dnsext] DNSEXT @ IETF-78 I suggest to discuss the drafts" bname and zone clone " in IETF-78 Jiankang Yao ----- Original Message ----- From: "Olafur Gudmundsson" To: "namedroppers" Sent: Friday, May 14, 2010 3:02 AM Subject: [dnsext] DNSEXT @ IETF-78 > > At this point the chairs are not aware of any reason to schedule a > meeting. If you have items that you think justify a session please > contact us as soon a possible. > > We will make final decision by June 1'st. > > Olafur & Andrew > > > From owner-namedroppers@ops.ietf.org Fri May 14 06:59:46 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4BF8D3A68B1; Fri, 14 May 2010 06:59:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.031 X-Spam-Level: X-Spam-Status: No, score=0.031 tagged_above=-999 required=5 tests=[AWL=-0.369, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Awl0muWGWIIo; Fri, 14 May 2010 06:59:45 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6EE593A689F; Fri, 14 May 2010 06:59:45 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCvM8-0007NR-RM for namedroppers-data0@psg.com; Fri, 14 May 2010 13:55:12 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCvM4-0007MF-AI for namedroppers@ops.ietf.org; Fri, 14 May 2010 13:55:08 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 50B2F1ECB41E for ; Fri, 14 May 2010 13:55:04 +0000 (UTC) Date: Fri, 14 May 2010 09:54:58 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Message-ID: <20100514135457.GA65855@shinkuro.com> References: <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear colleagues, On Sat, Mar 27, 2010 at 07:04:22PM -0400, Samuel Weiler wrote: > I'm hopeful that better text about controlling query floods will be > added soon. The contribution of such text is the only thing standing in the way of a WGLC on this document. Anyone? A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Fri May 14 08:05:27 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5F15E3A6A92; Fri, 14 May 2010 08:05:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.338 X-Spam-Level: * X-Spam-Status: No, score=1.338 tagged_above=-999 required=5 tests=[AWL=-1.662, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CwPtTsSk6ASQ; Fri, 14 May 2010 08:05:26 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B39573A6B1A; Fri, 14 May 2010 08:05:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCwMu-000GIZ-TO for namedroppers-data0@psg.com; Fri, 14 May 2010 15:00:04 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCwMp-000GGt-JV for namedroppers@ops.ietf.org; Fri, 14 May 2010 14:59:59 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 5F4EA1ECB41E for ; Fri, 14 May 2010 14:59:58 +0000 (UTC) Date: Fri, 14 May 2010 10:59:56 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100514145956.GF65855@shinkuro.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear colleagues, There has previously been some interest expressed in the draft draft-kerr-ixfr-only-01, and we've had a request to adopt it. However, we have not had the requisite five people committing to review through WGLC. In my opinion, the document is mostly complete. We could knock this off pretty quickly if we had committed reviewers. So far we have two people who said they'd review, with a third conditional offer. If we do _not_ have committed reviewers by 17:00 UTC on 2010-05-21, the Chairs will take that as an indication of a lack of interest in the draft, and will assume that the WG does not want to do this work. Best regards, Andrew -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Fri May 14 08:09:02 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D32623A6A13; Fri, 14 May 2010 08:09:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.366 X-Spam-Level: * X-Spam-Status: No, score=1.366 tagged_above=-999 required=5 tests=[AWL=-1.634, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NIQ15USjUERr; Fri, 14 May 2010 08:08:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0456B3A6B46; Fri, 14 May 2010 08:08:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCwS1-000H6M-Nf for namedroppers-data0@psg.com; Fri, 14 May 2010 15:05:21 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCwRx-000H4c-KU for namedroppers@ops.ietf.org; Fri, 14 May 2010 15:05:17 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 0FE2B1ECB41E for ; Fri, 14 May 2010 15:05:15 +0000 (UTC) Date: Fri, 14 May 2010 11:05:14 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] DNSEXT @ IETF-78 Message-ID: <20100514150514.GG65855@shinkuro.com> References: <473778789.26681@cnnic.cn> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 14, 2010 at 10:21:52AM +0800, Jiankang YAO wrote: > > I suggest to discuss the drafts" bname and zone clone " in IETF-78 What is there to discuss in the drafts? We have not yet made a determination about whether there is work to be done at all on this general topic. The Chairs are preparing an outline of what we think the discussion has yielded. (We hope to have a draft on this topic posted soon.) But even supposing we had made a decision on that, what are the precise open items that need resolution in a WG meeting, rather than here on the list, with the proposals in those documents? (I am completely opposed to having a meeting just for status updates on documents. Status can be put on a wiki or on the mailing list.) Best, A (speaking for myself, but as co-chair) -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Fri May 14 10:46:55 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 20BFD3A67B6; Fri, 14 May 2010 10:46:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.88 X-Spam-Level: X-Spam-Status: No, score=0.88 tagged_above=-999 required=5 tests=[AWL=-1.039, BAYES_40=-0.185, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e+-rVAvK9tvK; Fri, 14 May 2010 10:46:54 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6CE073A694A; Fri, 14 May 2010 10:46:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCyrT-000ATt-A9 for namedroppers-data0@psg.com; Fri, 14 May 2010 17:39:47 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OCyrO-000ATT-RF for namedroppers@ops.ietf.org; Fri, 14 May 2010 17:39:43 +0000 Received: from [IPv6:::1] (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4EHddrB035037 for ; Fri, 14 May 2010 13:39:41 -0400 (EDT) (envelope-from ogud@ogud.com) Message-ID: <4BED8AD7.8020801@ogud.com> Date: Fri, 14 May 2010 13:39:35 -0400 From: Olafur Gudmundsson User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: namedroppers Subject: [dnsext] EDNS0-bis document next steps Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: The ENDS0-bis document is in relatively good shape, we plan to start a WGLC on this document by the end of this month. Before then we ask that people take a look at the current version and see if they have issues with the document as it is. Link: http://datatracker.ietf.org/doc/draft-ietf-dnsext-rfc2671bis-edns0/ In particular Section's 6.4 - 6.8 need to be reviewed as to if the recommendations in the sections are the ones the WG should make? The document specifies Expert review for new EDNS0 options, currently there is no criteria in the document for the expert(s) to follow. The question is: SHOULD the document specify a criteria for the expert(s) ? The document closes the extend labels registry and moves bit-labels to historic. Do WG members agree with these actions? Olafur From owner-namedroppers@ops.ietf.org Fri May 14 12:26:02 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9FE153A683F; Fri, 14 May 2010 12:26:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.183 X-Spam-Level: X-Spam-Status: No, score=0.183 tagged_above=-999 required=5 tests=[AWL=-2.784, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ulLTcWdfGQcM; Fri, 14 May 2010 12:26:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9FD8D3A67E9; Fri, 14 May 2010 12:26:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OD0QK-000MSn-SM for namedroppers-data0@psg.com; Fri, 14 May 2010 19:19:52 +0000 Message-Id: Received: from [76.96.62.96] (helo=qmta09.westchester.pa.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OD0QI-000MRc-2y for namedroppers@ops.ietf.org; Fri, 14 May 2010 19:19:50 +0000 Received: from omta11.westchester.pa.mail.comcast.net ([76.96.62.36]) by qmta09.westchester.pa.mail.comcast.net with comcast id HUcL1e0050mv7h059XKpFn; Fri, 14 May 2010 19:19:49 +0000 Received: from Mike-PC3.comcast.net ([68.83.217.57]) by omta11.westchester.pa.mail.comcast.net with comcast id HXKo1e00D1EtFYL3XXKoKx; Fri, 14 May 2010 19:19:49 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Fri, 14 May 2010 15:19:46 -0400 To: Andrew Sullivan ,namedroppers@ops.ietf.org From: Michael StJohns Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data In-Reply-To: <20100514135457.GA65855@shinkuro.com> References: <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <20100514135457.GA65855@shinkuro.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 09:54 AM 5/14/2010, Andrew Sullivan wrote: >Dear colleagues, > >On Sat, Mar 27, 2010 at 07:04:22PM -0400, Samuel Weiler wrote: >> I'm hopeful that better text about controlling query floods will be >> added soon. > >The contribution of such text is the only thing standing in the way of >a WGLC on this document. Anyone? Um.. the authors still haven't done anything to address/fix the text on the CD bit - go back to 3/24 for my diagram/discussion on why the current text is still inadequate. I'll write text, but I want agreement as to the fix before that. It's really silly that this has taken more than 18 months (or pretty close by now) and still not done. Mike >A > >-- >Andrew Sullivan >ajs@shinkuro.com >Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Fri May 14 12:59:27 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BF0CB3A68C8; Fri, 14 May 2010 12:59:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.818 X-Spam-Level: X-Spam-Status: No, score=0.818 tagged_above=-999 required=5 tests=[AWL=-1.071, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8DlVSVEl51Tt; Fri, 14 May 2010 12:59:27 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C97C33A6842; Fri, 14 May 2010 12:59:26 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OD0yp-0000fM-LW for namedroppers-data0@psg.com; Fri, 14 May 2010 19:55:31 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OD0ym-0000f1-Nm for namedroppers@ops.ietf.org; Fri, 14 May 2010 19:55:28 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 60F361ECB41E for ; Fri, 14 May 2010 19:55:27 +0000 (UTC) Date: Fri, 14 May 2010 15:55:25 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Message-ID: <20100514195525.GL65855@shinkuro.com> References: <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <20100514135457.GA65855@shinkuro.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 14, 2010 at 03:19:46PM -0400, Michael StJohns wrote: > Um.. the authors still haven't done anything to address/fix the text > on the CD bit - go back to 3/24 for my diagram/discussion on why the > current text is still inadequate. I'll write text, but I want > agreement as to the fix before that. I just re-read that thread, and I went back and read the earlier threads. My impression was that several people agreed to text that David suggested: When processing a request with the CD bit set, the resolver MUST set the CD bit on its upstream queries. Furthermore, if the validating recursive resolver has a trust anchor covering a request, it SHOULD set the CD bit on its upstream query regardless of the CD bit setting of the request. Right? If so, it now belongs in 5.9 (because of changes since the -08 draft). If not, please explain why not. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Fri May 14 17:49:28 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C43C93A68C4; Fri, 14 May 2010 17:49:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.204 X-Spam-Level: * X-Spam-Status: No, score=1.204 tagged_above=-999 required=5 tests=[AWL=-1.763, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JmSdTG5viYld; Fri, 14 May 2010 17:49:27 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 585833A68BF; Fri, 14 May 2010 17:49:25 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OD5Rj-0001Wc-FA for namedroppers-data0@psg.com; Sat, 15 May 2010 00:41:39 +0000 Message-Id: Received: from [76.96.59.243] (helo=qmta13.westchester.pa.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OD5Rf-0001W7-3k for namedroppers@ops.ietf.org; Sat, 15 May 2010 00:41:35 +0000 Received: from omta11.westchester.pa.mail.comcast.net ([76.96.62.36]) by qmta13.westchester.pa.mail.comcast.net with comcast id HbYf1e0010mv7h05DchbQb; Sat, 15 May 2010 00:41:35 +0000 Received: from Mike-PC3.comcast.net ([68.83.217.57]) by omta11.westchester.pa.mail.comcast.net with comcast id HchZ1e0071EtFYL3XchZTg; Sat, 15 May 2010 00:41:34 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Fri, 14 May 2010 20:41:31 -0400 To: Andrew Sullivan ,namedroppers@ops.ietf.org From: Michael StJohns Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data In-Reply-To: <20100514195525.GL65855@shinkuro.com> References: <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <20100514135457.GA65855@shinkuro.com> <20100514195525.GL65855@shinkuro.com> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=====================_103687920==.ALT" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --=====================_103687920==.ALT Content-Type: text/plain; charset="us-ascii" For the rest of you joining us late, this discussion does not assume that there is a single validating resolver between the querier and the authoritative servers (which is the most typical implementation). It's an unusual architecture, but there are situations where having at least two validating resolvers in the path may happen. Because of this, a validating resolver can't assume its next query will go directly to the authoritative server and may need to twiddle with the CD bit in the Upstream query. At 03:55 PM 5/14/2010, Andrew Sullivan wrote: >On Fri, May 14, 2010 at 03:19:46PM -0400, Michael StJohns wrote: > >> Um.. the authors still haven't done anything to address/fix the text >> on the CD bit - go back to 3/24 for my diagram/discussion on why the >> current text is still inadequate. I'll write text, but I want >> agreement as to the fix before that. > >I just re-read that thread, and I went back and read the earlier >threads. My impression was that several people agreed to text that >David suggested: > > When processing a request with the CD bit set, the resolver MUST set > the CD bit on its upstream queries. > > Furthermore, if the validating recursive resolver has a trust > anchor covering a request, it SHOULD set the CD bit on its upstream > query regardless of the CD bit setting of the request. > >Right? If so, it now belongs in 5.9 (because of changes since the -08 >draft). If not, please explain why not. Its really much more complex than the above. Sadly. -08 is where the above text comment was made (and never acted upon), -11 inserted instead: When processing a request with the CD bit set, a resolver SHOULD >> the SHOULD mirrors the "SHOULD" in 4035 3.2.2, but probably should be a MUST. The language in 3.2.2 is pretty clear what the intent of the CD bit is - resolver is not responsible for validation. Otherwise, just add something like "An intermediate resolver MAY implement an option to be configured to ignore the CD bit in queries, in which case it behaves exactly as if the CD bit were not set. The option MUST default to non-ignore" to the CD section attempt to return all responsive data, even data that has failed DNSSEC validation. RFC4035 section 3.2.2 requires a resolver processing a request with the CD bit set to set the CD bit on its upstream queries. The guidance in RFC4035 is ambiguous about what to do when a cached response was obtained with the CD bit not set. >> its also ambiguous what to do when a cached response was obtained with the CD bit set and the query is for non-CD data. E.g. do you not cache the unvalidated data? In the typical case, no new query is required, nor does the cache need to track the state of the CD bit used to make a given query. >> This sentence appears to be wrong, but for the wrong reason. You need to track the CD bit not because of the CD bit queries but because of the non-CD bit queries. See below and my diagram. The problem arises when the cached response is a server failure (RCODE 2), which may indicate that the requested data failed DNSSEC validation at an upstream validating resolver. (RFC2308 permits caching of server failures for up to five minutes.) In these cases, a new query with the CD bit set is required. >> the language David proposed was wrong, the above is correct. For efficiency, a validator may wish to set the CD bit on all upstream queries when it has a trust anchor at or above the QNAME (and thus can reasonably expect to be able to validate the response). >> this doesn't appear to be an efficiency issue. A resolver SHOULD/MUST set the CD bit on all TA covered upstream queries, otherwise it's not getting the data to do its job. Sam made a counter argument in the 3/30 exchange which I believe is contrived, but at least marginally possible. The text for his covering the implementation of his argument would have this be something like: "The resolver MAY implement an option to to clear the CD bit on any or all TA-coverd non-CD bit queries to take advantage of validation at resolver closer to the authoritative servers" To be blunt, I think this is a bad idea - if you want to do this, simply remove your local TAs. The -11 text ignores a number of subcases. See my diagram of 3/24 but basically if query CD bit is set if response is cached if SERVFAIL is cached Set CD bit upstream and query Else Return cached else // response not cached Set CD bit upstream and query else // query CD bit clear if response is cached if cached response had CD bit set if resolver has covering trust anchor run validation against cached and return else // resolver can't validate locally and data wasn't validated upstream clear CD bit and query else // prev data was validated upstream if at all return cached data else // response not cached if resolver has covering trust anchor set CD bit and query then validate locally else clear CD bit query and return While looking at this, I realized that it may be possible to "poison" the cache of a non-validating (but DNSSEC away) intermediate resolver by passing it a CD bit set query. Later queries to that same data - unless the resolver realizes it needs to requery - may get the non-validated data and I can't see any text either in 4035 or -11 that would prevent this. Mike >A >-- >Andrew Sullivan >ajs@shinkuro.com >Shinkuro, Inc. --=====================_103687920==.ALT Content-Type: text/html; charset="us-ascii" For the rest of you joining us late, this discussion does not assume that there is a single validating resolver between the querier and the authoritative servers (which is the most typical implementation).  It's an unusual architecture, but there are situations where having at least two validating resolvers in the path may happen.  Because of this, a validating resolver can't assume its next query will go directly to the authoritative server and may need to twiddle with the CD bit in the Upstream query.



At 03:55 PM 5/14/2010, Andrew Sullivan wrote:
On Fri, May 14, 2010 at 03:19:46PM -0400, Michael StJohns wrote:

> Um.. the authors still haven't done anything to address/fix the text
> on the CD bit - go back to 3/24 for my diagram/discussion on why the
> current text is still inadequate.  I'll write text, but I want
> agreement as to the fix before that.

I just re-read that thread, and I went back and read the earlier
threads.  My impression was that several people agreed to text that
David suggested:
 
   When processing a request with the CD bit set, the resolver MUST set
   the CD bit on its upstream queries.

   Furthermore, if the validating recursive resolver has a trust
   anchor covering a request, it SHOULD set the CD bit on its upstream
   query regardless of the CD bit setting of the request.

Right?  If so, it now belongs in 5.9 (because of changes since the -08
draft).  If not, please explain why not.

Its really much more complex than the above.  Sadly.

-08 is where the above text comment was made (and never acted upon),  -11 inserted instead:

 When processing a request with the CD bit set, a resolver
SHOULD  



                    


>> the SHOULD mirrors the "SHOULD" in 4035 3.2.2, but
probably should be a MUST.  The language in 3.2.2 is pretty clear
what the intent of the CD bit is - resolver is not responsible for
validation.  Otherwise, just add something like "An
intermediate resolver MAY implement an option to be configured to ignore
the CD bit in queries, in which case it behaves exactly as if the CD bit
were not set.  The option MUST default to non-ignore" to the CD
section



   attempt to return all responsive data, even data that
has failed


   DNSSEC validation.  RFC4035 section 3.2.2 requires
a resolver


   processing a request with the CD bit set to set the CD
bit on its


   upstream queries.



   The guidance in RFC4035 is ambiguous about what to do
when a cached


   response was obtained with the CD bit not set. 



>> its also ambiguous what to do when a cached response was
obtained with the CD bit set and the query is for non-CD data.  E.g.
do you not cache the unvalidated data?



 In the typical case,


   no new query is required, nor does the cache need to
track the state


   of the CD bit used to make a given query.  



>> This sentence appears to be wrong, but for the wrong
reason.  You need to track the CD bit not because of the CD bit
queries but because of the non-CD bit queries.  See below and my
diagram.



The problem arises when


   the cached response is a server failure (RCODE 2), which
may indicate


   that the requested data failed DNSSEC validation at an
upstream


   validating resolver.  (RFC2308 permits caching of
server failures for


   up to five minutes.)  In these cases, a new query
with the CD bit set


   is required.



>> the language David proposed was wrong, the above is
correct.



   For efficiency, a validator may wish to set the CD bit
on all


   upstream queries when it has a trust anchor at or above
the QNAME


   (and thus can reasonably expect to be able to validate
the response).
>> this doesn't appear to be an efficiency issue.  A resolver SHOULD/MUST set the CD bit on all TA covered upstream queries, otherwise it's not getting the data to do its job.  Sam made a counter argument in the 3/30 exchange which I believe is contrived, but at least marginally possible.  The text for his covering the implementation of his argument would have this be something like:  "The resolver MAY implement an option to to clear the CD bit on any or all  TA-coverd non-CD bit queries to take advantage of validation at resolver closer to the authoritative servers"   To be blunt, I think this is a bad idea - if you want to do this, simply remove your local TAs. 
The -11 text ignores a number of subcases.  See my diagram of 3/24 but basically


if query CD bit is set
if response is cached
if SERVFAIL is cached
Set CD bit upstream and query
Else
Return cached
else // response not cached
Set CD bit upstream and query
else // query CD bit clear
if response is cached
if cached response had CD bit set
if resolver has covering trust anchor
run validation against cached and return
else // resolver can't validate locally and data wasn't validated upstream
clear CD bit and query
else // prev data was validated upstream if at all
return cached data
else // response not cached
if resolver has covering trust anchor
set CD bit and query then validate locally
else
clear CD bit query and return


While looking at this, I realized that it may be possible to "poison" the cache of a non-validating (but DNSSEC away) intermediate resolver by passing it a CD bit set query.  Later queries to that same data - unless the resolver realizes it needs to requery - may get the non-validated data and I can't see any text either in 4035 or -11 that would prevent this.

Mike





A
--
Andrew Sullivan
ajs@shinkuro.com
Shinkuro, Inc.

--=====================_103687920==.ALT-- From owner-namedroppers@ops.ietf.org Fri May 14 18:10:09 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AEDD73A68BC; Fri, 14 May 2010 18:10:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.318 X-Spam-Level: ** X-Spam-Status: No, score=2.318 tagged_above=-999 required=5 tests=[AWL=-0.409, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5l9cJ0Mkkt6h; Fri, 14 May 2010 18:10:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1CB103A68B3; Fri, 14 May 2010 18:10:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OD5jh-0003KU-Iz for namedroppers-data0@psg.com; Sat, 15 May 2010 01:00:13 +0000 Received: from [209.85.212.180] (helo=mail-px0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OD5jR-0003IV-JE for namedroppers@ops.ietf.org; Sat, 15 May 2010 00:59:57 +0000 Received: by pxi17 with SMTP id 17so1775075pxi.11 for ; Fri, 14 May 2010 17:59:56 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.38.31 with SMTP id q31mr1723348waj.113.1273885196768; Fri, 14 May 2010 17:59:56 -0700 (PDT) Received: by 10.114.25.9 with HTTP; Fri, 14 May 2010 17:59:56 -0700 (PDT) Date: Fri, 14 May 2010 17:59:56 -0700 Message-ID: Subject: [dnsext] Feedback on draft-ietf-dnsext-rfc2671bis-edns0 From: Matthew Dempsky To: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Section 3: > EDNS support is mandatory in a modern world. Is this informative or normative text? Assuming informative, I suggest rephrasing as something like "Many modern uses of DNS necessitate support for EDNS." > In order to support this, DNS > servers, middleware, and stub resolvers MUST support larger packet > sizes advertised via EDNS0. Is this intended to be all DNS servers, middleware, and stub resolvers, or just EDNS-supporting software? I suggest explicitly specifying that "DNS servers, middleware, and stub resolvers implement EDNS MUST support ...". It's unclear to me exactly what it means to "support larger packet sizes advertised by EDNS" means. Is it okay to just just support 513-byte packets? If a server wants to send a 2000 byte response, and the client has advertised the ability to do so, is it a violation of the draft to send a truncated response? Also, this seems like an odd place for this requirement text. Why not closer to where the packet size advertisement is actually defined? Section 4.1: > The DNS Message Header's second full 16-bit word is divided into a > 4-bit OPCODE, a 4-bit RCODE, and a number of 1-bit flags (see , > section 4.1.1 [RFC1035]). Looks like a typo in the citations. I'm guessing it meant to be something like "see [RFC1035], section 4.1.1"? Section 4.3: > Today, many organizations wish to return many > records in a single reply, and special tricks are needed to make the > responses fit in this 512-byte limit. I don't think it's so much that organizations want to return many records per se, but more generally that a number of DNS use cases are burdened by the 512-byte limit. I think rewording it as such would be appropriate; e.g., "Today, many DNS uses cases could benefit from using more or larger resource records, but are unduly burdened by this 512-byte limit." Section 6.1: > An OPT record does not carry any DNS data. It is used only to > contain control information pertaining to the question and answer > sequence of a specific transaction. OPT RRs MUST NOT be cached, > forwarded, or stored in or loaded from master files. Strictly speaking, this wording seems to rule out the possibility of EDNS options that might want to carry DNS records for some reason. As I can imagine worthwhile uses for that, I'd suggest rewording this to something like: As OPT records are not actual DNS records, in most cases they SHOULD NOT treated as such by DNS software. In particular, DNS software MUST ensure that OPT records are not cached, forwarded, or stored in or loaded from master zone files as though they were generic DNS records. However, the requirement that DNS software cannot forward OPT records stands in contrast with section 6.8 which requires that they forward it. Section 6.2: > The order of appearance of option tuples is not guaranteed. If one > option modifies the behavior of another or multiple options are > related to one another in some way, they have the same effect > regardless of ordering in the RDATA wire encoding. This disclaimer was not in RFC 2671. Is there a reason to add it rather than allow EDNS options to define the significance (if any) of their relative ordering? If not, I suggest removing this paragraph. Section 6.3: > The OPT record must not be cached. This section seems redundant with section 6.1, so I suggest removing it. Section 6.5: > Choosing a very large value will guarantee fragmentation at the IP > layer, and may prevent answers from being received due to a single > fragment loss or misconfigured firewalls. I think "guarantee" is the wrong word here, and "very large" is misleading: in the range of possible values for the payload size advertisement, most values could result in fragmentation. I suggest rewording as: Choosing a larger value risks fragmentation, which may prevent answers from being received due to a single fragment loss or misconfigured firewalls. > The requestor's maximum payload size can change over time. It MUST > not be cached for use beyond the transaction in which it is > advertised. I don't generally think of holding onto data still necessary to complete a transaction as "caching" it, so reading "X MUST NOT be cached for Y" makes me inherently think there might be cases other than Y where it's acceptable to cache X. However, I think the intent is that the maximum payload size value should never be used outside of the actual transaction it was part of. Also, it's worth pointing out that there might be multiple DNS clients running on the same host (or behind the same NAT), so it would additionally be incorrect to assume capabilities of one client apply to other clients on the same host. Section 6.8: > Middleware boxes MUST NOT limit DNS messages over UDP to 512 bytes. What should they do instead? Is it acceptable to limit to 513? Should they support any arbitrary sized UDP packet? (This seems outside of the scope of RFC2671bis though.) > Middleware boxes which simply forward requests to a recursive > resolver MUST NOT modify the OPT record contents in either direction. I think it's acceptable for middleware boxes to modify OPT records (e.g., adding or removing options, clamping payload size), but then perhaps tautologically that does not qualify as "simply forward[ing] requests" (i.e., the "intelligent forwarder" from the next section)? > Middleware boxes which have additional functionality, such as > answering certain queries or acting like an intelligent forwarder, > MUST understand the OPT record. These boxes MUST consider the > incoming request and any outgoing requests as separate transactions > if the characteristics of the messages are different. One thing that I think is worth defining is how a box can tell whether or not it's safe to forward an unknown option field. E.g., extensions like edns-ping and edns-client-ip are safe to forward. Are future extensions required to be similarly safe to blindly copy, or can some extensions alter the transaction structure or message format? Section 7: > Responders who do not implement these protocol extensions MUST > respond with FORMERR messages without any OPT record. This seems to stand in contrast against existing practice. Many DNS servers that don't support EDNS will just ignore the OPT record and respond as normal. (Heck, I understood this was the driving motivation for adding EDNS features in such an awkward fashion.) Finally, for Section 9, I'm still in support of having a range of option codes reserved for private use. I'd suggest adding text requesting IANA to reserve 65280--65534 for private use. From owner-namedroppers@ops.ietf.org Sat May 15 18:28:47 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DDA823A6837; Sat, 15 May 2010 18:28:47 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Duplicate header field: "Message-ID" X-Spam-Flag: NO X-Spam-Score: 3.616 X-Spam-Level: *** X-Spam-Status: No, score=3.616 tagged_above=-999 required=5 tests=[AWL=-0.533, BAYES_50=0.001, FH_RELAY_NODNS=1.451, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XvBlKZpLZvmF; Sat, 15 May 2010 18:28:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CFC223A67C1; Sat, 15 May 2010 18:28:46 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1ODSWk-000Jnl-1H for namedroppers-data0@psg.com; Sun, 16 May 2010 01:20:22 +0000 Received: from [159.226.7.146] (helo=cnnic.cn) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1ODSWg-000JnH-3p for namedroppers@ops.ietf.org; Sun, 16 May 2010 01:20:18 +0000 Received: (eyou send program); Sun, 16 May 2010 09:20:15 +0800 Message-ID: <473972815.11280@cnnic.cn> X-EYOUMAIL-SMTPAUTH: yaojk@cnnic.cn Received: from unknown (HELO abc) (127.0.0.1) by 127.0.0.1 with SMTP; Sun, 16 May 2010 09:20:15 +0800 Message-ID: <4AA641431B0C4A58A7FE0ADC1F71CD42@abc> From: "Yao Jiankang" To: "Andrew Sullivan" , References: <473778789.26681@cnnic.cn> <473850201.31393@cnnic.cn> Subject: Re: [dnsext] DNSEXT @ IETF-78 Date: Sun, 16 May 2010 09:20:15 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5931 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIkFuZHJldyBTdWxsaXZhbiIg PGFqc0BzaGlua3Vyby5jb20+DQpUbzogPG5hbWVkcm9wcGVyc0BvcHMuaWV0Zi5vcmc+DQpTZW50 OiBGcmlkYXksIE1heSAxNCwgMjAxMCAxMTowNSBQTQ0KU3ViamVjdDogUmU6IFtkbnNleHRdIERO U0VYVCBAIElFVEYtNzgNCg0KDQo+IE9uIEZyaSwgTWF5IDE0LCAyMDEwIGF0IDEwOjIxOjUyQU0g KzA4MDAsIEppYW5rYW5nIFlBTyB3cm90ZToNCj4+IA0KPj4gSSBzdWdnZXN0IHRvIGRpc2N1c3Mg dGhlIGRyYWZ0cyIgYm5hbWUgYW5kIHpvbmUgY2xvbmUgIiBpbiBJRVRGLTc4DQo+IA0KPiBXaGF0 IGlzIHRoZXJlIHRvIGRpc2N1c3MgaW4gdGhlIGRyYWZ0cz8NCj4gDQo+IFdlIGhhdmUgbm90IHll dCBtYWRlIGEgZGV0ZXJtaW5hdGlvbiBhYm91dCB3aGV0aGVyIHRoZXJlIGlzIHdvcmsgdG8gYmUN Cj4gZG9uZSBhdCBhbGwgb24gdGhpcyBnZW5lcmFsIHRvcGljLiAgVGhlIENoYWlycyBhcmUgcHJl cGFyaW5nIGFuDQo+IG91dGxpbmUgb2Ygd2hhdCB3ZSB0aGluayB0aGUgZGlzY3Vzc2lvbiBoYXMg eWllbGRlZC4gIChXZSBob3BlIHRvIGhhdmUNCj4gYSBkcmFmdCBvbiB0aGlzIHRvcGljIHBvc3Rl ZCBzb29uLikNCg0Kd2lsbCB5b3Ugc3VibWl0IHRoaXMgZHJhZnQ/DQppZiBwb3NzaWJsZSwNCkkg d2lsbCB0cnkgdG8gc3VibWl0IHRoZSBkcmFmdCByZWxhdGVkIHRvIHRoaXMgdG9waWMuDQoNCj4g DQo+IEJ1dCBldmVuIHN1cHBvc2luZyB3ZSBoYWQgbWFkZSBhIGRlY2lzaW9uIG9uIHRoYXQsIHdo YXQgYXJlIHRoZQ0KPiBwcmVjaXNlIG9wZW4gaXRlbXMgdGhhdCBuZWVkIHJlc29sdXRpb24gaW4g YSBXRyBtZWV0aW5nLCByYXRoZXIgdGhhbg0KPiBoZXJlIG9uIHRoZSBsaXN0LCB3aXRoIHRoZSBw cm9wb3NhbHMgaW4gdGhvc2UgZG9jdW1lbnRzPyANCg0KdW5kZXIgdGhpcyBzaXR1YXRpb24geW91 IGRlc2NyaWJlZCBhYm92ZSwgd2Ugd2lsbCBuZWVkIGEgV0cgbWVldGluZz8NCg0KDQo+IChJIGFt DQo+IGNvbXBsZXRlbHkgb3Bwb3NlZCB0byBoYXZpbmcgYSBtZWV0aW5nIGp1c3QgZm9yIHN0YXR1 cyB1cGRhdGVzIG9uDQo+IGRvY3VtZW50cy4gIFN0YXR1cyBjYW4gYmUgcHV0IG9uIGEgd2lraSBv ciBvbiB0aGUgbWFpbGluZyBsaXN0LikNCg0KdW5kZXJzdG9vZC4NCg0KVGhhbmtzIGEgbG90Lg0K DQoNCkppYW5rYW5nIFlhbw0KDQo+IA0KPiBCZXN0LA0KPiANCj4gQSAoc3BlYWtpbmcgZm9yIG15 c2VsZiwgYnV0IGFzIGNvLWNoYWlyKQ0KPiANCj4gLS0gDQo+IEFuZHJldyBTdWxsaXZhbg0KPiBh anNAc2hpbmt1cm8uY29tDQo+IFNoaW5rdXJvLCBJbmMuDQo+IA0KPg== From owner-namedroppers@ops.ietf.org Sun May 16 18:31:02 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 718F53A6C0E; Sun, 16 May 2010 18:31:02 -0700 (PDT) X-Quarantine-ID: <50REv7BxKYgs> X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Duplicate header field: "Message-ID" X-Spam-Flag: NO X-Spam-Score: 4.138 X-Spam-Level: **** X-Spam-Status: No, score=4.138 tagged_above=-999 required=5 tests=[AWL=-1.010, BAYES_60=1, FH_RELAY_NODNS=1.451, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 50REv7BxKYgs; Sun, 16 May 2010 18:31:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4F3C63A6C22; Sun, 16 May 2010 18:31:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1ODp2D-0005GL-Ec for namedroppers-data0@psg.com; Mon, 17 May 2010 01:22:21 +0000 Received: from [159.226.7.146] (helo=cnnic.cn) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1ODp2A-0005Fu-BR for namedroppers@ops.ietf.org; Mon, 17 May 2010 01:22:18 +0000 Received: (eyou send program); Mon, 17 May 2010 09:22:16 +0800 Message-ID: <474059336.22856@cnnic.cn> X-EYOUMAIL-SMTPAUTH: yaojk@cnnic.cn Received: from unknown (HELO lenovo47e041cf) (127.0.0.1) by 127.0.0.1 with SMTP; Mon, 17 May 2010 09:22:16 +0800 Message-ID: <4C1E9A685DE640FB8D009532564EA37B@LENOVO47E041CF> From: "Jiankang YAO" To: "Paul Vixie" , References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> Subject: (bname)Re: [dnsext] shadow zones Date: Mon, 17 May 2010 09:22:20 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5931 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQoNCkkgaG9wZSB0aGF0IHRoZSB3ZyB0YWtlIHVwIGJuYW1lIGFzIGEgd29yayBpdGVtLCB0b28u DQoNCkJuYW1lIGFuZCB6b25lIGNsb25lIGFyZSBkaWZmZXJlbnQgc29sdXRpb25zLg0KU29tZSBj dXN0b21lcnMgd2lsbCBzZWxlY3QgYm5hbWUsIHNvbWUgd2lsbCBzZWxlY3Qgem9uZSBjbG9uZSBh Y2NvcmRpbmcgdG8gdGhlaXIgb3duIG5lZWRzLg0KDQpUaGFua3MgYSBsb3QuDQoNCkppYW5rYW5n IFlhbw0KDQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIlBhdWwgVml4aWUi IDx2aXhpZUBpc2Mub3JnPg0KVG86IDxuYW1lZHJvcHBlcnNAb3BzLmlldGYub3JnPg0KU2VudDog VHVlc2RheSwgTWFyY2ggMDIsIDIwMTAgODoxNCBBTQ0KU3ViamVjdDogUmU6IFtkbnNleHRdIHNo YWRvdyB6b25lcyANCg0KDQo+IG9uZSBtb3JlIHRoaW5nOiBpIHJlcXVlc3QgdGhhdCB0aGUgd2cg dGFrZSB1cCBzaGFkb3cgem9uZXMgYXMgYSB3b3JrIGl0ZW0uDQo+ From owner-namedroppers@ops.ietf.org Mon May 17 04:29:20 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A09BF3A67B7; Mon, 17 May 2010 04:29:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.281 X-Spam-Level: X-Spam-Status: No, score=-7.281 tagged_above=-999 required=5 tests=[AWL=-2.582, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, RCVD_IN_DNSWL_HI=-8, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gBwJFDFxtt4G; Mon, 17 May 2010 04:29:19 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 350E528C141; Mon, 17 May 2010 04:22:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1ODyGl-000GQv-5G for namedroppers-data0@psg.com; Mon, 17 May 2010 11:13:59 +0000 Received: from [213.248.199.23] (helo=mx3.nominet.org.uk) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1ODyGi-000GQU-F2 for namedroppers@ops.ietf.org; Mon, 17 May 2010 11:13:56 +0000 DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:Received:Received:From:To:Subject: Thread-Topic:Thread-Index:Date:Message-ID:In-Reply-To: Accept-Language:Content-Language:X-MS-Has-Attach: X-MS-TNEF-Correlator:Content-Type:Content-ID: Content-Transfer-Encoding:MIME-Version:Return-Path; b=fwDVOJP50ZBelM+70B47G9pH24VobbKpZPn98ppjzdnl/eZW5HN+faAz tn6gAuB4hwwSbEWWIPN6/o+jwb4Wxu9gYq1xrAJ4/tNCp6565qNBNd+uz pre+9ojkr0KU69c; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=Ray.Bellis@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1274094836; x=1305630836; h=from:sender:reply-to:subject:date:message-id:to:cc: mime-version:content-transfer-encoding:content-id: content-description:resent-date:resent-from:resent-sender: resent-to:resent-cc:resent-message-id:in-reply-to: references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:list-owner:list-archive; z=From:=20Ray=20Bellis=20 |Subject:=20Re:=20[dnsext]=20draft-kerr-ixfr-only-01 |Date:=20Mon,=2017=20May=202010=2011:13:52=20+0000 |Message-ID:=20 |To:=20Andrew=20Sullivan=20,=20"namedro ppers@ops.ietf.org"=0D=0A=09 |MIME-Version:=201.0|Content-Transfer-Encoding:=20quoted- printable|Content-ID:=20|In-Reply-To:=20<20100514145956.GF65855@shinkuro.com >; bh=uqa71EzHQgPSQsRbMTILHY5DlGZt9BThAH8is22axKs=; b=r73Rcc2xwhVL9ZoETqf64VOPgv+6C2SyyhxUGfKCwhT3USNJ/fmAm8f/ vKriEIzbvZDwLHVUKhi9BPwQAkLRgjap975UMPQPqCY4E+jL3/q5BIhw7 jVf4Pyy6HroIvXV; X-IronPort-AV: E=Sophos;i="4.53,247,1272841200"; d="scan'208";a="24303642" Received: from wds-exc2.okna.nominet.org.uk ([213.248.197.145]) by mx3.nominet.org.uk with ESMTP; 17 May 2010 12:13:54 +0100 Received: from BDC-WDS-EXC1.okna.nominet.org.uk (2002:d5f8:c592::d5f8:c592) by wds-exc2.okna.nominet.org.uk (2002:d5f8:c591::d5f8:c591) with Microsoft SMTP Server (TLS) id 14.0.639.21; Mon, 17 May 2010 12:13:53 +0100 Received: from WDS-EXC1.okna.nominet.org.uk ([fe80::1593:1394:a91f:8f5f]) by bdc-wds-exc1.okna.nominet.org.uk ([fe80::784f:9067:6a1a:ab8f%18]) with mapi; Mon, 17 May 2010 12:13:53 +0100 From: Ray Bellis To: Andrew Sullivan , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Thread-Topic: [dnsext] draft-kerr-ixfr-only-01 Thread-Index: AQHK83eKaIZEAIzRDkKr76jSrwTBrpJVfSAA Date: Mon, 17 May 2010 11:13:52 +0000 Message-ID: In-Reply-To: <20100514145956.GF65855@shinkuro.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 14/05/2010 15:59, "Andrew Sullivan" wrote: > Dear colleagues, >=20 > There has previously been some interest expressed in the draft > draft-kerr-ixfr-only-01, and we've had a request to adopt it. > However, we have not had the requisite five people committing to > review through WGLC. >=20 > In my opinion, the document is mostly complete. We could knock this > off pretty quickly if we had committed reviewers. So far we have two > people who said they'd review, with a third conditional offer. +1 for another conditional offer. In particular I'd also like to see discussion around Alfred's text (below) > Since ixfr-only needs EDNS anyway (for a new [extended] RCODE), > it should be considered to signal new behavior for IXFR (and allow > for additional feedback if necessary) via a new EDNS Option (for > use with IXFR only), thus avoiding the introduction of a new QTYPE. Ray From owner-namedroppers@ops.ietf.org Mon May 17 04:51:07 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9CD5A28C16B; Mon, 17 May 2010 04:51:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.55 X-Spam-Level: *** X-Spam-Status: No, score=3.55 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_NL=0.55, HELO_MISMATCH_NL=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Spc6n+0wwjAX; Mon, 17 May 2010 04:51:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3F4F428C16C; Mon, 17 May 2010 04:44:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1ODydr-000JFA-3N for namedroppers-data0@psg.com; Mon, 17 May 2010 11:37:51 +0000 Received: from [131.174.66.174] (helo=smtpout1.ru.nl) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1ODydo-000JE4-7C for namedroppers@ops.ietf.org; Mon, 17 May 2010 11:37:48 +0000 X-Virus-Scanned: by AMaViS & ClamAV Received: from tjeb.nl (vhe-520087.sshn.net [195.169.221.157]) by smtp.ru.nl (Postfix) with ESMTP id 5567415D864; Mon, 17 May 2010 13:34:56 +0200 (CEST) Received: from [192.168.8.11] (dragon [192.168.8.11]) by tjeb.nl (Postfix) with ESMTP id CCE62CFA24; Mon, 17 May 2010 13:35:03 +0200 (CEST) Message-ID: <4BF129E7.2000901@isc.org> Date: Mon, 17 May 2010 13:35:03 +0200 From: Jelte Jansen User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Andrew Sullivan CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <20100514145956.GF65855@shinkuro.com> In-Reply-To: <20100514145956.GF65855@shinkuro.com> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/14/2010 04:59 PM, Andrew Sullivan wrote: > Dear colleagues, > > There has previously been some interest expressed in the draft > draft-kerr-ixfr-only-01, and we've had a request to adopt it. > However, we have not had the requisite five people committing to > review through WGLC. > > In my opinion, the document is mostly complete. We could knock this > off pretty quickly if we had committed reviewers. So far we have two > people who said they'd review, with a third conditional offer. > > If we do _not_ have committed reviewers by 17:00 UTC on 2010-05-21, > the Chairs will take that as an indication of a lack of interest in > the draft, and will assume that the WG does not want to do this work. > I'll sign up for reviewing it Jelte -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkvxKecACgkQ4nZCKsdOncXoRwCgp1ZOXuWYLQrScJcdcI8xnJtu TUsAn2YmrKa5BrJ9t2L50E2ElxGaqSne =/zbI -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Mon May 17 05:06:09 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EA1AC3A6B83; Mon, 17 May 2010 05:06:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.335 X-Spam-Level: X-Spam-Status: No, score=-0.335 tagged_above=-999 required=5 tests=[AWL=0.160, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id biKzXuNMIwGB; Mon, 17 May 2010 05:06:09 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 01DB03A6A81; Mon, 17 May 2010 04:59:25 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1ODyuW-000LXV-Sx for namedroppers-data0@psg.com; Mon, 17 May 2010 11:55:04 +0000 Received: from [195.54.233.65] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1ODyuU-000LWw-1u for namedroppers@ops.ietf.org; Mon, 17 May 2010 11:55:02 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jim) by hutch.rfc1035.com (Postfix) with ESMTPSA id 63D381542837; Mon, 17 May 2010 12:54:59 +0100 (BST) Cc: namedroppers Message-Id: <645AE459-FABC-4139-9F8E-F9CB9866CEAF@rfc1035.com> From: Jim Reid To: Olafur Gudmundsson In-Reply-To: <4BED8AD7.8020801@ogud.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] EDNS0-bis document next steps Date: Mon, 17 May 2010 12:54:58 +0100 References: <4BED8AD7.8020801@ogud.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 14 May 2010, at 18:39, Olafur Gudmundsson wrote: > SHOULD the document specify a criteria for the expert(s) ? Maybe. OTOH, RFC5395 has almost no criteria for the experts who review new RRtype code assignments. So perhaps the EDNS0-bis document should follow what was done for 5395. From owner-namedroppers@ops.ietf.org Mon May 17 07:45:09 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EA85C3A6BFA; Mon, 17 May 2010 07:45:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.391 X-Spam-Level: * X-Spam-Status: No, score=1.391 tagged_above=-999 required=5 tests=[AWL=-1.609, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CfaTjC-n5p8k; Mon, 17 May 2010 07:45:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1C0683A6CA0; Mon, 17 May 2010 07:44:07 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE1Si-000HLt-4G for namedroppers-data0@psg.com; Mon, 17 May 2010 14:38:32 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE1Sf-000HKo-7d for namedroppers@ops.ietf.org; Mon, 17 May 2010 14:38:29 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id C6F3E1ECB41D for ; Mon, 17 May 2010 14:38:27 +0000 (UTC) Date: Mon, 17 May 2010 10:38:12 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Message-ID: <20100517143811.GA77756@shinkuro.com> References: <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <20100514135457.GA65855@shinkuro.com> <20100514195525.GL65855@shinkuro.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 14, 2010 at 08:41:31PM -0400, Michael StJohns wrote: > -08 is where the above text comment was made (and never acted upon), -11 inserted instead: > > When processing a request with the CD bit set, a resolver SHOULD > > > > the SHOULD mirrors the "SHOULD" in 4035 3.2.2, but probably should > be a MUST. More than one person has responded to your suggestion here by saying it's too prescriptive. I'm not entirely sure I agree, but to the extent there's been responses, most of them have disagreed with MUST. > The language in 3.2.2 is pretty clear what the intent of > the CD bit is - resolver is not responsible for validation. My reading is that the CD bit is not saying, "You're not responsible," but rather, "Give me everything." > Otherwise, just add something like "An intermediate resolver MAY > implement an option to be configured to ignore the CD bit in > queries, in which case it behaves exactly as if the CD bit were not > set. The option MUST default to non-ignore" to the CD section I sort of hate the idea of "disable checking disabled", which I think is what you're suggesting there. > this doesn't appear to be an efficiency issue. A resolver > SHOULD/MUST set the CD bit on all TA covered upstream queries, > otherwise it's not getting the data to do its job. Sam made a > counter argument in the 3/30 exchange which I believe is contrived, > but at least marginally possible. The text for his covering the > implementation of his argument would have this be something like: > "The resolver MAY implement an option to to clear the CD bit on any > or all TA-coverd non-CD bit queries to take advantage of validation > at resolver closer to the authoritative servers" To be blunt, I > think this is a bad idea - if you want to do this, simply remove > your local TAs. I don't think that was what he was saying, but I'll defer to him. I have the impression that you're making this slightly more complicated than it really is. In particular, I looked at your diagram, but I still don't get how it entails the strong requirements you seem to want. I'm also not entirely sure what text you want in the document -- if you could supply actual text for evaluation, that would help. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Mon May 17 08:31:48 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5D7AB28C125; Mon, 17 May 2010 08:31:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.041 X-Spam-Level: * X-Spam-Status: No, score=1.041 tagged_above=-999 required=5 tests=[AWL=-1.218, BAYES_20=-0.74, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ikoJJjzollSg; Mon, 17 May 2010 08:31:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9AB8A3A6D39; Mon, 17 May 2010 08:27:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE2AE-000O7U-Vm for namedroppers-data0@psg.com; Mon, 17 May 2010 15:23:31 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE2AB-000O63-OF for namedroppers@ops.ietf.org; Mon, 17 May 2010 15:23:27 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id B8C631ECB41D for ; Mon, 17 May 2010 15:23:24 +0000 (UTC) Date: Mon, 17 May 2010 11:23:23 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Message-ID: <20100517152322.GF77756@shinkuro.com> References: <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <20100514135457.GA65855@shinkuro.com> <20100514195525.GL65855@shinkuro.com> <2CC6D6735E144D7EAF749B399E36F361@local> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2CC6D6735E144D7EAF749B399E36F361@local> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sat, May 15, 2010 at 03:19:38PM +0100, George Barwood wrote: > The objectives are > (a) As much validation as possible is performed when answering CD=0 queries. By whom? Why is this a goal? > (b) Validation failures are to be avoided when answering CD=1 queries. Why are they to be avoided? Obviously, we want _false_ validation failures not to happen. But we always want that. And validation failures by whom? Presumably by the querying client? A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Mon May 17 11:21:06 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4944B3A6AA8; Mon, 17 May 2010 11:21:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.477 X-Spam-Level: X-Spam-Status: No, score=-102.477 tagged_above=-999 required=5 tests=[AWL=0.123, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AX66KuaYIm65; Mon, 17 May 2010 11:21:03 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A1CF03A6AB2; Mon, 17 May 2010 11:20:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE4qD-000Nng-1O for namedroppers-data0@psg.com; Mon, 17 May 2010 18:15:01 +0000 Received: from [2001:1890:1112:1::20] (helo=mail.ietf.org) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE4q8-000Nmj-Tf for namedroppers@ops.ietf.org; Mon, 17 May 2010 18:14:57 +0000 Received: by core3.amsl.com (Postfix, from userid 0) id 689DC3A6AC1; Mon, 17 May 2010 11:15:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Cc: namedroppers@ops.ietf.org Subject: [dnsext] I-D Action:draft-ietf-dnsext-dnssec-registry-fixes-04.txt Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20100517181502.689DC3A6AC1@core3.amsl.com> Date: Mon, 17 May 2010 11:15:02 -0700 (PDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Extensions Working Group of the IETF. Title : DNS Security (DNSSEC) DNSKEY IANA Registry Algorithm Status Addition Author(s) : S. Rose Filename : draft-ietf-dnsext-dnssec-registry-fixes-04.txt Pages : 9 Date : 2010-05-17 The DNS Security Extensions (DNSSEC) has an IANA registry to allocate cryptographic algorithm suites for use in generating digital signatures over DNS data. Newly introduced cryptographic algorithms to DNSSEC mean implementors need to know which algorithms need to be implemented, which are optional, and which are obsolete. This document adds a column to the IANA registry table for Domain Name System Security (DNSSEC) Algorithm Numbers which lists their current status for use. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-registry-fixes-04.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-dnsext-dnssec-registry-fixes-04.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-05-17110056.I-D@ietf.org> --NextPart-- From owner-namedroppers@ops.ietf.org Mon May 17 12:54:10 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C71BC3A680E; Mon, 17 May 2010 12:54:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.966 X-Spam-Level: ** X-Spam-Status: No, score=2.966 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QoQ6N8dFebCf; Mon, 17 May 2010 12:54:10 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CD6C43A6358; Mon, 17 May 2010 12:54:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE6Ie-000BSP-74 for namedroppers-data0@psg.com; Mon, 17 May 2010 19:48:28 +0000 Message-Id: Received: from [76.96.30.64] (helo=qmta07.emeryville.ca.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE6Ib-000BRB-4f for namedroppers@ops.ietf.org; Mon, 17 May 2010 19:48:25 +0000 Received: from omta07.emeryville.ca.mail.comcast.net ([76.96.30.59]) by qmta07.emeryville.ca.mail.comcast.net with comcast id JdTe1e0031GXsucA7joRDl; Mon, 17 May 2010 19:48:25 +0000 Received: from Mike-PC3.comcast.net ([98.250.33.228]) by omta07.emeryville.ca.mail.comcast.net with comcast id JjoN1e0034vKbZu8UjoPFM; Mon, 17 May 2010 19:48:25 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 17 May 2010 15:48:19 -0400 To: Andrew Sullivan ,namedroppers@ops.ietf.org From: Michael StJohns Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data In-Reply-To: <20100517152322.GF77756@shinkuro.com> References: <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <20100514135457.GA65855@shinkuro.com> <20100514195525.GL65855@shinkuro.com> <2CC6D6735E144D7EAF749B399E36F361@local> <20100517152322.GF77756@shinkuro.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Let me hit this one first and then go back and deal with your other email. At 11:23 AM 5/17/2010, Andrew Sullivan wrote: >On Sat, May 15, 2010 at 03:19:38PM +0100, George Barwood wrote: >> The objectives are >> (a) As much validation as possible is performed when answering CD=0 queries. > >By whom? Why is this a goal? I assume George meant "as much validation as possible is performed [by an intermediate validating resolver] etc..." Are you saying this isn't a goal of the general DNSSEC design? If you believe it isn't then we're really on separate pages. >> (b) Validation failures are to be avoided when answering CD=1 queries. > >Why are they to be avoided? Obviously, we want _false_ validation >failures not to happen. But we always want that. And validation >failures by whom? Presumably by the querying client? Again, George meant by the intermediate resolver. CD stands for "Checking Disabled" and is a request to the upstream resolver to pass through raw data - or that how its always been described to me. E.g. don't attempt to do validation, just pretend you know nothing at all about DNSSEC and give me the raw data as if I had asked the upstream server myself. So I wouldn't phrase it as "have the intermediate resolver avoid validation failure" so much as "have the intermediate resolver get the hell out of my way and just let me do my own validation if I so choose". I state forcefully that it is a REQUIREMENT that if the CD bit is set, absent any [stupid] policy by a containing organization, that an end entity be able to get to raw data if it asks for it. This may be the only thing that saves us when (note that I do not say if) some upstream validating resolver manages to screw up the trust anchor (or the signing authority screws up the signatures) for .COM and makes the entire .COM tree disappear to those stuck behind validating resolvers. Mike >A >-- >Andrew Sullivan >ajs@shinkuro.com >Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Mon May 17 13:57:02 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 54CB93A6907; Mon, 17 May 2010 13:57:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.338 X-Spam-Level: * X-Spam-Status: No, score=1.338 tagged_above=-999 required=5 tests=[AWL=-1.476, BAYES_40=-0.185, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Td7eU4xdnPAT; Mon, 17 May 2010 13:57:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6FBE83A680E; Mon, 17 May 2010 13:57:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE7IA-000J6c-TY for namedroppers-data0@psg.com; Mon, 17 May 2010 20:52:02 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE7I8-000J5m-Fo for namedroppers@ops.ietf.org; Mon, 17 May 2010 20:52:00 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 23CF31ECB41D for ; Mon, 17 May 2010 20:51:59 +0000 (UTC) Date: Mon, 17 May 2010 16:51:57 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Message-ID: <20100517205157.GO77756@shinkuro.com> References: <4BAC7776.3090106@nlnetlabs.nl> <20100514135457.GA65855@shinkuro.com> <20100514195525.GL65855@shinkuro.com> <2CC6D6735E144D7EAF749B399E36F361@local> <20100517152322.GF77756@shinkuro.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, May 17, 2010 at 03:48:19PM -0400, Michael StJohns wrote: > I assume George meant "as much validation as possible is performed > [by an intermediate validating resolver] etc..." Are you saying > this isn't a goal of the general DNSSEC design? If you believe it > isn't then we're really on separate pages. But that's not consistent with what you go on to say: > So I wouldn't phrase it as "have the intermediate resolver avoid > validation failure" so much as "have the intermediate resolver get > the hell out of my way and just let me do my own validation if I so > choose". > > I state forcefully that it is a REQUIREMENT that if the CD bit is > set, absent any [stupid] policy by a containing organization, that > an end entity be able to get to raw data if it asks for it. This If the goal of CD is in fact, "Give me everything, even if you have to go get it to see whether it's out there," then I agree that this is a clarification we need to make; but it does not mean "as much validation as possible". It means, instead, exactly the validation that the requesting client can do and nothing else. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Mon May 17 14:14:22 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E9193A6A90; Mon, 17 May 2010 14:14:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.198 X-Spam-Level: ** X-Spam-Status: No, score=2.198 tagged_above=-999 required=5 tests=[AWL=-0.646, BAYES_50=0.001, FH_RELAY_NODNS=1.451, MISSING_HEADERS=1.292, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2sYxHAykzaOA; Mon, 17 May 2010 14:14:20 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 67D913A6AAA; Mon, 17 May 2010 14:14:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE7aI-000LQc-7I for namedroppers-data0@psg.com; Mon, 17 May 2010 21:10:46 +0000 Received: from [202.46.183.22] (helo=srsomail.nzrs.net.nz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE7aF-000LQ8-0j for namedroppers@ops.ietf.org; Mon, 17 May 2010 21:10:43 +0000 Received: from localhost (srsomail.office.nzrs.net.nz [202.46.183.22]) by srsomail.nzrs.net.nz (Postfix) with ESMTP id 2327D2DA6AB for ; Tue, 18 May 2010 09:10:41 +1200 (NZST) Received: from srsomail.nzrs.net.nz ([202.46.183.22]) by localhost (srsomail.office.nzrs.net.nz [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 65i7Yidc7OpQ for ; Tue, 18 May 2010 09:10:41 +1200 (NZST) Received: from [192.168.22.190] (unknown [202.46.183.35]) (Authenticated sender: sebastian) by srsomail.nzrs.net.nz (Postfix) with ESMTPSA id C54E22DA615 for ; Tue, 18 May 2010 09:10:40 +1200 (NZST) Message-ID: <4BF1B0CD.2090205@nzrs.net.nz> Date: Tue, 18 May 2010 09:10:37 +1200 From: Sebastian Castro User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 CC: "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: In-Reply-To: X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Ray Bellis wrote: > On 14/05/2010 15:59, "Andrew Sullivan" wrote: > >> Dear colleagues, >> >> There has previously been some interest expressed in the draft >> draft-kerr-ixfr-only-01, and we've had a request to adopt it. >> However, we have not had the requisite five people committing to >> review through WGLC. >> >> In my opinion, the document is mostly complete. We could knock this >> off pretty quickly if we had committed reviewers. So far we have two >> people who said they'd review, with a third conditional offer. > > +1 for another conditional offer. Count with me as reviewer. > > In particular I'd also like to see discussion around Alfred's text (below) > >> Since ixfr-only needs EDNS anyway (for a new [extended] RCODE), >> it should be considered to signal new behavior for IXFR (and allow >> for additional feedback if necessary) via a new EDNS Option (for >> use with IXFR only), thus avoiding the introduction of a new QTYPE. I'd like to extend on the "additional feedback" thought. Given EDNS is needed, it shouldn't be better that, when an IXFR client requests an IXFR-ONLY to an IXFR Server and the size of the AXFR is lower than the IXFR the IXFR Server signals this situation, letting to the IXFR client the final decision of requesting IXFR or AXFR based on their own policy? Given the IXFR client already has to keep some state about the IXFR Servers (which RCODE they replied), this a little piece of state that may help the client to decide if going to the faster (lower latency) server offering AXFR or slower server serving IXFR. Besides that, I have some additional comments: On Section 1, paragraph 2: The text starts with "In the document", but given the context, sounds more reasonable to say" In this document". On Section 3, paragraph 6 reads: "normally in situatians" and should read "normally in situations". And just being picky: Why the choice for CannotIXFR instead of IXFRNotAvail, for example? Cannot sounds to me like "I can't give you this for some reason", "NotAvail" sounds more like "I can't give it to you because I don't have it". Cheers! > > Ray > > -- Sebastian Castro DNS Specialist .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535 From owner-namedroppers@ops.ietf.org Mon May 17 14:45:34 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 74C133A6A70; Mon, 17 May 2010 14:45:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.966 X-Spam-Level: ** X-Spam-Status: No, score=2.966 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NAFcSxnBGrQG; Mon, 17 May 2010 14:45:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 19DF63A6B9E; Mon, 17 May 2010 14:45:25 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE82s-000OK6-R6 for namedroppers-data0@psg.com; Mon, 17 May 2010 21:40:18 +0000 Message-Id: Received: from [76.96.27.211] (helo=qmta11.emeryville.ca.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE82p-000OJp-AQ for namedroppers@ops.ietf.org; Mon, 17 May 2010 21:40:15 +0000 Received: from omta03.emeryville.ca.mail.comcast.net ([76.96.30.27]) by qmta11.emeryville.ca.mail.comcast.net with comcast id Jddp1e0020b6N64ABlgFVm; Mon, 17 May 2010 21:40:15 +0000 Received: from Mike-PC3.comcast.net ([98.250.33.228]) by omta03.emeryville.ca.mail.comcast.net with comcast id JlgC1e0014vKbZu8PlgDsl; Mon, 17 May 2010 21:40:15 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 17 May 2010 17:40:09 -0400 To: Andrew Sullivan ,namedroppers@ops.ietf.org From: Michael StJohns Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data In-Reply-To: <20100517143811.GA77756@shinkuro.com> References: <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <20100514135457.GA65855@shinkuro.com> <20100514195525.GL65855@shinkuro.com> <20100517143811.GA77756@shinkuro.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 10:38 AM 5/17/2010, Andrew Sullivan wrote: >On Fri, May 14, 2010 at 08:41:31PM -0400, Michael StJohns wrote: >> -08 is where the above text comment was made (and never acted upon), -11 inserted instead: >> >> When processing a request with the CD bit set, a resolver SHOULD >> >> >> >> the SHOULD mirrors the "SHOULD" in 4035 3.2.2, but probably should >> be a MUST. > >More than one person has responded to your suggestion here by saying >it's too prescriptive. I'm not entirely sure I agree, but to the >extent there's been responses, most of them have disagreed with MUST. See my email response to your response to George's later email. Having this as a MUST is a safety valve for when either the trust anchor or signatures get screwed up and you absolutely need to bypass DNSSEC validation. Without this, we're going to be captives of our ISP's query redirection and misconfigurations. >> The language in 3.2.2 is pretty clear what the intent of >> the CD bit is - resolver is not responsible for validation. > >My reading is that the CD bit is not saying, "You're not responsible," >but rather, "Give me everything." I'll go along with this. >> Otherwise, just add something like "An intermediate resolver MAY >> implement an option to be configured to ignore the CD bit in >> queries, in which case it behaves exactly as if the CD bit were not >> set. The option MUST default to non-ignore" to the CD section > >I sort of hate the idea of "disable checking disabled", which I think >is what you're suggesting there. I hate this too, but too many counter-arguments to this discussion have stated that whether the CD bit is set in the upstream from an intermediate resolver is a local policy (e.g. a SHOULD vs a MUST). I would argue then that whether or not you do validation for CD-bit set queries from a client should also be a local policy. E.g. either both or none. Since you don't know what's upstream of you - e.g. authoritative vs intermediate - you really need to do something consistent. >> this doesn't appear to be an efficiency issue. A resolver >> SHOULD/MUST set the CD bit on all TA covered upstream queries, >> otherwise it's not getting the data to do its job. Sam made a >> counter argument in the 3/30 exchange which I believe is contrived, >> but at least marginally possible. The text for his covering the >> implementation of his argument would have this be something like: >> "The resolver MAY implement an option to to clear the CD bit on any >> or all TA-coverd non-CD bit queries to take advantage of validation >> at resolver closer to the authoritative servers" To be blunt, I >> think this is a bad idea - if you want to do this, simply remove >> your local TAs. > >I don't think that was what he was saying, but I'll defer to him. I >have the impression that you're making this slightly more complicated >than it really is. In particular, I looked at your diagram, but I >still don't get how it entails the strong requirements you seem to >want. I'm also not entirely sure what text you want in the document >-- if you could supply actual text for evaluation, that would help. I did - its the if/then/else text in my earlier message. If there's a branch that you think is incorrect or not necessary, please point me to it and explain why I'm wrong. Basically, if I do a CD bit set query at the client, I want to be a) able to use the local intermediate resolver caches (because those are the ones I know about through auto configuration/DHCP), b) be assured that the intermediate resolver cache is passing through the original data from the authoritative servers. At the first intermediate resolver, I don't necessarily know that the upstream query will get directly to the authoritative server - it may get intercepted and redirected to another, higher level resolver (or the first intermediate resolver may have a configuration which directs certain subsets of queries to a non-authoritative server) which may or may not do validation (also something the first intermediate resolver may not be able to detect). This system should work - or be designed to work - regardless of the number of intermediate resolvers in the system. The design assumptions of a single intermediate resolver between the client and the authoritative server are not universally valid. Interestingly, the comment in -11 that says you don't have to track CD bit set on cached data is a little bit of sophistry -I'm still not convinced of this and I think it may be wrong - see below. So how about this for text: -11 section 3.1.1 and or 5.9 --- this may reflect current implementation practice, but I couldn't find this called out anywhere. "Security aware intermediate resolvers MUST set the CD bit on any upstream query for which they have a covering trust anchor (TA). Security aware intermediate resolvers SHOULD cache data returned from an upstream (server side) query which had the CD bit set. If the downstream (client side) query also has the CD bit set, the resolver MAY defer validation of this data (assuming a covering TA) until a later non-CD bit query for the same data, but MUST mark the cached data as non-validated until local validation actually occurs. Security aware intermediate resolvers SHOULD cache SERVFAIL responses returned from an upstream query. They MUST cache the state of the CD bit in all upstream queries as well. If a security aware intermediate resolvers receives a query for data which has a SERVFAIL cached, but with the CD bit set, the resolver MUST set the CD bit on the upstream query and cache BOTH the SERVFAIL and the returned data. Data in cache with the CD bit set which has not been locally validated MUST NOT be returned to a non-CD query. If the cached data has the CD bit set it may be returned to a CD query, and if a SERVFAIL is cached it may be returned to a non-CD query, otherwise this should be treated as a cache miss and the query repeated upstream." The above is closer, but may still be missing some corner cases. For the first paragraph, simply delete the TA if you don't want to force the setting of the CD bit. There is no way - programatically or protocol wise to determine if an upstream resolver can do validation over this query so making this a SHOULD makes no sense whatsoever. The second paragraph covers whether or not unvalidated data is cached and how to treat it. I couldn't find any discussion of tracking validation status in cache in either 4035 or -11, but it maybe somewhere else. If you have a covering TA and enough cycles it may be reasonable to do the validation at the same time even if the downstream (client) query has the CD bit set rather than having to track validation status. But from a resource POV, I'd rather delay it until someone actually asks to have it done (by not setting the CD bit). The last paragraph deals with an aware resolver which doesn't have a TA covering a CD query from a client. The same upstream query may result either in data (if the client sent a CD query upstream) or the SERVFAIL if it didn't. I think it also implies you have to track whether or not you did an upstream query with the CD bit if you want to serve data from cache. From owner-namedroppers@ops.ietf.org Mon May 17 14:49:33 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 01AC03A67E9; Mon, 17 May 2010 14:49:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.966 X-Spam-Level: ** X-Spam-Status: No, score=2.966 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5bbWhGZp9Qet; Mon, 17 May 2010 14:49:32 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C27353A62C1; Mon, 17 May 2010 14:49:17 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE889-000P9k-Br for namedroppers-data0@psg.com; Mon, 17 May 2010 21:45:45 +0000 Message-Id: Received: from [76.96.30.56] (helo=qmta06.emeryville.ca.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE885-000P9M-SO for namedroppers@ops.ietf.org; Mon, 17 May 2010 21:45:41 +0000 Received: from omta03.emeryville.ca.mail.comcast.net ([76.96.30.27]) by qmta06.emeryville.ca.mail.comcast.net with comcast id JdX61e0020b6N64A6lli8m; Mon, 17 May 2010 21:45:42 +0000 Received: from Mike-PC3.comcast.net ([98.250.33.228]) by omta03.emeryville.ca.mail.comcast.net with comcast id Jllg1e00F4vKbZu8Pllh0V; Mon, 17 May 2010 21:45:42 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 17 May 2010 17:45:38 -0400 To: Andrew Sullivan ,namedroppers@ops.ietf.org From: Michael StJohns Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data In-Reply-To: <20100517205157.GO77756@shinkuro.com> References: <4BAC7776.3090106@nlnetlabs.nl> <20100514135457.GA65855@shinkuro.com> <20100514195525.GL65855@shinkuro.com> <2CC6D6735E144D7EAF749B399E36F361@local> <20100517152322.GF77756@shinkuro.com> <20100517205157.GO77756@shinkuro.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 04:51 PM 5/17/2010, Andrew Sullivan wrote: >On Mon, May 17, 2010 at 03:48:19PM -0400, Michael StJohns wrote: > >> I assume George meant "as much validation as possible is performed >> [by an intermediate validating resolver] etc..." Are you saying >> this isn't a goal of the general DNSSEC design? If you believe it >> isn't then we're really on separate pages. > >But that's not consistent with what you go on to say: Sorry - you're confusing me with George. I want - "give me all" - George said "as much as possible". >> So I wouldn't phrase it as "have the intermediate resolver avoid >> validation failure" so much as "have the intermediate resolver get >> the hell out of my way and just let me do my own validation if I so >> choose". >> >> I state forcefully that it is a REQUIREMENT that if the CD bit is >> set, absent any [stupid] policy by a containing organization, that >> an end entity be able to get to raw data if it asks for it. This > >If the goal of CD is in fact, "Give me everything, even if you have to >go get it to see whether it's out there," I think that's exactly what it is. >then I agree that this is a >clarification we need to make; but it does not mean "as much >validation as possible". It means, instead, exactly the validation >that the requesting client can do and nothing else. And I agree that what I said wasn't "as much as possible".. :-) >A > >-- >Andrew Sullivan >ajs@shinkuro.com >Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Mon May 17 15:08:35 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0A8E93A6880; Mon, 17 May 2010 15:08:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.083 X-Spam-Level: * X-Spam-Status: No, score=1.083 tagged_above=-999 required=5 tests=[AWL=-1.176, BAYES_20=-0.74, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5Pli3rcVXQ-a; Mon, 17 May 2010 15:08:34 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 518E73A6925; Mon, 17 May 2010 15:08:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE8MQ-0001gh-GV for namedroppers-data0@psg.com; Mon, 17 May 2010 22:00:30 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OE8MN-0001dh-9o for namedroppers@ops.ietf.org; Mon, 17 May 2010 22:00:27 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 8144A1ECB41D for ; Mon, 17 May 2010 22:00:25 +0000 (UTC) Date: Mon, 17 May 2010 18:00:22 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Message-ID: <20100517220022.GQ77756@shinkuro.com> References: <20100514135457.GA65855@shinkuro.com> <20100514195525.GL65855@shinkuro.com> <2CC6D6735E144D7EAF749B399E36F361@local> <20100517152322.GF77756@shinkuro.com> <20100517205157.GO77756@shinkuro.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, May 17, 2010 at 05:45:38PM -0400, Michael StJohns wrote: > At 04:51 PM 5/17/2010, Andrew Sullivan wrote: > >On Mon, May 17, 2010 at 03:48:19PM -0400, Michael StJohns wrote: > > > >> I assume George meant "as much validation as possible is performed > >> [by an intermediate validating resolver] etc..." Are you saying > >> this isn't a goal of the general DNSSEC design? If you believe it > >> isn't then we're really on separate pages. > > > >But that's not consistent with what you go on to say: > > > Sorry - you're confusing me with George. I want - "give me all" - George said "as much as possible". I'm not confusing you. You appeared to be suggesting that as much validation as possible is supposed to be performed by someone as a goal of the general DNSSEC design (in your rhetorical question, reproduced above). I was just pointing out that that's not consistent with what you're claiming the CD bit is for. If CD means what I think you are saying it means (and I have some sympathy with that interpretation), then it cannot possibly be a design goal in general that we get as much validation as possible. And indeed, my reading of 4035 suggests that a security-aware validating recursive name server needn't do validation if it gets a query with CD set. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Mon May 17 17:59:59 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1EDC03A6BAF; Mon, 17 May 2010 17:59:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.966 X-Spam-Level: ** X-Spam-Status: No, score=2.966 tagged_above=-999 required=5 tests=[AWL=-0.001, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q6IytBsePiD9; Mon, 17 May 2010 17:59:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 69F2728C138; Mon, 17 May 2010 17:59:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEB47-000Ha7-Tg for namedroppers-data0@psg.com; Tue, 18 May 2010 00:53:47 +0000 Message-Id: Received: from [76.96.30.40] (helo=qmta04.emeryville.ca.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEB3x-000HYt-Kd for namedroppers@ops.ietf.org; Tue, 18 May 2010 00:53:37 +0000 Received: from omta07.emeryville.ca.mail.comcast.net ([76.96.30.59]) by qmta04.emeryville.ca.mail.comcast.net with comcast id Jcje1e0051GXsucA4otemw; Tue, 18 May 2010 00:53:38 +0000 Received: from Mike-PC3.comcast.net ([98.250.33.228]) by omta07.emeryville.ca.mail.comcast.net with comcast id Jota1e0034vKbZu8Uotb57; Tue, 18 May 2010 00:53:38 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 17 May 2010 20:53:30 -0400 To: Andrew Sullivan ,namedroppers@ops.ietf.org From: Michael StJohns Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data In-Reply-To: <20100517220022.GQ77756@shinkuro.com> References: <20100514135457.GA65855@shinkuro.com> <20100514195525.GL65855@shinkuro.com> <2CC6D6735E144D7EAF749B399E36F361@local> <20100517152322.GF77756@shinkuro.com> <20100517205157.GO77756@shinkuro.com> <20100517220022.GQ77756@shinkuro.com> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=====================_75123186==.ALT" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --=====================_75123186==.ALT Content-Type: text/plain; charset="us-ascii" At 06:00 PM 5/17/2010, Andrew Sullivan wrote: >On Mon, May 17, 2010 at 05:45:38PM -0400, Michael StJohns wrote: >> At 04:51 PM 5/17/2010, Andrew Sullivan wrote: >> >On Mon, May 17, 2010 at 03:48:19PM -0400, Michael StJohns wrote: >> > >> >> I assume George meant "as much validation as possible is performed >> >> [by an intermediate validating resolver] etc..." Are you saying >> >> this isn't a goal of the general DNSSEC design? If you believe it >> >> isn't then we're really on separate pages. >> > >> >But that's not consistent with what you go on to say: >> >> >> Sorry - you're confusing me with George. I want - "give me all" - George said "as much as possible". > >I'm not confusing you. You appeared to be suggesting that as much >validation as possible is supposed to be performed by someone as a >goal of the general DNSSEC design (in your rhetorical question, >reproduced above). Heh... you're still misreading this - a bunch of cross references I think. I was asking simply if you disagreed with George's statement that this was a goal, not whether or not the goal trumped the setting of the CD bit. George said that one general goal of DNSSEC was to do as much validation as possible at intermediate resolvers - that's correct and I think you agree that was a goal in the design.. But setting the CD bit is the escape clause. Which discussion was in a separate paragraph. So two separate items: 1) DNSSEC goal is to do as much validation as possible in intermediate resolvers. (I don't necessarily think this was a good goal by the way). 2) If the CD bit is set, intermediate resolvers should get out of the way and just pass through the unvalidated data. > I was just pointing out that that's not consistent >with what you're claiming the CD bit is for. If CD means what I think >you are saying it means (and I have some sympathy with that >interpretation), then it cannot possibly be a design goal in general >that we get as much validation as possible. Yes. Agreed. Done. Again - you're conflating two different discussions and responses into one item. So I hopefully think were past that now? >And indeed, my reading of >4035 suggests that a security-aware validating recursive name server >needn't do validation if it gets a query with CD set. And its not just "Suggests" From 4035: A security-aware resolver MAY set a query's CD bit in order to indicate that the resolver takes responsibility for performing whatever authentication its local policy requires on the RRsets in the response. >From 4033: (emphasis mine) Thus, a security-aware resolver that is part of a security-aware recursive name server will have to pay careful attention to the DNSSEC "checking disabled" (CD) bit ([RFC4034]). This is in order to avoid blocking valid signatures from getting through to other security-aware resolvers that are clients of this recursive name server. [Side note - the ref above is wrong, the CD bit isn't mentioned in 4034] So with respect to the answer to the querier, someone receiving a CD bit set query is not responsible for returning post-validation data. HOWEVER, this doesn't talk about what has to happen locally with respect to caching of the CD bit set data and whether or not validation need be done before caching, marking etc. Mike >A > > >-- >Andrew Sullivan >ajs@shinkuro.com >Shinkuro, Inc. --=====================_75123186==.ALT Content-Type: text/html; charset="us-ascii" At 06:00 PM 5/17/2010, Andrew Sullivan wrote:
On Mon, May 17, 2010 at 05:45:38PM -0400, Michael StJohns wrote:
> At 04:51 PM 5/17/2010, Andrew Sullivan wrote:
> >On Mon, May 17, 2010 at 03:48:19PM -0400, Michael StJohns wrote:
> >
> >> I assume George meant "as much validation as possible is performed
> >> [by an intermediate validating resolver] etc..."  Are you saying
> >> this isn't a goal of the general DNSSEC design?  If you believe it
> >> isn't then we're really on separate pages.
> >
> >But that's not consistent with what you go on to say:
>
>
> Sorry - you're confusing me with George.  I want - "give me all" - George said "as much as possible".

I'm not confusing you.  You appeared to be suggesting that as much
validation as possible is supposed to be performed by someone as a
goal of the general DNSSEC design (in your rhetorical question,
reproduced above).

Heh... you're still misreading this - a bunch of cross references I think.  I was asking simply if you disagreed with George's statement that this was a goal, not whether or not the goal trumped the setting of the CD bit.

George said that one general goal of DNSSEC was to do as much validation as possible at intermediate resolvers  - that's correct and I think you agree that was a goal in the design..  But setting the CD bit is the escape clause.   Which discussion was in a separate paragraph.


So two separate items:

1) DNSSEC goal is to do as much validation as possible in intermediate resolvers.  (I don't necessarily think this was a good goal by the way).
2) If the CD bit is set, intermediate resolvers should get out of the way and just pass through the unvalidated data.


  I was just pointing out that that's not consistent
with what you're claiming the CD bit is for.  If CD means what I think
you are saying it means (and I have some sympathy with that
interpretation), then it cannot possibly be a design goal in general
that we get as much validation as possible. 

Yes.  Agreed.  Done.
Again - you're conflating two different discussions and responses into one item.  So I hopefully think were past that now?

And indeed, my reading of
4035 suggests that a security-aware validating recursive name server
needn't do validation if it gets a query with CD set.


And its not just "Suggests"  From 4035:

A security-aware resolver MAY set a query's CD bit in order to
   indicate that the resolver takes responsibility for
performing
   whatever authentication its local policy requires on the
RRsets in
   the response.
From 4033:  (emphasis mine)  


Thus, a
   security-aware resolver that is part of a security-aware
recursive
   name server will have to pay careful attention to the
DNSSEC
   "checking disabled" (CD) bit ([RFC4034]). 
This is in order to avoid
   blocking valid signatures from getting through to other
   security-aware resolvers that are clients of this
recursive name
   server.
[Side note - the ref above is wrong, the CD bit isn't mentioned in 4034]

So with respect to the answer to the querier, someone receiving a CD bit set query is not responsible for returning post-validation data.  HOWEVER, this doesn't talk about what has to happen locally with respect to caching of the CD bit set data and whether or not validation need be done before caching, marking etc.

Mike



A


--
Andrew Sullivan
ajs@shinkuro.com
Shinkuro, Inc.

--=====================_75123186==.ALT-- From dnsext-archive@ietf.org Mon May 17 23:25:52 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CE2733A6C72 for ; Mon, 17 May 2010 23:25:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.897 X-Spam-Level: X-Spam-Status: No, score=-10.897 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_IMAGE_ONLY_24=1.552, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aidMyyteLMS6 for ; Mon, 17 May 2010 23:25:50 -0700 (PDT) Received: from alston.com (unknown [58.69.213.59]) by core3.amsl.com (Postfix) with SMTP id B384B3A6C6A for ; Mon, 17 May 2010 23:19:59 -0700 (PDT) From: RX-Store Subject: Special Discount 75% for dnsext-archive@ietf.org To: MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100518061959.B384B3A6C6A@core3.amsl.com> Date: Mon, 17 May 2010 23:19:59 -0700 (PDT)
Delivery department work across the Globe.
Please click here if the e-mail below is not displayed correctly.

This feature will help you stay in touch with friends and family. We will continually work to add new services over time.
http://othermight.com/ Stay Connected with Family and Friends!

ABRA LLC. All Rights Reserved
ABRA Inc. does not authorize the use of its proprietary computers and computer network (the 16518 Network") to accept, transmit or distribute unsolicited bulk e-mail sent from the Internet to ASDuuq members. In addition, Internet e-mail sent, or caused to be sent, to or through the 25807 that makes use of or contains invalid or forged headers, invalid or non-existent domain names or other means of deceptive addressing will be deemed to be counterfeit. Any attempt to send or cause such counterfeit e-mail to be sent to or through the 78232 is unauthorized. 14957

From owner-namedroppers@ops.ietf.org Tue May 18 04:10:14 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 35E4B3A6990; Tue, 18 May 2010 04:10:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.279 X-Spam-Level: X-Spam-Status: No, score=-2.279 tagged_above=-999 required=5 tests=[AWL=0.169, BAYES_50=0.001, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zet1KjT8yfXf; Tue, 18 May 2010 04:10:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 347303A6911; Tue, 18 May 2010 04:10:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEKYd-00060X-Il for namedroppers-data0@psg.com; Tue, 18 May 2010 11:01:55 +0000 Received: from [139.91.1.2] (helo=mailgate.ics.forth.gr) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEKYa-0005zw-Iq for namedroppers@ops.ietf.org; Tue, 18 May 2010 11:01:53 +0000 X-DNSBL-MILTER: Passed Received: from av1.ics.forth.gr ([139.91.157.71]) by mailgate.ics.forth.gr (8.14.3/ICS-FORTH/V10-1.8-GATE) with ESMTP id o4IB0mTB004964; Tue, 18 May 2010 14:01:31 +0300 (EEST) X-AuditID: 8b5b9d47-b7c28ae0000015d4-b6-4bf27360b613 Received: from enigma.ics.forth.gr (webmail.ics.forth.gr [139.91.1.30]) by av1.ics.forth.gr (SMTP Outbound / FORTH / ICS) with SMTP id 60.F0.05588.06372FB4; Tue, 18 May 2010 14:00:48 +0300 (EEST) Received: from Thanatos (thanatos.ics.forth.gr [139.91.88.160]) (authenticated bits=0) by enigma.ics.forth.gr (8.14.3//ICS-FORTH/V10.3.0C-EXTNULL-SSL-SASL) with ESMTP id o4IB0lZ8011220 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Tue, 18 May 2010 14:00:47 +0300 From: "Vaggelis Segredakis" To: "'Jiankang YAO'" , "'Paul Vixie'" , References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> Subject: RE: (bname)Re: [dnsext] shadow zones Date: Tue, 18 May 2010 14:00:33 +0300 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 11 In-Reply-To: <474059336.22856@cnnic.cn> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Thread-Index: Acr1Y7RcnYfdwT/IRT6cwmOO/0Q1WgBE70GA X-Brightmail-Tracker: AAAAAA== X-j-chkmail-Score: MSGID : 4BF27360.000 on mailgate : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-ICS-JCHK-SCL: Ham Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: I have to second Yao on this. I am not certain if the "zone clone" proposal is covering all the "DNAME is not enough" issues, where BNAME as a basis for discussion seems close to what we expect as a registry of this new function. Kind Regards, Vaggelis Segredakis -----Original Message----- From: owner-namedroppers@ops.ietf.org [mailto:owner-namedroppers@ops.ietf.org] On Behalf Of Jiankang YAO Sent: Monday, May 17, 2010 4:22 AM To: Paul Vixie; namedroppers@ops.ietf.org Subject: (bname)Re: [dnsext] shadow zones I hope that the wg take up bname as a work item, too. Bname and zone clone are different solutions. Some customers will select bname, some will select zone clone according to their own needs. Thanks a lot. Jiankang Yao ----- Original Message ----- From: "Paul Vixie" To: Sent: Tuesday, March 02, 2010 8:14 AM Subject: Re: [dnsext] shadow zones > one more thing: i request that the wg take up shadow zones as a work item. > From owner-namedroppers@ops.ietf.org Tue May 18 04:59:35 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 002243A6973; Tue, 18 May 2010 04:59:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.4 X-Spam-Level: X-Spam-Status: No, score=-1.4 tagged_above=-999 required=5 tests=[AWL=-0.290, BAYES_05=-1.11] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OtBgV2-yUUAS; Tue, 18 May 2010 04:59:34 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7B76C3A6966; Tue, 18 May 2010 04:59:28 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OELOh-000D2o-4z for namedroppers-data0@psg.com; Tue, 18 May 2010 11:55:43 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OELOe-000D1Y-PZ for namedroppers@ops.ietf.org; Tue, 18 May 2010 11:55:40 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 9D7A6A5E96 for ; Tue, 18 May 2010 11:55:39 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: (bname)Re: [dnsext] shadow zones In-Reply-To: Your message of "Tue, 18 May 2010 14:00:33 +0300." References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Tue, 18 May 2010 11:55:39 +0000 Message-ID: <13802.1274183739@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: "Vaggelis Segredakis" > Date: Tue, 18 May 2010 14:00:33 +0300 > > I have to second Yao on this. I am not certain if the "zone clone" proposal > is covering all the "DNAME is not enough" issues, where BNAME as a basis for > discussion seems close to what we expect as a registry of this new function. as the author of one draft and co-author of the other, i'm +1 on this. From owner-namedroppers@ops.ietf.org Tue May 18 05:37:47 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DD2993A692B; Tue, 18 May 2010 05:37:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.19 X-Spam-Level: X-Spam-Status: No, score=-1.19 tagged_above=-999 required=5 tests=[AWL=1.444, BAYES_40=-0.185, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dQ7KafqbxiNv; Tue, 18 May 2010 05:37:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 579F63A6BA1; Tue, 18 May 2010 05:37:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OELyC-000Ihu-8F for namedroppers-data0@psg.com; Tue, 18 May 2010 12:32:24 +0000 Received: from [129.6.16.227] (helo=smtp.nist.gov) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OELy9-000IhX-Mm for namedroppers@ops.ietf.org; Tue, 18 May 2010 12:32:21 +0000 Received: from WSXGHUB1.xchange.nist.gov (WSXGHUB1.xchange.nist.gov [129.6.18.96]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id o4ICW6n4008846 for ; Tue, 18 May 2010 08:32:06 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Tue, 18 May 2010 08:32:06 -0400 From: "Rose, Scott W." To: IETF DNSEXT WG Date: Tue, 18 May 2010 08:32:05 -0400 Subject: [dnsext] draft-registry-fixes terms question Thread-Topic: draft-registry-fixes terms question Thread-Index: Acr2hhgk3tOoihGxR9G8uOPGxO7TPw== Message-ID: <37183901-7770-4716-806D-93A0A8B296DE@nist.gov> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-NIST-MailScanner: Found to be clean X-NIST-MailScanner-From: scott.rose@nist.gov Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In the draft-ietf-dnsext-dnssec-registry-fixes the terms used in the "status" column are defined in another working document (draft-ogud-iana-protocol-maintenance-words). draft-registry-fixes seems to be wrapping up and heading for last call, so that leaves an issue with the terms used. So a question posed to the working group about the terms. Either: 1. Define the terms in draft-registry-fixes as they are used in the doc (basically, copy the text from draft-ogud-iana-protocol-maintenance-words and place them in a separate section in this draft. 2. Use "SHOULD+" instead of DISCRETIONARY (and define it), MUST instead of MANDATORY and MUST NOT for OBSOLETE. 3. do nothing (assume that draft-ogud-iana-protocol-maintenance-words will advance). Scott From owner-namedroppers@ops.ietf.org Tue May 18 08:37:24 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A60D43A6AAC; Tue, 18 May 2010 08:37:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.471 X-Spam-Level: * X-Spam-Status: No, score=1.471 tagged_above=-999 required=5 tests=[AWL=-1.529, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id leOi7miDzbsI; Tue, 18 May 2010 08:37:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 210113A68D4; Tue, 18 May 2010 08:35:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEOef-000ICu-Le for namedroppers-data0@psg.com; Tue, 18 May 2010 15:24:25 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEOec-000IC3-FO for namedroppers@ops.ietf.org; Tue, 18 May 2010 15:24:22 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 98FDB1ECB41D for ; Tue, 18 May 2010 15:24:20 +0000 (UTC) Date: Tue, 18 May 2010 11:24:19 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Message-ID: <20100518152418.GF81855@shinkuro.com> References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <13802.1274183739@nsa.vix.com> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear colleagues, On Tue, May 18, 2010 at 11:55:39AM +0000, Paul Vixie wrote: > > From: "Vaggelis Segredakis" > > Date: Tue, 18 May 2010 14:00:33 +0300 > > > > I have to second Yao on this. I am not certain if the "zone clone" proposal > > is covering all the "DNAME is not enough" issues, where BNAME as a basis for > > discussion seems close to what we expect as a registry of this new function. > > as the author of one draft and co-author of the other, i'm +1 on this. I'm picking on Paul's message because it's handy, not because I want to pick on him. As usual in these discussions, I really haven't made up my mind about anything. But in this message, I shall argue the case for _not_ adopting this work, at least not right now. My personal-but-hat-on impression of what we determined at our last meeting was that we needed to do two things before we'd decide whether we'd go ahead with any of this work. In some sense, we need to work from both ends. One end is to try to figure out what problems people are trying to solve. We had a volunteer (Suzanne) who was planning to write (I'm sure she'll correct me with "edit") a draft that provides such an outline. We don't have that draft yet, but I think we probably need it in order to understand what we're doing. The other end was to outline what we actually can do (I recall Ted Hardie making this argument at the mic, for instance). This bit of work is to explain what each approach can (and can not) do. Similarly, I think we need to understand what the deployment requirements of the particular technologies are in order to make them useful. I don't think either of the existing drafts do either of these things in sufficient detail that someone who isn't already intimate with how DNS works will be able to understand the implications. (I'd be satisfied with an answer that such detail doesn't belong in these drafts, in which case I'd still like to see such an analysis in some draft.) There are non-trivial costs associated with doing this work. Moreover, as I've previously argued, that ICANN is doing something using only provisioning and legal agreements is _prima facie_ evidence that at least some class of problems can be solved just by improved provisioning tools. If that's right, it might move one or both drafts from "needed for certain goals" to "nice to have". If a feature is just nice to have, then we have to have a serious talk about whether the benefit it brings to the people who want it is worth the additional complexity in the protocol. On the "additional complexity" front, I am particularly concerned about the BNAME proposal. CNAME synthesis is one of the most controversial aspects of DNAME -- it's actually been used as part of an argument that DNAME can't be used in some cases -- but without CNAME synthesis (or some other synthesis) BNAME simply can't deliver what is needed to non-BNAME aware resolvers. But of course, if that were true, BNAME wouldn't be a live option at all. The draft currently uses a CNAME record, but in a way that violates the original restrictions on CNAME (and which is therefore possibly backward incompatible with deployed software). So, in my opinion, we still have some distance to go before I think we should commit to doing this work. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Tue May 18 09:08:47 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3FFFB3A6C3D; Tue, 18 May 2010 09:08:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.669 X-Spam-Level: X-Spam-Status: No, score=0.669 tagged_above=-999 required=5 tests=[AWL=-1.436, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XRuToVTQP1a9; Tue, 18 May 2010 09:08:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8301D3A69ED; Tue, 18 May 2010 09:07:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEPGP-000NXQ-Tg for namedroppers-data0@psg.com; Tue, 18 May 2010 16:03:25 +0000 Received: from [89.16.176.221] (helo=mail.avalus.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEPGM-000NVr-Ul for namedroppers@ops.ietf.org; Tue, 18 May 2010 16:03:23 +0000 Received: from [192.168.100.15] (87-194-71-186.bethere.co.uk [87.194.71.186]) by mail.avalus.com (Postfix) with ESMTPSA id 3C495C568F7; Tue, 18 May 2010 17:03:20 +0100 (BST) Date: Tue, 18 May 2010 17:03:20 +0100 From: Alex Bligh Reply-To: Alex Bligh To: Andrew Sullivan , namedroppers@ops.ietf.org cc: Alex Bligh Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Message-ID: In-Reply-To: <20100518152418.GF81855@shinkuro.com> References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --On 18 May 2010 11:24:19 -0400 Andrew Sullivan wrote: > So, in my opinion, we still have some distance to go before I think we > should commit to doing this work. +1 -- Alex Bligh From owner-namedroppers@ops.ietf.org Tue May 18 11:47:24 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D819C3A688B; Tue, 18 May 2010 11:47:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.246 X-Spam-Level: X-Spam-Status: No, score=0.246 tagged_above=-999 required=5 tests=[AWL=-1.859, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yz9dOoX+eBeF; Tue, 18 May 2010 11:47:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E56AF3A6884; Tue, 18 May 2010 11:47:19 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OERjh-000Jhg-9A for namedroppers-data0@psg.com; Tue, 18 May 2010 18:41:49 +0000 Received: from [207.182.41.81] (helo=hoffman.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OERje-000JhF-SS for namedroppers@ops.ietf.org; Tue, 18 May 2010 18:41:46 +0000 Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o4IIfiI5020169 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 18 May 2010 11:41:45 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <20100518152418.GF81855@shinkuro.com> References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> Date: Tue, 18 May 2010 11:41:42 -0700 To: Andrew Sullivan , namedroppers@ops.ietf.org From: Paul Hoffman Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 11:24 AM -0400 5/18/10, Andrew Sullivan wrote: >One end is to try to figure out what problems people are trying to >solve. We had a volunteer (Suzanne) who was planning to write (I'm >sure she'll correct me with "edit") a draft that provides such an >outline. We don't have that draft yet, but I think we probably need >it in order to understand what we're doing. Definitely. Look at the range of responses on this list during the last round: it was widespread even among people who normally agree with each other. >The other end was to outline what we actually can do (I recall Ted >Hardie making this argument at the mic, for instance). This bit of >work is to explain what each approach can (and can not) do. >Similarly, I think we need to understand what the deployment >requirements of the particular technologies are in order to make them >useful. I don't think either of the existing drafts do either of >these things in sufficient detail that someone who isn't already >intimate with how DNS works will be able to understand the >implications. (I'd be satisfied with an answer that such detail >doesn't belong in these drafts, in which case I'd still like to see >such an analysis in some draft.) Such detail *is mandatory* in the draft: otherwise, it will just get posted on the list and be lost in the exaflood of responses on a probably-misnamed thread. >There are non-trivial costs associated with doing this work. >Moreover, as I've previously argued, that ICANN is doing something >using only provisioning and legal agreements is _prima facie_ evidence >that at least some class of problems can be solved just by improved >provisioning tools. Indeed. If it's good enough for ICANN, why is it not good enough for us? --Paul Hoffman, Director --VPN Consortium From dmanet@ietf.org Tue May 18 13:43:07 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1779C28C23E for ; Tue, 18 May 2010 13:43:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.697 X-Spam-Level: X-Spam-Status: No, score=0.697 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_DYNAMIC=1.144, HELO_EQ_RU=0.595, HOST_EQ_RU=0.875, HTML_IMAGE_ONLY_24=1.552, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gLBT3PK+1SaJ for ; Tue, 18 May 2010 13:43:01 -0700 (PDT) Received: from 93-120-129-44.dynamic.mts-nn.ru (93-120-129-44.dynamic.mts-nn.ru [93.120.129.44]) by core3.amsl.com (Postfix) with SMTP id 2B66328C1E9 for ; Tue, 18 May 2010 13:40:05 -0700 (PDT) From: RX-Store Subject: New Private Message for dnsext-archive@ietf.org To: MIME-Version: 1.0 Content-Type: text/html X-Antivirus: avast! (VPS 100406-1, 06.04.2010), Outbound message X-Antivirus-Status: Clean Message-Id: <20100518204007.2B66328C1E9@core3.amsl.com> Date: Tue, 18 May 2010 13:40:05 -0700 (PDT)
Delivery department work across the Globe.
Please click here if the e-mail below is not displayed correctly.

This feature will help you stay in touch with friends and family. We will continually work to add new services over time.
http://barrecord.com/ Stay Connected with Family and Friends!

ABRA LLC. All Rights Reserved
ABRA Inc. does not authorize the use of its proprietary computers and computer network (the 43818 Network") to accept, transmit or distribute unsolicited bulk e-mail sent from the Internet to ASDuuq members. In addition, Internet e-mail sent, or caused to be sent, to or through the 62009 that makes use of or contains invalid or forged headers, invalid or non-existent domain names or other means of deceptive addressing will be deemed to be counterfeit. Any attempt to send or cause such counterfeit e-mail to be sent to or through the 58157 is unauthorized. 84587

From owner-namedroppers@ops.ietf.org Tue May 18 15:22:48 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D2D7C3A6A08; Tue, 18 May 2010 15:22:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.042 X-Spam-Level: X-Spam-Status: No, score=-2.042 tagged_above=-999 required=5 tests=[AWL=0.557, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hJb2jnuSiarJ; Tue, 18 May 2010 15:22:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0EEEB3A68DD; Tue, 18 May 2010 15:22:40 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEV2g-000H7O-7T for namedroppers-data0@psg.com; Tue, 18 May 2010 22:13:38 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEV2b-000H6m-C6 for namedroppers@ops.ietf.org; Tue, 18 May 2010 22:13:33 +0000 Received: from [199.212.90.24] (helo=dh24.r1.owls.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEV2Z-000K1P-6k; Tue, 18 May 2010 22:13:31 +0000 Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley In-Reply-To: <20100514145956.GF65855@shinkuro.com> Date: Tue, 18 May 2010 18:13:30 -0400 Cc: namedroppers@ops.ietf.org Content-Transfer-Encoding: 7bit Message-Id: <2B279E33-C5B3-4A72-B587-278006B64C00@hopcount.ca> References: <20100514145956.GF65855@shinkuro.com> To: Andrew Sullivan X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 199.212.90.24 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-14, at 10:59, Andrew Sullivan wrote: > There has previously been some interest expressed in the draft > draft-kerr-ixfr-only-01, and we've had a request to adopt it. > However, we have not had the requisite five people committing to > review through WGLC. I will review it. Joe From owner-namedroppers@ops.ietf.org Tue May 18 18:55:09 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DF1C73A6AE1; Tue, 18 May 2010 18:55:09 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Duplicate header field: "Message-ID" X-Spam-Flag: NO X-Spam-Score: 3.681 X-Spam-Level: *** X-Spam-Status: No, score=3.681 tagged_above=-999 required=5 tests=[AWL=-0.468, BAYES_50=0.001, FH_RELAY_NODNS=1.451, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sicA69tWEIVK; Tue, 18 May 2010 18:55:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7D8273A6ADB; Tue, 18 May 2010 18:55:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEYPV-0009Sv-7y for namedroppers-data0@psg.com; Wed, 19 May 2010 01:49:25 +0000 Received: from [159.226.7.146] (helo=cnnic.cn) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEYPR-0009SD-3n for namedroppers@ops.ietf.org; Wed, 19 May 2010 01:49:21 +0000 Received: (eyou send program); Wed, 19 May 2010 09:49:19 +0800 Message-ID: <474233759.27518@cnnic.cn> X-EYOUMAIL-SMTPAUTH: yaojk@cnnic.cn Received: from unknown (HELO lenovo47e041cf) (127.0.0.1) by 127.0.0.1 with SMTP; Wed, 19 May 2010 09:49:19 +0800 Message-ID: From: "Jiankang YAO" To: "Andrew Sullivan" , , "Paul Hoffman" References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <474208945.21142@cnnic.cn> Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Date: Wed, 19 May 2010 09:49:22 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5931 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIlBhdWwgSG9mZm1hbiIgPHBh dWwuaG9mZm1hbkB2cG5jLm9yZz4NClRvOiAiQW5kcmV3IFN1bGxpdmFuIiA8YWpzQHNoaW5rdXJv LmNvbT47IDxuYW1lZHJvcHBlcnNAb3BzLmlldGYub3JnPg0KU2VudDogV2VkbmVzZGF5LCBNYXkg MTksIDIwMTAgMjo0MSBBTQ0KU3ViamVjdDogUmU6IE9uIGFkb3B0aW9uIG9mIHR3byBkcmFmdHMg KHdhczogKGJuYW1lKVJlOiBbZG5zZXh0XSBzaGFkb3cgem9uZXMpDQoNCj4+VGhlcmUgYXJlIG5v bi10cml2aWFsIGNvc3RzIGFzc29jaWF0ZWQgd2l0aCBkb2luZyB0aGlzIHdvcmsuDQo+Pk1vcmVv dmVyLCBhcyBJJ3ZlIHByZXZpb3VzbHkgYXJndWVkLCB0aGF0IElDQU5OIGlzIGRvaW5nIHNvbWV0 aGluZw0KPj51c2luZyBvbmx5IHByb3Zpc2lvbmluZyBhbmQgbGVnYWwgYWdyZWVtZW50cyBpcyBf cHJpbWEgZmFjaWVfIGV2aWRlbmNlDQo+PnRoYXQgYXQgbGVhc3Qgc29tZSBjbGFzcyBvZiBwcm9i bGVtcyBjYW4gYmUgc29sdmVkIGp1c3QgYnkgaW1wcm92ZWQNCj4+cHJvdmlzaW9uaW5nIHRvb2xz Lg0KPiANCj4gSW5kZWVkLiBJZiBpdCdzIGdvb2QgZW5vdWdoIGZvciBJQ0FOTiwgd2h5IGlzIGl0 IG5vdCBnb29kIGVub3VnaCBmb3IgdXM/DQoNCklDQU5OIGV2YWx1dGVzIHRoZSBjdXJyZW50IERO UyB0ZWNobm9sb2d5IGluY2x1ZGluZyBETkFNRSwgYnV0IG5vdCBzdXJlIHdoaWNoIGRucyB0ZWNo bm9sb2d5IGNhbiBiZSB1c2VkLg0KU28gaWNhbm4gaGFzIHRvIHVzZSB0aGUgcHJvdmlzaW9uaW5n IGFuZCBsZWdhbCBhZ3JlZW1lbnRzIGR1ZSB0byBsYWNrIG9mIHRoZSBETlMgdGVjaG5vbG9neSB0 byBzb2x2ZSBpdC4NCklDQU5OIGlzIHN0aWxsIGxvb2tpbmcgZm9yIGFuZCBldmFsdXRpbmcgc29t ZSBkbnMgdGVjaG5vbG9neSBvciBzb21lIHBvdGVuaWFsIGRucyB0ZWNobm9sb2d5IGluY2x1ZGlu ZyBibmFtZSBhbmQgem9uZSBjbG9uZS4gDQpJbiBjYXNlIG9mIGljYW5uIGZpbmRpbmcgaXQsIElD QU5OIHdpbGwgdXNlIGl0Lg0KU28gaWNhbm4gYWxzbyBzYWlkIHRoYXQgaWYgdGhlcmUgaXMgYSBE TlMgdGVjaG5vbG9neSB0byBzb2x2ZSB0aGUgcHJvYmxlbSwgaWNhbm4gd2lsbCBwdXNoIGFsbCB0 aGUgVExEcyB0byBtb3ZlIHRvIHRoYXQgZG5zIHRlY2hub2xvZ3kuDQoNCg0KSmlhbmthbmcgWWFv DQoNCg0KPiANCj4gLS1QYXVsIEhvZmZtYW4sIERpcmVjdG9yDQo+IC0tVlBOIENvbnNvcnRpdW0N Cj4= From owner-namedroppers@ops.ietf.org Wed May 19 03:18:29 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F27FC3A6886; Wed, 19 May 2010 03:18:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.321 X-Spam-Level: X-Spam-Status: No, score=-3.321 tagged_above=-999 required=5 tests=[AWL=1.127, BAYES_50=0.001, FH_RELAY_NODNS=1.451, GB_I_LETTER=-2, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o4i7FIlfoqLk; Wed, 19 May 2010 03:18:26 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A3E293A69A3; Wed, 19 May 2010 03:16:44 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEgCA-0006Dq-JN for namedroppers-data0@psg.com; Wed, 19 May 2010 10:08:10 +0000 Received: from [139.91.1.2] (helo=mailgate.ics.forth.gr) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEgC0-0006D1-Es for namedroppers@ops.ietf.org; Wed, 19 May 2010 10:08:01 +0000 X-DNSBL-MILTER: Passed Received: from av1.ics.forth.gr ([139.91.157.71]) by mailgate.ics.forth.gr (8.14.3/ICS-FORTH/V10-1.8-GATE) with ESMTP id o4JA7ifj014890; Wed, 19 May 2010 13:07:56 +0300 (EEST) X-AuditID: 8b5b9d47-b7c28ae0000015d4-f8-4bf3b8788b76 Received: from enigma.ics.forth.gr (webmail.ics.forth.gr [139.91.1.30]) by av1.ics.forth.gr (SMTP Outbound / FORTH / ICS) with SMTP id C0.81.05588.878B3FB4; Wed, 19 May 2010 13:07:52 +0300 (EEST) Received: from Thanatos (thanatos.ics.forth.gr [139.91.88.160]) (authenticated bits=0) by enigma.ics.forth.gr (8.14.3//ICS-FORTH/V10.3.0C-EXTNULL-SSL-SASL) with ESMTP id o4JA7phE018660 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Wed, 19 May 2010 13:07:51 +0300 From: "Vaggelis Segredakis" To: "'Andrew Sullivan'" , Cc: "'Sotiris Panaretou'" References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> Subject: RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Date: Wed, 19 May 2010 13:07:35 +0300 Message-ID: <074970A647044F50B5D429F213119233@ics.forth.gr> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-7" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 In-Reply-To: <20100518152418.GF81855@shinkuro.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Thread-Index: Acr2o3eXN6w8e22hRiK7r8z5OG7FFQAlMGrQ X-Brightmail-Tracker: AAAAAA== X-j-chkmail-Score: MSGID : 4BF3B870.000 on mailgate : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-ICS-JCHK-SCL: Ham Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear Andrew, dear All, With the fear that this should be done at a more initial phase, I am = sending to the list a small, compact, description of our issues with the IDNs, hoping this will set some grounds and requirements for our following discussion on the adoption of the two drafts. ------------------------------------------ Issue: The creation of xNAME Description of the problem:=20 In the .gr ccTLD we have presented in 2005 the option of registering IDN domain names in Greek. The Greek language requires for all multi = syllabus words to have an accent sign called "tonos" over one of the letters. In capital letters the word is not accented. However, in UTF the accented = Greek letters are different that the non-accented. This leads in a pair of = domain names necessary to describe each word, one with a tonos and one without. The .gr registry has given the registrants the option to DNAME these two domain names. This way if a user types the word in capital or small = letters, the outcome should be the same, like in every Latin domain name. With the proposal of IDNA2008 protocol, the problem becomes even more complicated because the final sigma letter is no more mapped to the = sigma letter. This way, for each domain that ends with a final sigma (approximately 1/3 of the domain names, all male names and more) has now four variants. If a domain name has two words in it then we have 16 = variants and so-on. To make things worse, the DNAME is not a solution. Because of the way it = was proposed it acts one level below of the DNAMEing. This makes impossible = to use DNAME for emails on the domain itself: info@domain1.gr will never be redirected to info@domain2.gr by just using "Domain1.gr DNAME = Domain2.gr". The same is true for http://domain1.gr and http://domain2.gr. One could suggest CNAME for the first level. The use of CNAME and DNAME together is prohibited though. The only workable solution would be the creation of xNAME. xNAME would = act like CNAME and DNAME together, from the first level. If you declare "Domain1.gr xNAME Domain2.gr" this means info@Domain1.gr will be the = "same" as info@Domain2.gr and http://Domain1.gr will be the same as typing http://Domain2.gr. Let me give you an example using my name... If someone would like to register =C2=E1=E3=E3=DD=EB=E7=F2.gr (xn--ixahcfaz1a9d.gr - This one has the = "tonos" mark) I have to register as well =C2=C1=C3=C3=C5=CB=C7=D3.gr (xn--mxabeakm1a9d.gr - This = one without the tonos). This is used for the representation in capital letters and maybe = for people who type without tonos, e.g. from mobile phones. At present (IDNA2003) we would dname these two domain names or the registrant would have to create two, distinct zones. In IDNA 2008 the first one will become two domains: = =E2=E1=E3=E3=DD=EB=E7=F3.gr and =E2=E1=E3=E3=DD=EB=E7=F2.gr (normal sigma and tonos, final sigma and = tonos) The second one will again be two different domain names, = =C2=E1=E3=E3=E5=EB=E7=F3.gr and =C2=E1=E3=E3=E5=EB=E7=F2.gr (normal sigma, without tonos and final sigma = without tonos). We now have to dname four (4) different domain names but no matter what = we as a registry do their operation will be limited, without proper support = of email. The problem becomes much more complicated if you have domain = names consisting of two, three, four words ending with final sigmas. ------------------------------------------ This case is not the same with the case ICANN presented. I am afraid = that zone cloning will not be the "one solution fits all". This is why we are asking for the BNAME or any type of xNAME solution to be studied = thoroughly. Please accept my apology if someone already has a clear picture of our issues and this lengthy email comes as a repetition. Kind Regards, Vaggelis Segredakis -----Original Message----- From: owner-namedroppers@ops.ietf.org [mailto:owner-namedroppers@ops.ietf.org] On Behalf Of Andrew Sullivan Sent: Tuesday, May 18, 2010 6:24 PM To: namedroppers@ops.ietf.org Subject: On adoption of two drafts (was: (bname)Re: [dnsext] shadow = zones) Dear colleagues, On Tue, May 18, 2010 at 11:55:39AM +0000, Paul Vixie wrote: > > From: "Vaggelis Segredakis" > > Date: Tue, 18 May 2010 14:00:33 +0300 > >=20 > > I have to second Yao on this. I am not certain if the "zone clone" proposal > > is covering all the "DNAME is not enough" issues, where BNAME as a = basis for > > discussion seems close to what we expect as a registry of this new function. >=20 > as the author of one draft and co-author of the other, i'm +1 on this. I'm picking on Paul's message because it's handy, not because I want to pick on him. As usual in these discussions, I really haven't made up my mind about anything. But in this message, I shall argue the case for _not_ adopting this work, at least not right now. My personal-but-hat-on impression of what we determined at our last meeting was that we needed to do two things before we'd decide whether we'd go ahead with any of this work. In some sense, we need to work from both ends. One end is to try to figure out what problems people are trying to solve. We had a volunteer (Suzanne) who was planning to write (I'm sure she'll correct me with "edit") a draft that provides such an outline. We don't have that draft yet, but I think we probably need it in order to understand what we're doing. The other end was to outline what we actually can do (I recall Ted Hardie making this argument at the mic, for instance). This bit of work is to explain what each approach can (and can not) do. Similarly, I think we need to understand what the deployment requirements of the particular technologies are in order to make them useful. I don't think either of the existing drafts do either of these things in sufficient detail that someone who isn't already intimate with how DNS works will be able to understand the implications. (I'd be satisfied with an answer that such detail doesn't belong in these drafts, in which case I'd still like to see such an analysis in some draft.) There are non-trivial costs associated with doing this work. Moreover, as I've previously argued, that ICANN is doing something using only provisioning and legal agreements is _prima facie_ evidence that at least some class of problems can be solved just by improved provisioning tools. If that's right, it might move one or both drafts from "needed for certain goals" to "nice to have". If a feature is just nice to have, then we have to have a serious talk about whether the benefit it brings to the people who want it is worth the additional complexity in the protocol. On the "additional complexity" front, I am particularly concerned about the BNAME proposal. CNAME synthesis is one of the most controversial aspects of DNAME -- it's actually been used as part of an argument that DNAME can't be used in some cases -- but without CNAME synthesis (or some other synthesis) BNAME simply can't deliver what is needed to non-BNAME aware resolvers. But of course, if that were true, BNAME wouldn't be a live option at all. The draft currently uses a CNAME record, but in a way that violates the original restrictions on CNAME (and which is therefore possibly backward incompatible with deployed software). So, in my opinion, we still have some distance to go before I think we should commit to doing this work. A --=20 Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Wed May 19 03:36:31 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 36DBE3A6B3A; Wed, 19 May 2010 03:36:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.519 X-Spam-Level: ** X-Spam-Status: No, score=2.519 tagged_above=-999 required=5 tests=[BAYES_40=-0.185, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_55=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bOxeIvnmpc5i; Wed, 19 May 2010 03:36:30 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9F27E3A69BF; Wed, 19 May 2010 03:35:15 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEgXi-0009bp-9h for namedroppers-data0@psg.com; Wed, 19 May 2010 10:30:26 +0000 Received: from [89.16.176.221] (helo=mail.avalus.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEgXe-0009az-J7 for namedroppers@ops.ietf.org; Wed, 19 May 2010 10:30:23 +0000 Received: from [10.113.78.195] (unknown [212.183.140.52]) by mail.avalus.com (Postfix) with ESMTPSA id 16043C568F8; Wed, 19 May 2010 11:30:20 +0100 (BST) Date: Wed, 19 May 2010 03:30:18 -0700 From: Alex Bligh Reply-To: Alex Bligh To: Vaggelis Segredakis , 'Andrew Sullivan' , namedroppers@ops.ietf.org cc: 'Sotiris Panaretou' , Alex Bligh Subject: RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Message-ID: In-Reply-To: <074970A647044F50B5D429F213119233@ics.forth.gr> References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --On 19 May 2010 13:07:35 +0300 Vaggelis Segredakis wrote: > One could suggest CNAME for the first level. The use of CNAME and DNAME > together is prohibited though. > > The only workable solution would be the creation of xNAME. xNAME would act > like CNAME and DNAME together, from the first level Were the prohibition on having CNAME+DNAME together lifted, together with appropriate signalling (which can be no harder than the signalling to support xNAME), would this resolve the problem you describe any less well than xNAME? If it's no worse, it seems to me it would be substantially easier. Clearly it may not give other functionality that the various xNAME proposals seek to offer. -- Alex Bligh From owner-namedroppers@ops.ietf.org Wed May 19 03:57:48 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AB34F3A690C; Wed, 19 May 2010 03:57:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.547 X-Spam-Level: X-Spam-Status: No, score=-3.547 tagged_above=-999 required=5 tests=[AWL=0.901, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, J_CHICKENPOX_55=0.6, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 189ePe8BeBiN; Wed, 19 May 2010 03:57:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 68D623A6B00; Wed, 19 May 2010 03:57:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEgrZ-000Dhg-2p for namedroppers-data0@psg.com; Wed, 19 May 2010 10:50:57 +0000 Received: from [139.91.1.2] (helo=mailgate.ics.forth.gr) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEgrU-000DhE-PD for namedroppers@ops.ietf.org; Wed, 19 May 2010 10:50:53 +0000 X-DNSBL-MILTER: Passed Received: from av1.ics.forth.gr ([139.91.157.71]) by mailgate.ics.forth.gr (8.14.3/ICS-FORTH/V10-1.8-GATE) with ESMTP id o4JAnq1r017627; Wed, 19 May 2010 13:50:34 +0300 (EEST) X-AuditID: 8b5b9d47-b7c28ae0000015d4-27-4bf3c250d415 Received: from enigma.ics.forth.gr (webmail.ics.forth.gr [139.91.1.30]) by av1.ics.forth.gr (SMTP Outbound / FORTH / ICS) with SMTP id DA.81.05588.052C3FB4; Wed, 19 May 2010 13:49:52 +0300 (EEST) Received: from Thanatos (thanatos.ics.forth.gr [139.91.88.160]) (authenticated bits=0) by enigma.ics.forth.gr (8.14.3//ICS-FORTH/V10.3.0C-EXTNULL-SSL-SASL) with ESMTP id o4JAnple018915 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Wed, 19 May 2010 13:49:51 +0300 From: "Vaggelis Segredakis" To: "'Alex Bligh'" , "'Andrew Sullivan'" , Cc: "'Sotiris Panaretou'" References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Subject: RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Date: Wed, 19 May 2010 13:49:36 +0300 Message-ID: <6B9E392052064A9D9284E22DFE6FC86D@ics.forth.gr> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 11 In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Thread-Index: Acr3PmZPC9aELc2mQm+lYu6vhQXU6QAAdvnA X-Brightmail-Tracker: AAAAAA== X-j-chkmail-Score: MSGID : 4BF3C250.000 on mailgate : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-ICS-JCHK-SCL: Ham Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: I am afraid that just changing the restriction of CNAME+DNAME will create havoc. You would not be able to determine if a domain name is resolved as it should be, it would depend on the version of the resolver but without any warning. Other than this, the CNAME+DNAME is actually pretty much the xNAME we ask for. Best, Vaggelis -----Original Message----- From: Alex Bligh [mailto:alex@alex.org.uk] Sent: Wednesday, May 19, 2010 1:30 PM To: Vaggelis Segredakis; 'Andrew Sullivan'; namedroppers@ops.ietf.org Cc: 'Sotiris Panaretou'; Alex Bligh Subject: RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) --On 19 May 2010 13:07:35 +0300 Vaggelis Segredakis wrote: > One could suggest CNAME for the first level. The use of CNAME and DNAME > together is prohibited though. > > The only workable solution would be the creation of xNAME. xNAME would act > like CNAME and DNAME together, from the first level Were the prohibition on having CNAME+DNAME together lifted, together with appropriate signalling (which can be no harder than the signalling to support xNAME), would this resolve the problem you describe any less well than xNAME? If it's no worse, it seems to me it would be substantially easier. Clearly it may not give other functionality that the various xNAME proposals seek to offer. -- Alex Bligh From owner-namedroppers@ops.ietf.org Wed May 19 07:00:25 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 42B7C3A6936; Wed, 19 May 2010 07:00:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.479 X-Spam-Level: X-Spam-Status: No, score=-0.479 tagged_above=-999 required=5 tests=[AWL=-1.080, BAYES_50=0.001, J_CHICKENPOX_55=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0qtivZE0gLYn; Wed, 19 May 2010 07:00:24 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 291F13A6971; Wed, 19 May 2010 07:00:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEjjc-000EfU-IF for namedroppers-data0@psg.com; Wed, 19 May 2010 13:54:56 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEjja-000EeG-7H for namedroppers@ops.ietf.org; Wed, 19 May 2010 13:54:54 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id A1689EC506; Wed, 19 May 2010 13:54:47 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4JDsfOp034332; Wed, 19 May 2010 23:54:42 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005191354.o4JDsfOp034332@drugs.dv.isc.org> To: Alex Bligh Cc: Vaggelis Segredakis , "'Andrew Sullivan'" , namedroppers@ops.ietf.org, "'Sotiris Panaretou'" From: Mark Andrews References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) In-reply-to: Your message of "Wed, 19 May 2010 03:30:18 MST." Date: Wed, 19 May 2010 23:54:41 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Alex Bligh writ es: > --On 19 May 2010 13:07:35 +0300 Vaggelis Segredakis > wrote: > > > One could suggest CNAME for the first level. The use of CNAME and DNAME > > together is prohibited though. > > > > The only workable solution would be the creation of xNAME. xNAME would act > > like CNAME and DNAME together, from the first level > > Were the prohibition on having CNAME+DNAME together lifted, together with > appropriate signalling (which can be no harder than the signalling to > support xNAME), would this resolve the problem you describe any less > well than xNAME? If it's no worse, it seems to me it would be > substantially easier. I don't believe that there is appropriate signaling for CNAME + DNAME. If you have a method please post the details. > Clearly it may not give other functionality that the various xNAME proposals > seek to offer. > > -- > Alex Bligh -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Wed May 19 07:01:03 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 527813A6936; Wed, 19 May 2010 07:01:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.227 X-Spam-Level: X-Spam-Status: No, score=-98.227 tagged_above=-999 required=5 tests=[AWL=0.273, BAYES_50=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9lbGBUZ4Ag-6; Wed, 19 May 2010 07:01:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DA08C3A6B9B; Wed, 19 May 2010 07:00:55 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEjii-000EUZ-Pw for namedroppers-data0@psg.com; Wed, 19 May 2010 13:54:00 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEjif-000EU6-Pn for namedroppers@ops.ietf.org; Wed, 19 May 2010 13:53:57 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id C3A25734271; Wed, 19 May 2010 15:53:55 +0200 (CEST) Message-ID: <4BF3ED73.30402@nic.cz> Date: Wed, 19 May 2010 15:53:55 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: Vaggelis Segredakis CC: 'Alex Bligh' , namedroppers@ops.ietf.org Subject: [dnsext] Re: On adoption of two drafts References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <6B9E392052064A9D9284E22DFE6FC86D@ics.forth.gr> In-Reply-To: <6B9E392052064A9D9284E22DFE6FC86D@ics.forth.gr> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 19.5.2010 12:49, Vaggelis Segredakis wrote: > I am afraid that just changing the restriction of CNAME+DNAME will create > havoc. You would not be able to determine if a domain name is resolved as it > should be, it would depend on the version of the resolver but without any > warning. Could you elaborate on that? I still didn't have a time to do thorough testing, but initial tests showed no impact on resolvers. I promise to do more testing soon. > Other than this, the CNAME+DNAME is actually pretty much the xNAME we ask > for. Ondrej -- OndÅ™ej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- LaboratoÅ™e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Wed May 19 07:10:37 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F2C263A6B93; Wed, 19 May 2010 07:10:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.947 X-Spam-Level: X-Spam-Status: No, score=-1.947 tagged_above=-999 required=5 tests=[AWL=-0.999, BAYES_50=0.001, FH_RELAY_NODNS=1.451, J_CHICKENPOX_23=0.6, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lgi8Ah85OUhV; Wed, 19 May 2010 07:10:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3E34328C0CF; Wed, 19 May 2010 07:10:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEjvF-000Ghn-1J for namedroppers-data0@psg.com; Wed, 19 May 2010 14:06:57 +0000 Received: from [139.91.1.2] (helo=mailgate.ics.forth.gr) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEjvB-000GhE-PK for namedroppers@ops.ietf.org; Wed, 19 May 2010 14:06:54 +0000 X-DNSBL-MILTER: Passed Received: from av1.ics.forth.gr ([139.91.157.71]) by mailgate.ics.forth.gr (8.14.3/ICS-FORTH/V10-1.8-GATE) with ESMTP id o4JE6BLV027167; Wed, 19 May 2010 17:06:44 +0300 (EEST) X-AuditID: 8b5b9d47-b7c28ae0000015d4-ed-4bf3f0539fc5 Received: from enigma.ics.forth.gr (webmail.ics.forth.gr [139.91.1.30]) by av1.ics.forth.gr (SMTP Outbound / FORTH / ICS) with SMTP id 9C.A1.05588.350F3FB4; Wed, 19 May 2010 17:06:11 +0300 (EEST) Received: from Thanatos (thanatos.ics.forth.gr [139.91.88.160]) (authenticated bits=0) by enigma.ics.forth.gr (8.14.3//ICS-FORTH/V10.3.0C-EXTNULL-SSL-SASL) with ESMTP id o4JE6Ahv020344 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Wed, 19 May 2010 17:06:11 +0300 From: "Vaggelis Segredakis" To: "=?iso-8859-2?Q?'Ond=F8ej_Sur=FD'?=" Cc: "'Alex Bligh'" , References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <6B9E392052064A9D9284E22DFE6FC86D@ics.forth.gr> <4BF3ED73.30402@nic.cz> Subject: [dnsext] RE: On adoption of two drafts Date: Wed, 19 May 2010 17:05:56 +0300 Message-ID: <74A29EA61AA44111BD84919F2AAC04D2@ics.forth.gr> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 In-Reply-To: <4BF3ED73.30402@nic.cz> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Thread-Index: Acr3WtswmkdvvJqETt2e/rxFs+/EzAAADWag X-Brightmail-Tracker: AAAAARRG44Y= X-j-chkmail-Score: MSGID : 4BF3F053.000 on mailgate : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-ICS-JCHK-SCL: Ham Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: It is not technical but rather an "adoption-phase" problem: If there = will not be a distinct DNS command with specific characteristics but instead = a differentiation of the protocol from a version and beyond, we will have = for years people asking "Why it is not working on my machine but it is ok on yours?". If this is not considered a prohibiting factor, I cannot raise = any other objections now, I haven't thought it through yet. We tried to test CNAME+DNAME but the Bind does not accept the zone as = valid. If you manage to get it to work, please share your results. Vaggelis -----Original Message----- From: Ond=F8ej Sur=FD [mailto:ondrej.sury@nic.cz]=20 Sent: Wednesday, May 19, 2010 4:54 PM To: Vaggelis Segredakis Cc: 'Alex Bligh'; namedroppers@ops.ietf.org Subject: Re: On adoption of two drafts On 19.5.2010 12:49, Vaggelis Segredakis wrote: > I am afraid that just changing the restriction of CNAME+DNAME will = create > havoc. You would not be able to determine if a domain name is resolved = as it > should be, it would depend on the version of the resolver but without = any > warning. Could you elaborate on that? I still didn't have a time to do thorough=20 testing, but initial tests showed no impact on resolvers. I promise to=20 do more testing soon. > Other than this, the CNAME+DNAME is actually pretty much the xNAME we = ask > for. Ondrej --=20 Ond=F8ej Sur=FD vedouc=ED v=FDzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- Laborato=F8e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Wed May 19 07:21:07 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51C7B28C0FB; Wed, 19 May 2010 07:21:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.25 X-Spam-Level: X-Spam-Status: No, score=-98.25 tagged_above=-999 required=5 tests=[AWL=0.250, BAYES_50=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DAChoJzEuRHH; Wed, 19 May 2010 07:21:05 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 00F2828C0F5; Wed, 19 May 2010 07:19:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEk3n-000I8m-9m for namedroppers-data0@psg.com; Wed, 19 May 2010 14:15:47 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEk3k-000I8J-Rj for namedroppers@ops.ietf.org; Wed, 19 May 2010 14:15:45 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id EECC1734271; Wed, 19 May 2010 16:15:38 +0200 (CEST) Message-ID: <4BF3F28A.1090207@nic.cz> Date: Wed, 19 May 2010 16:15:38 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: Mark Andrews CC: "namedroppers@ops.ietf.org" Subject: [dnsext] Re: On adoption of two drafts References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> In-Reply-To: <201005191354.o4JDsfOp034332@drugs.dv.isc.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 19.5.2010 15:54, Mark Andrews wrote: > In message, Alex Bligh writ > es: >> --On 19 May 2010 13:07:35 +0300 Vaggelis Segredakis >> wrote: >> >>> One could suggest CNAME for the first level. The use of CNAME and DNAME >>> together is prohibited though. >>> >>> The only workable solution would be the creation of xNAME. xNAME would act >>> like CNAME and DNAME together, from the first level >> >> Were the prohibition on having CNAME+DNAME together lifted, together with >> appropriate signalling (which can be no harder than the signalling to >> support xNAME), would this resolve the problem you describe any less >> well than xNAME? If it's no worse, it seems to me it would be >> substantially easier. > > I don't believe that there is appropriate signaling for CNAME + DNAME. > If you have a method please post the details. Why do you need signaling? If it fits into all existing scenarios and there is existing support in all resolvers. If it doesn't that CNAME+DNAME is no-go. Ondrej -- OndÅ™ej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- LaboratoÅ™e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Wed May 19 07:43:58 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 21CB53A6974; Wed, 19 May 2010 07:43:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -95.501 X-Spam-Level: X-Spam-Status: No, score=-95.501 tagged_above=-999 required=5 tests=[AWL=-0.351, BAYES_50=0.001, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, GB_I_LETTER=-2, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B-ElHg-DC9Kn; Wed, 19 May 2010 07:43:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0164E3A6B70; Wed, 19 May 2010 07:39:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkLj-000Kfr-DO for namedroppers-data0@psg.com; Wed, 19 May 2010 14:34:19 +0000 Received: from [213.178.172.147] (helo=TR-Sys.de) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkLf-000KfF-Gy for namedroppers@ops.ietf.org; Wed, 19 May 2010 14:34:16 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3.2) id AA094839607; Wed, 19 May 2010 16:33:27 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id QAA13726; Wed, 19 May 2010 16:33:26 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <201005191433.QAA13726@TR-Sys.de> Subject: [dnsext] RE: On adoption of two drafts ... To: segred@ics.forth.gr Date: Wed, 19 May 2010 16:33:26 +0200 (MESZ) Cc: namedroppers@ops.ietf.org X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Vaggelis Segredakis wrote: > In the .gr ccTLD we have presented in 2005 the option of registering > IDN domain names in Greek. The Greek language requires for all > multi syllabus words to have an accent sign called "tonos" over > one of the letters. [...] Unfortunately, hereby we apparently are back at one of the greatest ratholes ever seen in DNS internationalization. Wasn't it one of the fundamental characteristics of the DNS that DNS labels are _not_ "words" (in any language), but simply abstract _identifiers_ in a more user friendly alphabet than IP addresses? I vaguely recall from IDNA discussion on the use of IDNA with the Arabic languages (and scripts) that it had been reported to the IETF community that "The hardest part in this work was to escape from the (mis)concept of a couple of stakeholders that DNS labels were 'words' in one of the Arabic languages and therefore linguistic rules would have to be superimposed on DNS labels." If application of a linguistic rule for Greek is the sole background of your requirement, aren't we in a similar position again? I do not support work on DNS protocol changes based on such specific (and arguably inappropriate) reasoning. If we shall undertake such effort, a "neutral" problem statement needs to be formulated and taken as the _only_ base for the subsequent work. IMO, for any purpose to be discussed here, the definition of DNS labels from the basic DNS standards should be taken for given, and this WG should refrain from imposing semantic rules of any kind on DNS labels. In other words: DNS Protocol mechanisms should work with any semantics imposed in a uniform manner by other bodies on *all* DNS labels. Scoped semantics of specific classes of DNS labels MUST remain out of scope of the discussion in this WG. If we agree on a generally desirable scheme/model of "equivalence" of domain _names_ (any restriction to equivalence of single _labels_ within a zone IMO is not worth such effort), it may happen that someone can apply the ensuing protocol extensions for purposes not amenable to consensus in the IETF; they may deploy such usage, but that MUST NOT become topic of discussion in this WG, if we actually want to arrive at success *within any finite time span*. A few general thoughts: The examples shown so far seem to indicate that any generally useful equivalence scheme needs to admit composition and iteration. I.e., it must be possible to store an equivalence for a single label that somehow automagically applies to all compositions containing the domain name which an instance of the equivalence mechanism is regarded to have as its owner, and such equivalences can happen to be 'crossed' multiple times in the resolution process of a multi- label DNS name. The variety, complexity, and context-specifity of equivalence 'nets' envisioned makes it clear that neither end system resolvers nor caches should be burdened with extraneous storing and/or processing requirements for equivalences. Equivalences mentioned so far apparently are neither generic nor symmetrical. This IMO implies that these 'equivalences' are not equivalence relations in a mathematical (set theoretical) sense; each instance of an 'equivalence class' instead needs to be represented by a simply-connected, loop-free, directed graph with a 'canonical' name form (chosen by the entity defining the instance of equivalence) at its (inverted) root. Each byte of information on any instance of equivalence must be located in the respective authoritative zones, and the nodes and arcs of that graph must be represented "in the DNS way", to allow transporting the information from the authorities to the resolvers in the standard way that admits "vouching" for these components of the graph by normal DNSSEC. In this model, the nodes in the equivalence graphs are represented by DNS nodes, and a directed arc ("arrow") in an equivalence graph is represented by an RR at the 'source' of the arc, pointing to the 'target' of the arc. (This is the model already present in CNAME and DNAME -- set aside synthetic CNAME generation for DNAME.) Kind regards, Alfred. -- +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From owner-namedroppers@ops.ietf.org Wed May 19 07:48:02 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 873063A6A3F; Wed, 19 May 2010 07:48:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.539 X-Spam-Level: X-Spam-Status: No, score=-0.539 tagged_above=-999 required=5 tests=[AWL=-1.140, BAYES_50=0.001, J_CHICKENPOX_55=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pYbOOKpV-64s; Wed, 19 May 2010 07:48:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1CD943A66B4; Wed, 19 May 2010 07:42:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkRB-000LMP-Pt for namedroppers-data0@psg.com; Wed, 19 May 2010 14:39:57 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkR9-000LLJ-MX for namedroppers@ops.ietf.org; Wed, 19 May 2010 14:39:55 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 72EAAA60D5 for ; Wed, 19 May 2010 14:39:54 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: "namedroppers\@ops.ietf.org" Subject: Re: [dnsext] Re: On adoption of two drafts In-Reply-To: Your message of "Wed\, 19 May 2010 16\:15\:38 +0200." <4BF3F28A.1090207@nic.cz> References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <4BF3F28A.1090207@nic.cz> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Wed, 19 May 2010 14:39:54 +0000 Message-ID: <89201.1274279994@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Wed, 19 May 2010 16:15:38 +0200 > From: Ond=C5=99ej Sur=C3=BD >=20 > Why do you need signaling? If it fits into all existing scenarios and > there is existing support in all resolvers. If it doesn't that > CNAME+DNAME is no-go. most if not all existing recursive servers, forwarders, stubs, and apps assume that a name either is an alias or is not one. the presence of a cname will in some cases trigger alias-following behaviour, silently ignoring the non-dname data. the presence of a non-cname will in some cases trigger resolution behaviour, silently ignoring the alias. the fact that a given authority server can be patched to allow this data pattern and that a given set of recursives, stubs, and apps can be tested to show no problems, doesn't mean this isn't a grave protocol violation with far reaching consequences. it is avoidable, and such avoidance is extremely worthwhile. bname, by comparison, is relatively safe. note though, anything involving aliases will create 'second class domains'. interior name references by NS and MX for example cannot refer to an alias since the specification does not require alias-following behaviour. From owner-namedroppers@ops.ietf.org Wed May 19 07:56:03 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EA06A3A6988; Wed, 19 May 2010 07:56:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.618 X-Spam-Level: * X-Spam-Status: No, score=1.618 tagged_above=-999 required=5 tests=[AWL=-1.687, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_15=0.6, J_CHICKENPOX_55=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yxfpybwQMdWs; Wed, 19 May 2010 07:56:03 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E2E7F3A6B70; Wed, 19 May 2010 07:56:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkcA-000NF3-NL for namedroppers-data0@psg.com; Wed, 19 May 2010 14:51:18 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkc8-000NEk-1o for namedroppers@ops.ietf.org; Wed, 19 May 2010 14:51:16 +0000 Received: from [IPv6:::1] (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4JEoKK9005845; Wed, 19 May 2010 10:50:20 -0400 (EDT) (envelope-from ogud@ogud.com) Message-ID: <4BF3FAA6.2010201@ogud.com> Date: Wed, 19 May 2010 10:50:14 -0400 From: Olafur Gudmundsson User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Vaggelis Segredakis CC: =?ISO-8859-2?Q?=27Ond=F8ej_Sur=FD=27?= , namedroppers@ops.ietf.org Subject: Re: [dnsext] RE: On adoption of two drafts References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <6B9E392052064A9D9284E22DFE6FC86D@ics.forth.gr> <4BF3ED73.30402@nic.cz> <74A29EA61AA44111BD84919F2AAC04D2@ics.forth.gr> In-Reply-To: <74A29EA61AA44111BD84919F2AAC04D2@ics.forth.gr> Content-Type: text/plain; charset=ISO-8859-2; format=flowed Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: The main question in my mind when comparing xNAME vs C+DNAME is where is the cost ? In xNAME we need to change all DNS protocol implementations (eventually). In C+DNAME the cost falls on the authoritative side as only signers and authoritative servers need to be changed. Resolvers will not get confused as "exact match" queries get CNAME answer and "partial match" get DNAME answer. The only failure mode for C+D that I see: is the possible lack of DNAME support in resolvers recursive validators rejecting NSEC/NSEC3 records with both DNAME and CNAME bits set. Olafur On 19/05/2010 10:05 AM, Vaggelis Segredakis wrote: > It is not technical but rather an "adoption-phase" problem: If there will > not be a distinct DNS command with specific characteristics but instead a > differentiation of the protocol from a version and beyond, we will have for > years people asking "Why it is not working on my machine but it is ok on > yours?". If this is not considered a prohibiting factor, I cannot raise any > other objections now, I haven't thought it through yet. > > We tried to test CNAME+DNAME but the Bind does not accept the zone as valid. > If you manage to get it to work, please share your results. > > Vaggelis > > -----Original Message----- > From: Ondøej Surý [mailto:ondrej.sury@nic.cz] > Sent: Wednesday, May 19, 2010 4:54 PM > To: Vaggelis Segredakis > Cc: 'Alex Bligh'; namedroppers@ops.ietf.org > Subject: Re: On adoption of two drafts > > On 19.5.2010 12:49, Vaggelis Segredakis wrote: >> I am afraid that just changing the restriction of CNAME+DNAME will create >> havoc. You would not be able to determine if a domain name is resolved as > it >> should be, it would depend on the version of the resolver but without any >> warning. > > Could you elaborate on that? I still didn't have a time to do thorough > testing, but initial tests showed no impact on resolvers. I promise to > do more testing soon. > >> Other than this, the CNAME+DNAME is actually pretty much the xNAME we ask >> for. > > Ondrej From owner-namedroppers@ops.ietf.org Wed May 19 07:57:01 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D2EA63A66B4; Wed, 19 May 2010 07:57:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3 X-Spam-Level: *** X-Spam-Status: No, score=3 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f6RnG5FMPPWe; Wed, 19 May 2010 07:57:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B55E83A6988; Wed, 19 May 2010 07:56:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEke2-000NWu-2d for namedroppers-data0@psg.com; Wed, 19 May 2010 14:53:14 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkdz-000NWX-Ti for namedroppers@ops.ietf.org; Wed, 19 May 2010 14:53:12 +0000 Received: from crankycanuck.ca (static-68-179-76-140.ptr.terago.net [68.179.76.140]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id A61CB1ECB41D for ; Wed, 19 May 2010 14:53:10 +0000 (UTC) Date: Wed, 19 May 2010 10:53:08 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: On adoption of two drafts Message-ID: <20100519145308.GB86053@shinkuro.com> References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <4BF3F28A.1090207@nic.cz> <89201.1274279994@nsa.vix.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <89201.1274279994@nsa.vix.com> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: No hat On Wed, May 19, 2010 at 02:39:54PM +0000, Paul Vixie wrote: > cname will in some cases trigger alias-following behaviour, silently > ignoring the non-dname data. the presence of a non-cname will in some > cases trigger resolution behaviour, silently ignoring the alias. > bname, by comparison, is relatively safe. note though, anything involving > aliases will create 'second class domains'. The current BNAME proposal includes a synthetic CNAME every time it sends a BNAME. It appears, then, that it runs into the same issue you outline above, for it may trigger alias-following behaviour when it ought not or conversely. No? A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Wed May 19 08:14:38 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 748E33A6A12; Wed, 19 May 2010 08:14:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.269 X-Spam-Level: X-Spam-Status: No, score=-98.269 tagged_above=-999 required=5 tests=[AWL=0.230, BAYES_50=0.001, J_CHICKENPOX_35=0.6, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yRJMIfKjK-C1; Wed, 19 May 2010 08:14:17 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 220303A69EF; Wed, 19 May 2010 08:14:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEks6-0000C2-2o for namedroppers-data0@psg.com; Wed, 19 May 2010 15:07:46 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEks2-0000BQ-T3 for namedroppers@ops.ietf.org; Wed, 19 May 2010 15:07:43 +0000 Received: from [10.169.84.23] (89-24-6-50.i4g.tmcz.cz [89.24.6.50]) by mail.nic.cz (Postfix) with ESMTPA id 75ACA7342F0; Wed, 19 May 2010 17:07:34 +0200 (CEST) References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <4BF3F28A.1090207@nic.cz> <89201.1274279994@nsa.vix.com> Message-Id: <0FC4B703-E048-41E3-B2DA-E4FB84246EEC@nic.cz> From: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= To: Paul Vixie In-Reply-To: <89201.1274279994@nsa.vix.com> Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable X-Mailer: iPhone Mail (7E18) Mime-Version: 1.0 (iPhone Mail 7E18) Subject: Re: [dnsext] Re: On adoption of two drafts Date: Wed, 19 May 2010 17:08:19 +0200 Cc: "namedroppers@ops.ietf.org" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Paul, are you saying that we have behaviour: A) if cname exist then do_more_work else do_standard_work or B) if any^cname exist then do_standard_work else do_more_work ? (Sent from my iPhone in afternoon traffic jam) Ondrej Sury On 19.5.2010, at 16:39, Paul Vixie wrote: >> Date: Wed, 19 May 2010 16:15:38 +0200 >> From: Ond=C5=99ej Sur=C3=BD >> >> Why do you need signaling? If it fits into all existing scenarios =20= >> and >> there is existing support in all resolvers. If it doesn't that >> CNAME+DNAME is no-go. > > most if not all existing recursive servers, forwarders, stubs, and =20 > apps > assume that a name either is an alias or is not one. the presence of a > cname will in some cases trigger alias-following behaviour, silently > ignoring the non-dname data. the presence of a non-cname will in some > cases trigger resolution behaviour, silently ignoring the alias. > > the fact that a given authority server can be patched to allow this =20= > data > pattern and that a given set of recursives, stubs, and apps can be =20 > tested > to show no problems, doesn't mean this isn't a grave protocol =20 > violation > with far reaching consequences. it is avoidable, and such avoidance is > extremely worthwhile. > > bname, by comparison, is relatively safe. note though, anything =20 > involving > aliases will create 'second class domains'. interior name references =20= > by > NS and MX for example cannot refer to an alias since the specification > does not require alias-following behaviour. > From owner-namedroppers@ops.ietf.org Wed May 19 08:19:02 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E72A03A6A44; Wed, 19 May 2010 08:19:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.104 X-Spam-Level: X-Spam-Status: No, score=-3.104 tagged_above=-999 required=5 tests=[AWL=0.444, BAYES_50=0.001, FH_RELAY_NODNS=1.451, GB_I_LETTER=-2, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QnGL2z78nwkr; Wed, 19 May 2010 08:19:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 98F013A6A59; Wed, 19 May 2010 08:18:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkyg-0001Ik-6L for namedroppers-data0@psg.com; Wed, 19 May 2010 15:14:34 +0000 Received: from [139.91.1.2] (helo=mailgate.ics.forth.gr) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkyc-0001IS-PK for namedroppers@ops.ietf.org; Wed, 19 May 2010 15:14:31 +0000 X-DNSBL-MILTER: Passed Received: from av1.ics.forth.gr ([139.91.157.71]) by mailgate.ics.forth.gr (8.14.3/ICS-FORTH/V10-1.8-GATE) with ESMTP id o4JFDv9r000863; Wed, 19 May 2010 18:14:29 +0300 (EEST) X-AuditID: 8b5b9d47-b7c28ae0000015d4-2b-4bf40035f29c Received: from enigma.ics.forth.gr (webmail.ics.forth.gr [139.91.1.30]) by av1.ics.forth.gr (SMTP Outbound / FORTH / ICS) with SMTP id C8.B1.05588.53004FB4; Wed, 19 May 2010 18:13:57 +0300 (EEST) Received: from Thanatos (thanatos.ics.forth.gr [139.91.88.160]) (authenticated bits=0) by enigma.ics.forth.gr (8.14.3//ICS-FORTH/V10.3.0C-EXTNULL-SSL-SASL) with ESMTP id o4JFDuqI020810 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Wed, 19 May 2010 18:13:56 +0300 From: "Vaggelis Segredakis" To: "=?iso-8859-7?Q?'Alfred_H=CEnes'?=" Cc: References: <201005191433.QAA13726@TR-Sys.de> Subject: [dnsext] RE: On adoption of two drafts ... Date: Wed, 19 May 2010 18:13:41 +0300 Message-ID: <2787750F517D45FFB7FBBA85CA821E80@ics.forth.gr> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-7" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 In-Reply-To: <201005191433.QAA13726@TR-Sys.de> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Thread-Index: Acr3YHepeg1G2MhJS1mwdJLhqycv+gAAP7Ng X-Brightmail-Tracker: AAAAARRG44Y= X-j-chkmail-Score: MSGID : 4BF40035.000 on mailgate : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-ICS-JCHK-SCL: Ham Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear Alfred, Thank you for your email. I would be one of the first to agree with you = that a domain name should not be considered a word, it is a number mnemonic reference. It is however a fact of modern life that domain names are = used as words, some of them even across several language platforms and character sets and most words are used for domain names.=20 I do not want to present a linguistic problem to the DNSEXT WG for a solution. As a registry we are looking for a technical solution to DNAME = a domain tree right from the top, not one layer below. Call it = DNAME+CNAME, BNAME, xNAME or any other future technical term. My report of the actual details of how this need appeared along with IDNs was there as a = historic and explanatory reference to our request. The discussion *if* this issue really is an issue has already taken = place on February the 16th. From the meeting minutes: "There was enough = indication of support to suggest that the WG might want to tackle the problem". What = we lack now is some clear path of work to identify which proposed solution would be good to begin with. Best, Vaggelis -----Original Message----- From: Alfred H=CEnes [mailto:ah@TR-Sys.de]=20 Sent: Wednesday, May 19, 2010 5:33 PM To: segred@ics.forth.gr Cc: namedroppers@ops.ietf.org Subject: RE: On adoption of two drafts ... Vaggelis Segredakis wrote: > In the .gr ccTLD we have presented in 2005 the option of registering > IDN domain names in Greek. The Greek language requires for all > multi syllabus words to have an accent sign called "tonos" over > one of the letters. [...] Unfortunately, hereby we apparently are back at one of the greatest ratholes ever seen in DNS internationalization. Wasn't it one of the fundamental characteristics of the DNS that DNS labels are _not_ "words" (in any language), but simply abstract _identifiers_ in a more user friendly alphabet than IP addresses? I vaguely recall from IDNA discussion on the use of IDNA with the Arabic languages (and scripts) that it had been reported to the IETF community that "The hardest part in this work was to escape from the (mis)concept of a couple of stakeholders that DNS labels were 'words' in one of the Arabic languages and therefore linguistic rules would have to be superimposed on DNS labels." If application of a linguistic rule for Greek is the sole background of your requirement, aren't we in a similar position again? I do not support work on DNS protocol changes based on such specific (and arguably inappropriate) reasoning. If we shall undertake such effort, a "neutral" problem statement needs to be formulated and taken as the _only_ base for the subsequent work. IMO, for any purpose to be discussed here, the definition of DNS labels from the basic DNS standards should be taken for given, and this WG should refrain from imposing semantic rules of any kind on DNS labels. In other words: DNS Protocol mechanisms should work with any semantics imposed in a uniform manner by other bodies on *all* DNS labels. Scoped semantics of specific classes of DNS labels MUST remain out of scope of the discussion in this WG. If we agree on a generally desirable scheme/model of "equivalence" of domain _names_ (any restriction to equivalence of single _labels_ within a zone IMO is not worth such effort), it may happen that someone can apply the ensuing protocol extensions for purposes not amenable to consensus in the IETF; they may deploy such usage, but that MUST NOT become topic of discussion in this WG, if we actually want to arrive at success *within any finite time span*. A few general thoughts: The examples shown so far seem to indicate that any generally useful equivalence scheme needs to admit composition and iteration. I.e., it must be possible to store an equivalence for a single label that somehow automagically applies to all compositions containing the domain name which an instance of the equivalence mechanism is regarded to have as its owner, and such equivalences can happen to be 'crossed' multiple times in the resolution process of a multi- label DNS name. The variety, complexity, and context-specifity of equivalence 'nets' envisioned makes it clear that neither end system resolvers nor caches should be burdened with extraneous storing and/or processing requirements for equivalences. Equivalences mentioned so far apparently are neither generic nor symmetrical. This IMO implies that these 'equivalences' are not equivalence relations in a mathematical (set theoretical) sense; each instance of an 'equivalence class' instead needs to be represented by a simply-connected, loop-free, directed graph with a 'canonical' name form (chosen by the entity defining the instance of equivalence) at its (inverted) root. Each byte of information on any instance of equivalence must be located in the respective authoritative zones, and the nodes and arcs of that graph must be represented "in the DNS way", to allow transporting the information from the authorities to the resolvers in the standard way that admits "vouching" for these components of the graph by normal DNSSEC. In this model, the nodes in the equivalence graphs are represented by DNS nodes, and a directed arc ("arrow") in an equivalence graph is represented by an RR at the 'source' of the arc, pointing to the 'target' of the arc. (This is the model already present in CNAME and DNAME -- set aside synthetic CNAME generation for DNAME.) Kind regards, Alfred. --=20 +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From owner-namedroppers@ops.ietf.org Wed May 19 08:19:04 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DBEA03A6A44; Wed, 19 May 2010 08:19:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.75 X-Spam-Level: X-Spam-Status: No, score=0.75 tagged_above=-999 required=5 tests=[AWL=-1.356, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UYW0NTSfI75J; Wed, 19 May 2010 08:19:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6F7463A6A4E; Wed, 19 May 2010 08:18:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkyp-0001KC-G5 for namedroppers-data0@psg.com; Wed, 19 May 2010 15:14:43 +0000 Received: from [74.125.82.180] (helo=mail-wy0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEkym-0001JU-Tr for namedroppers@ops.ietf.org; Wed, 19 May 2010 15:14:41 +0000 Received: by wyi11 with SMTP id 11so632052wyi.11 for ; Wed, 19 May 2010 08:14:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:content-type; bh=mQdSyFYvFQoFJ/4/umJaI24I0qaO/4A5jwiSe2mM0HA=; b=Ob6ruTUmDuBbV/cjWUi7K9tvk2GqjCcTVtnD7gmi/UkuMMV2BAMSTkCw5WVCriP3Jl jkKToIc7IvkpjhNzN+kcyeRim6oPuSuugqV7v53YyhgsAJGA1TgA9c9BP/D7cfEl8aGx HGO/q97z3lamq7yrMFebBlDg8qJS6jkHRK0Kk= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=HrT995U6D2A3avOtRlp8FXKfSgma/mtu82hcwE9u25FgjoM3zBL364AvUOkmeap9WQ C047JJc0uzVRZ7hYj2jdevJ+iCQSaOdeQmPC6F2dGYW7TOiOtHj6doa1Pfrlmp5gLfQ0 zy/1yEYy/zsSac31Odp+gQDE2cHrzcn/Zb/HQ= MIME-Version: 1.0 Received: by 10.216.158.197 with SMTP id q47mr149105wek.64.1274282078960; Wed, 19 May 2010 08:14:38 -0700 (PDT) Received: by 10.216.89.72 with HTTP; Wed, 19 May 2010 08:14:38 -0700 (PDT) In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> Date: Wed, 19 May 2010 11:14:38 -0400 Message-ID: Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) From: Donald Eastlake To: namedroppers@ops.ietf.org Content-Type: multipart/alternative; boundary=001636833ceaa8fe640486f3ead8 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --001636833ceaa8fe640486f3ead8 Content-Type: text/plain; charset=ISO-8859-1 On Tue, May 18, 2010 at 2:41 PM, Paul Hoffman wrote: > At 11:24 AM -0400 5/18/10, Andrew Sullivan wrote: > ... > > >There are non-trivial costs associated with doing this work. > >Moreover, as I've previously argued, that ICANN is doing something > >using only provisioning and legal agreements is _prima facie_ evidence > >that at least some class of problems can be solved just by improved > >provisioning tools. > > Indeed. If it's good enough for ICANN, why is it not good enough for us? Because ICANN is focused on the top of the tree, they can afford to adopt solutions that are fine for one or two levels with the problem and, at least temporarily, wash their hands of any exponential explosion resulting from applying such solutions to the general N level problem. --Paul Hoffman, Director > --VPN Consortium Donald --001636833ceaa8fe640486f3ead8 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
On Tue, May 18, 2010 at 2:41 PM, Paul Hoffman <paul.hoffman@v= pnc.org> wrote:
At 11:24 AM -0400 5/18/10, Andrew Sullivan wrote:
...

>There are non-trivial costs associated with doing this work.
>Moreover, as I've previously argued, that ICANN is doing something<= br> >using only provisioning and legal agreements is _prima facie_ evidence<= br> >that at least some class of problems can be solved just by improved
>provisioning tools.

Indeed. If it's good enough for ICANN, why is it not good enough = for us?

Because ICANN is focused on the top= of the tree, they can afford to adopt solutions that are fine for one or t= wo levels with the problem and, at least temporarily, wash their hands of a= ny exponential explosion resulting from applying such solutions to the gene= ral N level problem.

--Paul Hoffman, Director
--VPN Consortium

Donald=A0
--001636833ceaa8fe640486f3ead8-- From owner-namedroppers@ops.ietf.org Wed May 19 08:28:10 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F1AF93A69E1; Wed, 19 May 2010 08:28:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -97.685 X-Spam-Level: X-Spam-Status: No, score=-97.685 tagged_above=-999 required=5 tests=[AWL=-0.386, BAYES_50=0.001, J_CHICKENPOX_35=0.6, J_CHICKENPOX_45=0.6, J_CHICKENPOX_51=0.6, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oL-NqP5bC3C8; Wed, 19 May 2010 08:28:10 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 150CD3A6944; Wed, 19 May 2010 08:28:10 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEl6p-0002Xx-8B for namedroppers-data0@psg.com; Wed, 19 May 2010 15:22:59 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEl6m-0002XJ-JQ for namedroppers@ops.ietf.org; Wed, 19 May 2010 15:22:56 +0000 Received: from [10.169.84.23] (89-24-6-50.i4g.tmcz.cz [89.24.6.50]) by mail.nic.cz (Postfix) with ESMTPA id 7413D7342F0; Wed, 19 May 2010 17:22:48 +0200 (CEST) References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <4BF3F28A.1090207@nic.cz> <89201.1274279994@nsa.vix.com> <0FC4B703-E048-41E3-B2DA-E4FB84246EEC@nic.cz> Message-Id: From: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= To: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= In-Reply-To: <0FC4B703-E048-41E3-B2DA-E4FB84246EEC@nic.cz> Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable X-Mailer: iPhone Mail (7E18) Mime-Version: 1.0 (iPhone Mail 7E18) Subject: Re: [dnsext] Re: On adoption of two drafts Date: Wed, 19 May 2010 17:23:34 +0200 Cc: Paul Vixie , "namedroppers@ops.ietf.org" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Just more thoughts. Ondrej Sury On 19.5.2010, at 17:08, Ond=C5=99ej Sur=C3=BD = wrote: > Paul, > > are you saying that we have behaviour: > > A) if cname exist then do_more_work else do_standard_work AFAIK this case is already covered by existing CNAME and DNAME =20 (+synthetized CNAME) handling. > or > > B) if any^cname exist then do_standard_work else do_more_work This case would be broken by BNAME as well (follow-up on Andrew's =20 message) and also by NSEC+RRSIG (which we already have). Or there is a third option: C) if cname exists then do_some_work elif non-cname exists then =20 do_another_work else not_specified And we don't know if cname rule will hit first or not? I don't believe this is the case. After all resolver will happily =20 return CNAME+A record in one DNS message to a DNS client. Ondrej > ? > > (Sent from my iPhone in afternoon traffic jam) > > Ondrej Sury > > On 19.5.2010, at 16:39, Paul Vixie wrote: > >>> Date: Wed, 19 May 2010 16:15:38 +0200 >>> From: Ond=C5=99ej Sur=C3=BD >>> >>> Why do you need signaling? If it fits into all existing scenarios =20= >>> and >>> there is existing support in all resolvers. If it doesn't that >>> CNAME+DNAME is no-go. >> >> most if not all existing recursive servers, forwarders, stubs, and =20= >> apps >> assume that a name either is an alias or is not one. the presence =20 >> of a >> cname will in some cases trigger alias-following behaviour, silently >> ignoring the non-dname data. the presence of a non-cname will in some >> cases trigger resolution behaviour, silently ignoring the alias. >> >> the fact that a given authority server can be patched to allow this =20= >> data >> pattern and that a given set of recursives, stubs, and apps can be =20= >> tested >> to show no problems, doesn't mean this isn't a grave protocol =20 >> violation >> with far reaching consequences. it is avoidable, and such avoidance =20= >> is >> extremely worthwhile. >> >> bname, by comparison, is relatively safe. note though, anything =20 >> involving >> aliases will create 'second class domains'. interior name =20 >> references by >> NS and MX for example cannot refer to an alias since the =20 >> specification >> does not require alias-following behaviour. >> From owner-namedroppers@ops.ietf.org Wed May 19 08:32:22 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DCE123A6AB1; Wed, 19 May 2010 08:32:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.61 X-Spam-Level: X-Spam-Status: No, score=-0.61 tagged_above=-999 required=5 tests=[AWL=-1.025, BAYES_40=-0.185, J_CHICKENPOX_55=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i6DlFL1gyRzR; Wed, 19 May 2010 08:32:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E881B3A6861; Wed, 19 May 2010 08:32:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OElBO-0003E4-8h for namedroppers-data0@psg.com; Wed, 19 May 2010 15:27:42 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OElBL-0003DR-L1 for namedroppers@ops.ietf.org; Wed, 19 May 2010 15:27:39 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 62FACA60E5 for ; Wed, 19 May 2010 15:27:39 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: On adoption of two drafts In-Reply-To: Your message of "Wed, 19 May 2010 10:53:08 -0400." <20100519145308.GB86053@shinkuro.com> References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <4BF3F28A.1090207@nic.cz> <89201.1274279994@nsa.vix.com> <20100519145308.GB86053@shinkuro.com> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Wed, 19 May 2010 15:27:39 +0000 Message-ID: <91313.1274282859@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Wed, 19 May 2010 10:53:08 -0400 > From: Andrew Sullivan > > On Wed, May 19, 2010 at 02:39:54PM +0000, Paul Vixie wrote: > > cname will in some cases trigger alias-following behaviour, silently > > ignoring the non-dname data. the presence of a non-cname will in some > > cases trigger resolution behaviour, silently ignoring the alias. > > [No hat.] The current BNAME proposal includes a synthetic CNAME every > time it sends a BNAME. It appears, then, that it runs into the same > issue you outline above, for it may trigger alias-following behaviour > when it ought not or conversely. No? no. as for dname's synthesis of cnames, for those who do not understand bname, they will see only the cname. this property is conveyed through caches, who themselves either do or don't understand [db]name, and either never hear anything but the cname, or who hear the [bd]name and who know what it means. this is the only safe way to use signalling to introduce new features. it's theoretically possible to enable cname+dname using only an "understand cname+dname" bit, but this is not simpler to deploy (or debug) than a new code point (bname) with an "understand bname" bit. From owner-namedroppers@ops.ietf.org Wed May 19 08:35:09 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E26CF3A6861; Wed, 19 May 2010 08:35:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.798 X-Spam-Level: X-Spam-Status: No, score=-1.798 tagged_above=-999 required=5 tests=[AWL=0.201, BAYES_00=-2.599, J_CHICKENPOX_15=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4vPFMMbW9Onv; Wed, 19 May 2010 08:35:09 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0C6733A6944; Wed, 19 May 2010 08:35:03 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OElFm-0003wx-43 for namedroppers-data0@psg.com; Wed, 19 May 2010 15:32:14 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OElFj-0003vW-Cj for namedroppers@ops.ietf.org; Wed, 19 May 2010 15:32:11 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 3C1B3A60DC for ; Wed, 19 May 2010 15:32:03 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] RE: On adoption of two drafts In-Reply-To: Your message of "Wed, 19 May 2010 10:50:14 -0400." <4BF3FAA6.2010201@ogud.com> References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <6B9E392052064A9D9284E22DFE6FC86D@ics.forth.gr> <4BF3ED73.30402@nic.cz> <74A29EA61AA44111BD84919F2AAC04D2@ics.forth.gr> <4BF3FAA6.2010201@ogud.com> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Wed, 19 May 2010 15:32:03 +0000 Message-ID: <91417.1274283123@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Wed, 19 May 2010 10:50:14 -0400 > From: Olafur Gudmundsson > > The main question in my mind when comparing xNAME vs C+DNAME is > where is the cost ? In xNAME we need to change all DNS protocol > implementations (eventually). In C+DNAME the cost falls on the > authoritative side as only signers and authoritative servers need to be > changed. ... no. see Message-ID: <89201.1274279994@nsa.vix.com> for more information. the only safe way to implement c+d is with an "understand c+d" bit, and i would find this harder to deploy and debug than a new code point and an "understand new code point" bit. thus my support for the bname proposal. From owner-namedroppers@ops.ietf.org Wed May 19 08:44:21 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8EE373A6B90; Wed, 19 May 2010 08:44:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.802 X-Spam-Level: X-Spam-Status: No, score=-1.802 tagged_above=-999 required=5 tests=[AWL=0.197, BAYES_00=-2.599, J_CHICKENPOX_35=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ymG0hQJ-pDzH; Wed, 19 May 2010 08:44:20 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B35FC3A6A28; Wed, 19 May 2010 08:44:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OElNS-0005CN-9u for namedroppers-data0@psg.com; Wed, 19 May 2010 15:40:10 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OElNQ-0005Bw-9G for namedroppers@ops.ietf.org; Wed, 19 May 2010 15:40:08 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 21CB5A60E7 for ; Wed, 19 May 2010 15:40:07 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: "namedroppers\@ops.ietf.org" Subject: Re: [dnsext] Re: On adoption of two drafts In-Reply-To: Your message of "Wed\, 19 May 2010 17\:08\:19 +0200." <0FC4B703-E048-41E3-B2DA-E4FB84246EEC@nic.cz> References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <4BF3F28A.1090207@nic.cz> <89201.1274279994@nsa.vix.com> <0FC4B703-E048-41E3-B2DA-E4FB84246EEC@nic.cz> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Wed, 19 May 2010 15:40:07 +0000 Message-ID: <91797.1274283607@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Ond=C5=99ej Sur=C3=BD > Date: Wed, 19 May 2010 17:08:19 +0200 >=20 > Paul, are you saying that we have behaviour: >=20 > A) if cname exist then do_more_work else do_standard_work > or > B) if any^cname exist then do_standard_work else do_more_work > ? i am aware of at least one implementation of each of those things, but that's not the point. the point is, such implementations would be correct. so, we can't alter the specification in a way that they become incorrect. so, new signalling must be used to introduce the desired new behaviour. From owner-namedroppers@ops.ietf.org Wed May 19 08:44:38 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AEF263A68CC; Wed, 19 May 2010 08:44:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.556 X-Spam-Level: * X-Spam-Status: No, score=1.556 tagged_above=-999 required=5 tests=[AWL=-1.410, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rHzJaGsZLoaW; Wed, 19 May 2010 08:44:37 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9DB6F3A659A; Wed, 19 May 2010 08:44:31 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OElMz-00057c-Ho for namedroppers-data0@psg.com; Wed, 19 May 2010 15:39:41 +0000 Message-Id: Received: from [76.96.62.24] (helo=qmta02.westchester.pa.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OElMv-00055i-Us for namedroppers@ops.ietf.org; Wed, 19 May 2010 15:39:38 +0000 Received: from omta19.westchester.pa.mail.comcast.net ([76.96.62.98]) by qmta02.westchester.pa.mail.comcast.net with comcast id KPRY1e00127AodY52TfeB0; Wed, 19 May 2010 15:39:38 +0000 Received: from Mike-PC3.comcast.net ([68.83.217.57]) by omta19.westchester.pa.mail.comcast.net with comcast id KTfc1e00C1EtFYL3fTfdGf; Wed, 19 May 2010 15:39:38 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Wed, 19 May 2010 11:39:33 -0400 To: Andrew Sullivan ,namedroppers@ops.ietf.org From: Michael StJohns Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data In-Reply-To: References: <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <20100514135457.GA65855@shinkuro.com> <20100514195525.GL65855@shinkuro.com> <20100517143811.GA77756@shinkuro.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: I wanted to make sure this didn't get lost in the discussion. Here's my proposal for a replacement to the text in 5.9 in -11. This is slightly edited from the previous message. At 05:40 PM 5/17/2010, Michael StJohns wrote: >>-- if you could supply actual text for evaluation, that would help. > So how about this for text: -11 section 3.1.1 and or 5.9 --- this may reflect current implementation practice, but I couldn't find this called out anywhere. "Security aware intermediate resolvers MUST set the CD bit on any upstream query for which they have a covering trust anchor (TA) or for which the downstream query has the CD bit set." Security aware intermediate resolvers SHOULD cache data returned from an upstream (server side) query which had the CD bit set. If the downstream (client side) query also has the CD bit set, the resolver MAY defer validation of this data (assuming a covering TA) until a later non-CD bit query for the same data, but MUST mark the cached data as non-validated until local validation actually occurs. Security aware intermediate resolvers SHOULD cache SERVFAIL responses returned from an upstream query. They MUST cache the state of the CD bit in all upstream queries as well. If a security aware intermediate resolver receives a CD bit set query for data which has a SERVFAIL cached, the resolver MUST set the CD bit on the upstream query and SHOULD cache BOTH the SERVFAIL and the data returned on the CD bit set upstream query. Data in cache with the CD bit set which has not been locally validated MUST NOT be returned to a non-CD query. If the cached data has the CD bit set it may be returned to a CD bit set query, if a SERVFAIL is cached it may be returned to a non-CD query, and if the cached data has the CD bit set, and there is a covering TA it may be locally validated and returned. Otherwise this should be treated as a cache miss and the query repeated upstream." The above is closer, but may still be missing some corner cases. For the first paragraph, simply delete the TA if you don't want to force the setting of the CD bit. There is no way - programatically or protocol wise to determine if an upstream resolver can do validation over this query so making this a SHOULD makes no sense whatsoever. The second paragraph covers whether or not unvalidated data is cached and how to treat it. I couldn't find any discussion of tracking validation status in cache in either 4035 or -11, but maybe its somewhere else. If you have a covering TA and enough cycles it may be reasonable to do the validation at the same time [you query] even if the downstream (client) query has the CD bit set rather than having to track validation status. But from a resource POV, I'd rather delay it until someone actually asks to have it done (by not setting the CD bit). The last paragraph deals with an aware resolver which doesn't have a TA covering a CD query from a client. The same upstream query may result either in data (if the client sent a CD query upstream) or the SERVFAIL if it didn't. I think it also implies you have to track whether or not you did an upstream query with the CD bit if you want to serve data from cache. The difference between the MUSTs and SHOULDs above are that the MUSTs are protocol related where the SHOULDs are implementation related. If you don't do a SHOULD (e.g. don't implement cache for both SERVFAIL and CD-bit set data, but only one or the other) you can still do your job by requerying upstream with the appropriate bits set. In the MUST case above, I can't figure out any programmatic way of deciding when to set the CD bit if this a "SHOULD". If you believe this is a SHOULD, then you need text describing the specific configuration option that applies so that we can get consistent behavior out of the DNS. The MUST NOT case above is a security requirement - obviously, unless asked to do so specifically (via the CD bit) you shouldn't return non-validated data to a query if you've got a covering TA. Finally, deleting "intermediate" from before "resolver" may be appropriate because looking at this, it's probably appropriate behavior for a caching validating stub resolver. Different applications will request different behavior out of the local stub resolver. Mike From owner-namedroppers@ops.ietf.org Wed May 19 09:38:54 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 680743A6BD2; Wed, 19 May 2010 09:38:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.276 X-Spam-Level: X-Spam-Status: No, score=0.276 tagged_above=-999 required=5 tests=[AWL=-1.829, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gkn+b5zN4xQR; Wed, 19 May 2010 09:38:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0CF373A6AD4; Wed, 19 May 2010 09:38:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEmCQ-000CvJ-E6 for namedroppers-data0@psg.com; Wed, 19 May 2010 16:32:50 +0000 Received: from [207.182.41.81] (helo=hoffman.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEmCL-000Cu5-5A for namedroppers@ops.ietf.org; Wed, 19 May 2010 16:32:45 +0000 Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o4JGWgWS088927 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 19 May 2010 09:32:43 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> Date: Wed, 19 May 2010 09:32:36 -0700 To: namedroppers@ops.ietf.org From: Paul Hoffman Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 11:14 AM -0400 5/19/10, Donald Eastlake wrote: >On Tue, May 18, 2010 at 2:41 PM, Paul Hoffman <paul.hoffman@vpnc.org> wrote: >Indeed. If it's good enough for ICANN, why is it not good enough for us? > > >Because ICANN is focused on the top of the tree, they can afford to adopt solutions that are fine for one or two levels with the problem and, at least temporarily, wash their hands of any exponential explosion resulting from applying such solutions to the general N level problem. If ICANN adopts such a dorky solution, the DNS world still needs to deploy it in order to make the top level work. If ICANN picks a solution that prevents co-existence with other, more robust solutions, then we're all screwed. I believe ICANN knows this. Thus, they should only pick such a dorky solution if (a) they didn't care about the rest of the DNS or (b) they didn't understand the technical problem. So, again, if it's good enough for ICANN, why is it not good enough for us? --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Wed May 19 09:54:01 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AAC473A6B53; Wed, 19 May 2010 09:54:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.3 X-Spam-Level: *** X-Spam-Status: No, score=3.3 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, J_CHICKENPOX_55=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AEU845xqZL3Q; Wed, 19 May 2010 09:54:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 328023A6C22; Wed, 19 May 2010 09:53:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEmSJ-000FGS-8N for namedroppers-data0@psg.com; Wed, 19 May 2010 16:49:15 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEmSG-000FFo-5l for namedroppers@ops.ietf.org; Wed, 19 May 2010 16:49:12 +0000 Received: from crankycanuck.ca (static-68-179-76-140.ptr.terago.net [68.179.76.140]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 067481ECB41D for ; Wed, 19 May 2010 16:49:10 +0000 (UTC) Date: Wed, 19 May 2010 12:49:09 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: On adoption of two drafts Message-ID: <20100519164908.GD86053@shinkuro.com> References: <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <4BF3F28A.1090207@nic.cz> <89201.1274279994@nsa.vix.com> <20100519145308.GB86053@shinkuro.com> <91313.1274282859@nsa.vix.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <91313.1274282859@nsa.vix.com> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: No hat. On Wed, May 19, 2010 at 03:27:39PM +0000, Paul Vixie wrote: > no. as for dname's synthesis of cnames, for those who do not understand > bname, they will see only the cname. this property is conveyed through > caches, who themselves either do or don't understand [db]name, and either > never hear anything but the cname, or who hear the [bd]name and who know > what it means. Well, I think what this means is that (1) we're going to be synthesizing CNAMEs only again, for people who don't understand BNAME and (2) sometimes caches will have a CNAME when they could have had a BNAME, because the cache wasn't signalled with the BNAME-aware bit so asked with it turned off. Both of these, it seems to me, are the locus of complaints about how DNAME works. > new features. it's theoretically possible to enable cname+dname using > only an "understand cname+dname" bit, but this is not simpler to deploy > (or debug) than a new code point (bname) with an "understand bname" bit. I have a lot of sympathy for that argument. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Wed May 19 10:08:40 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F9B43A63EB; Wed, 19 May 2010 10:08:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.846 X-Spam-Level: X-Spam-Status: No, score=-3.846 tagged_above=-999 required=5 tests=[AWL=-2.009, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PmCSCgGpWNjA; Wed, 19 May 2010 10:08:38 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 49D5C3A6860; Wed, 19 May 2010 10:08:35 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEmfp-000HS2-PW for namedroppers-data0@psg.com; Wed, 19 May 2010 17:03:13 +0000 Received: from [204.152.189.190] (helo=virtualized.org) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEmfm-000HRc-GP for namedroppers@ops.ietf.org; Wed, 19 May 2010 17:03:10 +0000 Received: from localhost (localhost [127.0.0.1]) by virtualized.org (Postfix) with ESMTP id 5BF5AC24B16; Wed, 19 May 2010 10:03:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at virtualized.org Received: from virtualized.org ([127.0.0.1]) by localhost (trantor.virtualized.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EdHFaSSmEb9r; Wed, 19 May 2010 10:03:07 -0700 (PDT) Received: from [10.0.1.4] (c-24-130-210-17.hsd1.ca.comcast.net [24.130.210.17]) by virtualized.org (Postfix) with ESMTP id ECAD2C24B09; Wed, 19 May 2010 10:03:06 -0700 (PDT) Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: David Conrad In-Reply-To: Date: Wed, 19 May 2010 10:03:05 -0700 Cc: namedroppers@ops.ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> To: Paul Hoffman X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Paul, On May 19, 2010, at 9:32 AM, Paul Hoffman wrote: > If ICANN adopts such a dorky solution, the DNS world still needs to = deploy it in order to make the top level work. My understanding (not being directly involved in any of this) is that = ICANN adopted such a "dorky" solution because no real solution existed = with the implicit assumption (or maybe even explicit) that when the IETF = comes up with a real solution, the "dorky" solution would be deprecated = as quickly as possible. > If ICANN picks a solution that prevents co-existence with other, more = robust solutions, then we're all screwed. I believe ICANN knows this. = Thus, they should only pick such a dorky solution if (a) they didn't = care about the rest of the DNS or (b) they didn't understand the = technical problem. or (c), ICANN's community told ICANN that the existing solutions were = insufficient but ICANN had to do something until a real solution = existed. Being stuck being a rock and a hard place (which is the normal = state for ICANN), ICANN tried to come up with a hack that would allow = things to move forward. > So, again, if it's good enough for ICANN, why is it not good enough = for us? Not entirely sure what you're arguing here. Do you think synch'd domains will scale past the root/TLDs? Regards, -drc From owner-namedroppers@ops.ietf.org Wed May 19 10:50:31 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 044A83A6C2F; Wed, 19 May 2010 10:50:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.458 X-Spam-Level: X-Spam-Status: No, score=-1.458 tagged_above=-999 required=5 tests=[AWL=0.990, BAYES_50=0.001, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1SXFwAJpanQ8; Wed, 19 May 2010 10:50:30 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 019E33A6C44; Wed, 19 May 2010 10:50:30 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEnL2-000NBk-IV for namedroppers-data0@psg.com; Wed, 19 May 2010 17:45:48 +0000 Received: from [129.6.16.227] (helo=smtp.nist.gov) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEnKy-000NBA-Lt for namedroppers@ops.ietf.org; Wed, 19 May 2010 17:45:44 +0000 Received: from WSXGHUB2.xchange.nist.gov (WSXGHUB2.xchange.nist.gov [129.6.18.19]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id o4JHjU0I002764 for ; Wed, 19 May 2010 13:45:30 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB2.xchange.nist.gov ([129.6.18.19]) with mapi; Wed, 19 May 2010 13:45:15 -0400 From: "Rose, Scott W." To: IETF DNSEXT WG Date: Wed, 19 May 2010 13:45:29 -0400 Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Thread-Topic: [dnsext] draft-kerr-ixfr-only-01 Thread-Index: Acr3ewnW+0W/hLhwQYugVRRTUCgYEQ== Message-ID: <75EFC58A-260F-4432-9587-EC18E9A21D58@nist.gov> References: <4BF1B0CD.2090205@nzrs.net.nz> In-Reply-To: <4BF1B0CD.2090205@nzrs.net.nz> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-NIST-MailScanner: Found to be clean X-NIST-MailScanner-From: scott.rose@nist.gov Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 17, 2010, at 5:10 PM, Sebastian Castro wrote: > Ray Bellis wrote: >> On 14/05/2010 15:59, "Andrew Sullivan" wrote: >> >>> Dear colleagues, >>> >>> There has previously been some interest expressed in the draft >>> draft-kerr-ixfr-only-01, and we've had a request to adopt it. >>> However, we have not had the requisite five people committing to >>> review through WGLC. >>> >>> In my opinion, the document is mostly complete. We could knock this >>> off pretty quickly if we had committed reviewers. So far we have two >>> people who said they'd review, with a third conditional offer. >> >> +1 for another conditional offer. > > Count with me as reviewer. > Considering I just read the draft, I guess I'm now a reviewer too. >> > > And just being picky: Why the choice for CannotIXFR instead of > IXFRNotAvail, for example? Cannot sounds to me like "I can't give you > this for some reason", "NotAvail" sounds more like "I can't give it to > you because I don't have it". > For that matter, why not use rcode= NotImp? Isn't that why it's there since the document defines a new Opcode? Scott > > Cheers! > >> >> Ray >> >> > > > -- > Sebastian Castro > DNS Specialist > .nz Registry Services (New Zealand Domain Name Registry Limited) > desk: +64 4 495 2337 > mobile: +64 21 400535 > From owner-namedroppers@ops.ietf.org Wed May 19 10:56:11 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4D4BE3A68CD; Wed, 19 May 2010 10:56:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.304 X-Spam-Level: X-Spam-Status: No, score=0.304 tagged_above=-999 required=5 tests=[AWL=-1.801, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D+xlqEpCVBIk; Wed, 19 May 2010 10:56:10 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 18D833A6891; Wed, 19 May 2010 10:56:10 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEnSD-000OIk-PP for namedroppers-data0@psg.com; Wed, 19 May 2010 17:53:13 +0000 Received: from [207.182.41.81] (helo=hoffman.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEnSB-000OIG-7b for namedroppers@ops.ietf.org; Wed, 19 May 2010 17:53:11 +0000 Received: from [10.20.30.158] (sn87.proper.com [75.101.18.87]) (authenticated bits=0) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o4JHr6Ek093662 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 19 May 2010 10:53:08 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> Date: Wed, 19 May 2010 10:53:04 -0700 To: David Conrad From: Paul Hoffman Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 10:03 AM -0700 5/19/10, David Conrad wrote: >Paul, > >On May 19, 2010, at 9:32 AM, Paul Hoffman wrote: >> If ICANN adopts such a dorky solution, the DNS world still needs to deploy it in order to make the top level work. > >My understanding (not being directly involved in any of this) is that ICANN adopted such a "dorky" solution because no real solution existed with the implicit assumption (or maybe even explicit) that when the IETF comes up with a real solution, the "dorky" solution would be deprecated as quickly as possible. That was not my understanding at all from having read the same announcements. My understanding is that ICANN is saying "provisioning is good enough for what we specify", and they specified that duplication will be made all the way down the parallel trees. > > If ICANN picks a solution that prevents co-existence with other, more robust solutions, then we're all screwed. I believe ICANN knows this. Thus, they should only pick such a dorky solution if (a) they didn't care about the rest of the DNS or (b) they didn't understand the technical problem. > >or (c), ICANN's community told ICANN that the existing solutions were insufficient but ICANN had to do something until a real solution existed. Being stuck being a rock and a hard place (which is the normal state for ICANN), ICANN tried to come up with a hack that would allow things to move forward. Yes, that is cetainly another possibility. > > So, again, if it's good enough for ICANN, why is it not good enough for us? > >Not entirely sure what you're arguing here. > >Do you think synch'd domains will scale past the root/TLDs? I do not run trees of any significant depth or width, so I am the wrong person to ask. ICANN presumably asked its constituents and came up with the current policy, and will presumably ask its constituents before coming up with policy changes. Those folks are in a much better position to answer the question than I. --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Wed May 19 11:06:22 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DBBFB3A697A; Wed, 19 May 2010 11:06:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.176 X-Spam-Level: X-Spam-Status: No, score=-1.176 tagged_above=-999 required=5 tests=[AWL=-0.436, BAYES_20=-0.74] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jG89l0iAYhuA; Wed, 19 May 2010 11:06:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CCA853A69A5; Wed, 19 May 2010 11:05:31 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEnas-00006g-28 for namedroppers-data0@psg.com; Wed, 19 May 2010 18:02:10 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEnao-00006I-Sd for namedroppers@ops.ietf.org; Wed, 19 May 2010 18:02:06 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 5B429A610E for ; Wed, 19 May 2010 18:02:06 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: On adoption of two drafts In-Reply-To: Your message of "Wed, 19 May 2010 12:49:09 -0400." <20100519164908.GD86053@shinkuro.com> References: <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <4BF3F28A.1090207@nic.cz> <89201.1274279994@nsa.vix.com> <20100519145308.GB86053@shinkuro.com> <91313.1274282859@nsa.vix.com> <20100519164908.GD86053@shinkuro.com> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Wed, 19 May 2010 18:02:06 +0000 Message-ID: <97759.1274292126@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Wed, 19 May 2010 12:49:09 -0400 > From: Andrew Sullivan > > No hat ... (1) we're going to be synthesizing CNAMEs only again, for > people who don't understand BNAME and (2) sometimes caches will have a > CNAME when they could have had a BNAME, because the cache wasn't > signalled with the BNAME-aware bit so asked with it turned off. Both of > these, it seems to me, are the locus of complaints about how DNAME works. yes but the complaints are about performance not correctness and so i've been lamenting alongside but not treating this as a design constraint. From owner-namedroppers@ops.ietf.org Wed May 19 11:40:17 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C94533A6D51; Wed, 19 May 2010 11:40:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.2 X-Spam-Level: ** X-Spam-Status: No, score=2.2 tagged_above=-999 required=5 tests=[AWL=-0.505, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_55=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vFjbofbbhpyV; Wed, 19 May 2010 11:40:16 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 697313A6BF2; Wed, 19 May 2010 11:29:39 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEnx5-0003UN-CZ for namedroppers-data0@psg.com; Wed, 19 May 2010 18:25:07 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEnx0-0003TS-SS for namedroppers@ops.ietf.org; Wed, 19 May 2010 18:25:03 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4JIOsKW036237; Wed, 19 May 2010 14:24:54 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [10.31.200.147] by Work-Laptop-2.local (PGP Universal service); Wed, 19 May 2010 14:25:00 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Wed, 19 May 2010 14:25:00 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Date: Wed, 19 May 2010 14:23:13 -0400 To: From: Edward Lewis Subject: [dnsext] Relaxing CNAME was RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Cc: ed.lewis@neustar.biz Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 3:30 -0700 5/19/10, Alex Bligh wrote: >Were the prohibition on having CNAME+DNAME together lifted, The protocol could not withstand this. Think of the issue with caches (and imagine the ANY query). If a cache has the CNAME but not the DNAME or vice versa it would have to fetch the other. If you tried to require a cache having the CNAME to try to test for DNAME (or vice versa) you would invite a never ending of fetching these two from the authoritative servers. What if the TTL for CNAME was 3600 and the DNAME 3000? After 300o seconds you'd drop the DNAME. Having a CNAME with TTL of 600, the cache would refresh and get DNAME with TTL of 3000 and CNAME of 600. 600 seconds later, we would wind up with CNAME 3600 and DNAME now at 2400. And on and on. Note my numbers aren't that realistic, there'd be a few seconds here and there skewing - but making the likelihood the two records would TTL out at the same time rare. All that fetching for nothing. If you wanted to relax the combination, you'd have to signal the caches that there was a CNAME and DNAME at a name in case you needed to know that. You'd need another way to signal this per domain...so you might as well just use a new RR type. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Wed May 19 12:04:38 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A12EB3A6B11; Wed, 19 May 2010 12:04:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.334 X-Spam-Level: ** X-Spam-Status: No, score=2.334 tagged_above=-999 required=5 tests=[AWL=-0.393, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mcDVM+nOcEX3; Wed, 19 May 2010 12:04:38 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4ED3D3A6B8F; Wed, 19 May 2010 11:58:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEoMW-0006dd-Jq for namedroppers-data0@psg.com; Wed, 19 May 2010 18:51:24 +0000 Received: from [209.85.214.180] (helo=mail-iw0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEoMS-0006b9-5i for namedroppers@ops.ietf.org; Wed, 19 May 2010 18:51:20 +0000 Received: by iwn8 with SMTP id 8so3233731iwn.11 for ; Wed, 19 May 2010 11:51:19 -0700 (PDT) MIME-Version: 1.0 Received: by 10.231.150.4 with SMTP id w4mr4151835ibv.41.1274295077511; Wed, 19 May 2010 11:51:17 -0700 (PDT) Received: by 10.231.161.69 with HTTP; Wed, 19 May 2010 11:51:17 -0700 (PDT) In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Date: Wed, 19 May 2010 11:51:17 -0700 Message-ID: Subject: Re: [dnsext] Relaxing CNAME was RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) From: Matthew Dempsky To: Edward Lewis Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, May 19, 2010 at 11:23 AM, Edward Lewis wrote= : > The protocol could not withstand this. =A0Think of the issue with caches = (and > imagine the ANY query). =A0If a cache has the CNAME but not the DNAME or = vice > versa it would have to fetch the other. I don't know any caches that exhibit this behavior. Every cache I've tested only issues upstream queries for a QNAME if it has *no* records in cache for that name, not just because it might only have some of them. From owner-namedroppers@ops.ietf.org Wed May 19 12:30:42 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D4F8928C0E0; Wed, 19 May 2010 12:30:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.709 X-Spam-Level: * X-Spam-Status: No, score=1.709 tagged_above=-999 required=5 tests=[AWL=-0.997, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, J_CHICKENPOX_55=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T9TDCTsS-aRg; Wed, 19 May 2010 12:30:41 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 57DED28C0F1; Wed, 19 May 2010 12:20:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEojZ-0009w6-4f for namedroppers-data0@psg.com; Wed, 19 May 2010 19:15:13 +0000 Received: from [74.125.83.52] (helo=mail-gw0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEojS-0009ux-WE for namedroppers@ops.ietf.org; Wed, 19 May 2010 19:15:07 +0000 Received: by gwj20 with SMTP id 20so3135160gwj.11 for ; Wed, 19 May 2010 12:15:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=xdaw1UH9TzfrcQOV8ouQaZx/nvxUw83OOXNQL9wQaW0=; b=IUy59Q5Nv2RHeE+HiV+WBKVG0ZNaryqhEpwBRA5FwA6fZtR3kcc3dLYv//qVQb7Pii PS99GTOxDhJRvnfQisRkEIAHHyMOLwytNbnEIRJrF3GnLVX2DCArygFvbmhXT9rjPtPk gaVOEdGa2lon1b4QJNHK6TRAEmSxqiO3S+KSc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=qru3YPiaR5MUNgcfngC/8ENMzdADONWBGhNaKe9mhGNpbb46TsNS0NeL2L3kPjat+W 3WK+uleAAKeMQgBd3kCabCHfEDQ6i0S8Sbg4drl2SDGx17JMxU93HBchlGam3W+G0cIy jxeQ9O2JZEBOvyRulCw+Mfn3qPqDOYe7kCNSg= MIME-Version: 1.0 Received: by 10.101.177.16 with SMTP id e16mr11293211anp.221.1274296505828; Wed, 19 May 2010 12:15:05 -0700 (PDT) Received: by 10.100.163.17 with HTTP; Wed, 19 May 2010 12:15:05 -0700 (PDT) In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Date: Wed, 19 May 2010 16:15:05 -0300 Message-ID: Subject: Re: [dnsext] Relaxing CNAME was RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) From: Brian Dickson To: Matthew Dempsky Cc: Edward Lewis , namedroppers@ops.ietf.org Content-Type: multipart/alternative; boundary=00163691fb42919b3d0486f746ed Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --00163691fb42919b3d0486f746ed Content-Type: text/plain; charset=ISO-8859-1 On Wed, May 19, 2010 at 3:51 PM, Matthew Dempsky wrote: > On Wed, May 19, 2010 at 11:23 AM, Edward Lewis > wrote: > > The protocol could not withstand this. Think of the issue with caches > (and > > imagine the ANY query). If a cache has the CNAME but not the DNAME or > vice > > versa it would have to fetch the other. > > I don't know any caches that exhibit this behavior. Every cache I've > tested only issues upstream queries for a QNAME if it has *no* records > in cache for that name, not just because it might only have some of > them. > > I think you are making Ed's point for him. :-) What he's saying is, allowing both means caches would need to return both (iff both exist). And what you say, means that current behavior would be incorrect, and caches would all need to be upgraded. (This is because, if the authority server had CNAME+DNAME, but the cache had one but not the other, and returned just that one in response to an ANY, the result would be semantically wrong.) I think we're seeing the rathole for what it is, i.e. that something new (xNAME) is needed if anything is needed, and that CNAME+DNAME might work in a lab, but is not real-world friendly. Brian --00163691fb42919b3d0486f746ed Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
On Wed, May 19, 2010 at 3:51 PM, Matthew Dem= psky <matthew@d= empsky.org> wrote:
On Wed, May 19, 2010 at 11:23 AM, Edward Lewis <Ed.Lewis@neustar.biz> wrote:
> The protocol could not withstand this. =A0Think of the issue with cach= es (and
> imagine the ANY query). =A0If a cache has the CNAME but not the DNAME = or vice
> versa it would have to fetch the other.

I don't know any caches that exhibit this behavior. =A0Every cach= e I've
tested only issues upstream queries for a QNAME if it has *no* records
in cache for that name, not just because it might only have some of
them.


I think you are making Ed's point for him. :-)
What he's saying is, allowing both means caches would need to ret= urn both (iff both exist).

And what you say, means that current beha= vior would be incorrect, and caches would all need to be upgraded.

(This is because, if the authority server had CNAME+DNAME, but the cach= e had one but not the other,
and returned just that one in response to a= n ANY, the result would be semantically wrong.)

I think we're se= eing the rathole for what it is, i.e. that something new (xNAME) is needed = if anything is needed,
and that CNAME+DNAME might work in a lab, but is not real-world friendly.
Brian
--00163691fb42919b3d0486f746ed-- From owner-namedroppers@ops.ietf.org Wed May 19 12:33:30 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CA56F28C115; Wed, 19 May 2010 12:33:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.919 X-Spam-Level: * X-Spam-Status: No, score=1.919 tagged_above=-999 required=5 tests=[AWL=-0.186, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AbqL892NFcDy; Wed, 19 May 2010 12:33:29 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7E05128C16D; Wed, 19 May 2010 12:23:19 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEont-000ARc-VT for namedroppers-data0@psg.com; Wed, 19 May 2010 19:19:41 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEonr-000ARE-Aw for namedroppers@ops.ietf.org; Wed, 19 May 2010 19:19:39 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4JJJU2h073426; Wed, 19 May 2010 15:19:31 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [10.31.200.147] by Work-Laptop-2.local (PGP Universal service); Wed, 19 May 2010 15:19:36 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Wed, 19 May 2010 15:19:36 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Date: Wed, 19 May 2010 15:15:58 -0400 To: namedroppers@ops.ietf.org From: Edward Lewis Subject: Re: [dnsext] Relaxing CNAME was RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Cc: Edward Lewis Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 11:51 -0700 5/19/10, Matthew Dempsky wrote: >On Wed, May 19, 2010 at 11:23 AM, Edward Lewis wrote: >> The protocol could not withstand this. Think of the issue with caches (and >> imagine the ANY query). If a cache has the CNAME but not the DNAME or vice >> versa it would have to fetch the other. > >I don't know any caches that exhibit this behavior. Every cache I've >tested only issues upstream queries for a QNAME if it has *no* records >in cache for that name, not just because it might only have some of >them. That's right. And that illustrates why, in RFC 1034, section 4.3.2, step 3 (and it's updates) there is no place for a rule that says "if the name owns a CNAME and a DNAME then perform the following processing..." -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Wed May 19 12:52:43 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9D4873A6884; Wed, 19 May 2010 12:52:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.699 X-Spam-Level: X-Spam-Status: No, score=-99.699 tagged_above=-999 required=5 tests=[BAYES_50=0.001, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XrdtJ4wLNP6z; Wed, 19 May 2010 12:52:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 62CE33A6A5A; Wed, 19 May 2010 12:50:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEpDV-000DrA-Gm for namedroppers-data0@psg.com; Wed, 19 May 2010 19:46:09 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEpDS-000DqW-Tv for namedroppers@ops.ietf.org; Wed, 19 May 2010 19:46:07 +0000 Received: from [10.0.0.3] (239.146.broadband3.iol.cz [85.70.146.239]) by mail.nic.cz (Postfix) with ESMTPA id 195FB7343DE; Wed, 19 May 2010 21:46:04 +0200 (CEST) References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Message-Id: <1FF85788-BD51-46E7-82FD-6B64E0AEFE7C@nic.cz> From: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= To: Edward Lewis In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit X-Mailer: iPhone Mail (7E18) Mime-Version: 1.0 (iPhone Mail 7E18) Subject: Re: [dnsext] Relaxing CNAME was RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Date: Wed, 19 May 2010 21:46:51 +0200 Cc: "namedroppers@ops.ietf.org" , Edward Lewis Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Ed, how does NSEC and RRSIG fit into your schema of arguments? Ondrej Sury On 19.5.2010, at 21:15, Edward Lewis wrote: > At 11:51 -0700 5/19/10, Matthew Dempsky wrote: >> On Wed, May 19, 2010 at 11:23 AM, Edward Lewis >> wrote: >>> The protocol could not withstand this. Think of the issue with >>> caches (and >>> imagine the ANY query). If a cache has the CNAME but not the >>> DNAME or vice >>> versa it would have to fetch the other. >> >> I don't know any caches that exhibit this behavior. Every cache I've >> tested only issues upstream queries for a QNAME if it has *no* >> records >> in cache for that name, not just because it might only have some of >> them. > > That's right. And that illustrates why, in RFC 1034, section 4.3.2, > step 3 (and it's updates) there is no place for a rule that says "if > the name owns a CNAME and a DNAME then perform the following > processing..." > -- > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > =-=-=- > Edward Lewis > NeuStar You can leave a voice message at +1-571-434-5468 > > Discussing IPv4 address policy is like deciding what to eat on the > Titanic. > From owner-namedroppers@ops.ietf.org Wed May 19 13:10:45 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B88593A69A5; Wed, 19 May 2010 13:10:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.624 X-Spam-Level: ** X-Spam-Status: No, score=2.624 tagged_above=-999 required=5 tests=[AWL=-0.877, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_QP_LONG_LINE=1.396, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ttTL15lkqsO3; Wed, 19 May 2010 13:10:44 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0AA723A69B2; Wed, 19 May 2010 13:10:43 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEpV2-000GYA-NS for namedroppers-data0@psg.com; Wed, 19 May 2010 20:04:16 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEpUz-000GXn-Je for namedroppers@ops.ietf.org; Wed, 19 May 2010 20:04:13 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4JK45C6025265; Wed, 19 May 2010 16:04:06 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [10.31.200.147] by Work-Laptop-2.local (PGP Universal service); Wed, 19 May 2010 16:04:11 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Wed, 19 May 2010 16:04:11 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: <1FF85788-BD51-46E7-82FD-6B64E0AEFE7C@nic.cz> References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <1FF85788-BD51-46E7-82FD-6B64E0AEFE7C@nic.cz> Date: Wed, 19 May 2010 16:03:45 -0400 To: "namedroppers@ops.ietf.org" From: Edward Lewis Subject: Re: [dnsext] Relaxing CNAME was RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Cc: Edward Lewis Content-Type: text/plain; charset="iso-8859-1" ; format="flowed" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 21:46 +0200 5/19/10, Ond=DEej Sur=98 wrote: >Ed, > >how does NSEC and RRSIG fit into your schema of arguments? There's no conditional processing based on the=20 presence of NSEC and/or RRSIG with any other=20 records. Yes, there is special processing when=20 you assemble the answer, but not during the=20 lookup process. What would happen if a cache has "dropped" the=20 RRSIG for a set? The cache would just return the=20 set as if the RRSIG wasn't there. (This is how=20 backwards compatibility is accommodated.) The=20 "omission" would then be up to the validator to=20 recover. -- -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D= -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Wed May 19 13:11:03 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F0E4F3A697F; Wed, 19 May 2010 13:11:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.82 X-Spam-Level: X-Spam-Status: No, score=0.82 tagged_above=-999 required=5 tests=[AWL=-1.343, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RV2dRpBsYc9I; Wed, 19 May 2010 13:11:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 761873A69A5; Wed, 19 May 2010 13:10:52 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEpXB-000GtY-0E for namedroppers-data0@psg.com; Wed, 19 May 2010 20:06:29 +0000 Received: from [209.86.89.64] (helo=elasmtp-curtail.atl.sa.earthlink.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEpX8-000GtJ-04 for namedroppers@ops.ietf.org; Wed, 19 May 2010 20:06:26 +0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=ix.netcom.com; b=Sflmy2wBU6ktfh23Bc29c3G+lO25NTeoluko/PvpH75PHtbddxNakDMqwvqjxaf9; h=Message-ID:Date:From:Reply-To:To:Subject:Cc:Mime-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:X-ELNK-Trace:X-Originating-IP; Received: from [209.86.224.27] (helo=mswamui-billy.atl.sa.earthlink.net) by elasmtp-curtail.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from ) id 1OEpX6-0007fc-Cv; Wed, 19 May 2010 16:06:24 -0400 Received: from 99.93.224.206 by webmail.earthlink.net with HTTP; Wed, 19 May 2010 16:06:23 -0400 Message-ID: <32449572.1274299584368.JavaMail.root@mswamui-billy.atl.sa.earthlink.net> Date: Wed, 19 May 2010 16:06:24 -0400 (EDT) From: "Jeffrey A. Williams" Reply-To: "Jeffrey A. Williams" To: Jiankang YAO , namedroppers@ops.ietf.org, Paul Hoffman , icann-board@icann.org, jeffrey@icann.org, rod_beckstrom@icann.org Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Cc: ga@gnso.icann.org, ssene@ntia.doc.gov, baptista@publicroot.org, roberto@icann.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Mailer: EarthLink Zoo Mail 1.0 X-ELNK-Trace: c8e3929e1e9c87a874cfc7ce3b1ad11381c87f5e519606887e5b1f5fce834c39579f59e314c65d47350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 209.86.224.27 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Jiankang and all, Thanks for sharing this with us. I am not sure that ICANN can now except the DNS technology you refer to that exists now and has existed. Perhaps that is due to a legal problem or some other non-articulated factor. ???? -----Original Message----- >From: Jiankang YAO >Sent: May 18, 2010 9:49 PM >To: Andrew Sullivan , namedroppers@ops.ietf.org, Paul Hoffman >Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) > > >----- Original Message ----- >From: "Paul Hoffman" >To: "Andrew Sullivan" ; >Sent: Wednesday, May 19, 2010 2:41 AM >Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) > >>>There are non-trivial costs associated with doing this work. >>>Moreover, as I've previously argued, that ICANN is doing something >>>using only provisioning and legal agreements is _prima facie_ evidence >>>that at least some class of problems can be solved just by improved >>>provisioning tools. >> >> Indeed. If it's good enough for ICANN, why is it not good enough for us? > >ICANN evalutes the current DNS technology including DNAME, but not sure which dns technology can be used. >So icann has to use the provisioning and legal agreements due to lack of the DNS technology to solve it. >ICANN is still looking for and evaluting some dns technology or some potenial dns technology including bname and zone clone. >In case of icann finding it, ICANN will use it. >So icann also said that if there is a DNS technology to solve the problem, icann will push all the TLDs to move to that dns technology. > > >Jiankang Yao > > >> >> --Paul Hoffman, Director >> --VPN Consortium >> Regards, Jeffrey A. Williams Spokesman for INEGroup LLA. - (Over 294k members/stakeholders and growing, strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1@ix.netcom.com Phone: 214-244-4827 From owner-namedroppers@ops.ietf.org Wed May 19 14:01:40 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B880D3A6A96; Wed, 19 May 2010 14:01:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.349 X-Spam-Level: ** X-Spam-Status: No, score=2.349 tagged_above=-999 required=5 tests=[AWL=-0.378, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SSaokYsg-feh; Wed, 19 May 2010 14:01:39 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 971083A6A8C; Wed, 19 May 2010 14:01:39 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEqJR-000O6l-L0 for namedroppers-data0@psg.com; Wed, 19 May 2010 20:56:21 +0000 Received: from [209.85.214.180] (helo=mail-iw0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEqJO-000O6S-Fx for namedroppers@ops.ietf.org; Wed, 19 May 2010 20:56:18 +0000 Received: by iwn8 with SMTP id 8so3369305iwn.11 for ; Wed, 19 May 2010 13:56:17 -0700 (PDT) MIME-Version: 1.0 Received: by 10.231.158.132 with SMTP id f4mr4271685ibx.52.1274302577396; Wed, 19 May 2010 13:56:17 -0700 (PDT) Received: by 10.231.161.69 with HTTP; Wed, 19 May 2010 13:56:17 -0700 (PDT) In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Date: Wed, 19 May 2010 13:56:17 -0700 Message-ID: Subject: Re: [dnsext] Relaxing CNAME was RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) From: Matthew Dempsky To: Brian Dickson Cc: Edward Lewis , namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, May 19, 2010 at 12:15 PM, Brian Dickson wrote: > I think you are making Ed's point for him. :-) No. Ed's claim is tantamount to saying that a recursive resolver must always return all records for a qname in response to an ANY query. However, it's standard practice for caches to only return records that are already in the cache (unless there are none, then an upstream query is in order). E.g., $ dig -t any isc.org @4.2.2.5 ; <<>> DiG 9.4.3-P3 <<>> -t any isc.org @4.2.2.5 ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50900 ;; flags: qr rd ra; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;isc.org. IN ANY ;; ANSWER SECTION: isc.org. 43198 IN RRSIG A 5 2 43200 20100617191610 20100518191610 18516 isc.org. KgmCmfsvCEPmbcA17XPm09qu5CAjItNEC7ka+E/wWjImwUAM6x8dlOje yaXhnKzO+N+5SX9xF27bxepoxrgDZQfNsbFlFXDosZyiv53Z+9ASl2rI LNHLTrfx7t7xne9tobkeDgswBZsw+F0k2s6FihmyVGRLlMR56Ab6Dsbr +W8= isc.org. 43198 IN A 149.20.64.42 isc.org. 43198 IN RRSIG NS 5 2 43200 20100617191610 20100518191610 18516 isc.org. ZUC9p0AvE+ePBYs6Red5nEx8hUW1IvN3gbSsBn4Ah47bNBpydyqR5mGl +wKAbLP8OPdpVgmLL6TQFiZ+toNInB5IRghS2EXhQXuYnqhYoSAH9rbL HOzxGKjSO3zmWPiH8gJM37fm88IF6UAYcdIVK/xMTNvr1kDTSoDbNMxs Nzg= isc.org. 27722 IN NS ams.sns-pb.isc.org. isc.org. 27722 IN NS sfba.sns-pb.isc.org. isc.org. 27722 IN NS ord.sns-pb.isc.org. isc.org. 27722 IN NS ns.isc.afilias-nst.info. ;; Query time: 27 msec ;; SERVER: 4.2.2.5#53(4.2.2.5) ;; WHEN: Wed May 19 13:51:07 2010 ;; MSG SIZE rcvd: 474 However, if you check with one of isc.org's authoritative name servers, you'll notice isc.org also has SOA, MX, TXT, AAAA, SPF, DNSKEY, NSEC, NAPTR, SPF, and a few more RRSIG records. Certainly if isc.org had a DNAME record, it would be handled the same way, so what's the issue with omitting it if isc.org had a CNAME record? From owner-namedroppers@ops.ietf.org Wed May 19 15:06:01 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F04303A6971; Wed, 19 May 2010 15:06:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.957 X-Spam-Level: * X-Spam-Status: No, score=1.957 tagged_above=-999 required=5 tests=[AWL=-0.148, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IdT32UUH7-mj; Wed, 19 May 2010 15:06:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E9C843A681D; Wed, 19 May 2010 15:06:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OErKT-0004hL-1j for namedroppers-data0@psg.com; Wed, 19 May 2010 22:01:29 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OErKP-0004gn-Ue for namedroppers@ops.ietf.org; Wed, 19 May 2010 22:01:26 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4JM1AEx073615; Wed, 19 May 2010 18:01:12 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [192.168.1.104] by Work-Laptop-2.local (PGP Universal service); Wed, 19 May 2010 18:01:20 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Wed, 19 May 2010 18:01:20 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Date: Wed, 19 May 2010 17:57:15 -0400 To: Matthew Dempsky From: Edward Lewis Subject: Re: [dnsext] Relaxing CNAME was RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Cc: Brian Dickson , Edward Lewis , Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 13:56 -0700 5/19/10, Matthew Dempsky wrote: >On Wed, May 19, 2010 at 12:15 PM, Brian Dickson > wrote: >> I think you are making Ed's point for him. :-) > >No. Ed's claim is tantamount to saying that a recursive resolver must >always return all records for a qname in response to an ANY query. No, no. My mail was (evidently poorly) trying to "prove by contradiction" that a cache cannot be programmed to make a decision based on the presence of multiple RRsets at a name. What I was trying to illustrate was that if a cache had a CNAME for a name, it would be a pain to maintain the DNAME because of a vicious cycle of having to retrieve the other to know that there were both. >However, it's standard practice for caches to only return records that >are already in the cache (unless there are none, then an upstream >query is in order). E.g., And that is correct and a reason why an approach that depends on relaxing the CNAME restrictions won't work. Caches don't try to maintain all of the sets at a name, just all of the records at a set. ANY clearly shows this. And there is no ALL qtype. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Wed May 19 15:15:46 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D8EC3A6AC0; Wed, 19 May 2010 15:15:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.662 X-Spam-Level: ** X-Spam-Status: No, score=2.662 tagged_above=-999 required=5 tests=[AWL=-0.665, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_55=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TCp6QuAJ4elu; Wed, 19 May 2010 15:15:45 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5DB063A6AAB; Wed, 19 May 2010 15:15:28 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OErV8-0005pS-Jv for namedroppers-data0@psg.com; Wed, 19 May 2010 22:12:30 +0000 Received: from [209.85.214.180] (helo=mail-iw0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OErV6-0005p9-5Z for namedroppers@ops.ietf.org; Wed, 19 May 2010 22:12:28 +0000 Received: by iwn8 with SMTP id 8so3447570iwn.11 for ; Wed, 19 May 2010 15:12:27 -0700 (PDT) MIME-Version: 1.0 Received: by 10.231.155.131 with SMTP id s3mr4373370ibw.2.1274307147204; Wed, 19 May 2010 15:12:27 -0700 (PDT) Received: by 10.231.161.69 with HTTP; Wed, 19 May 2010 15:12:27 -0700 (PDT) In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Date: Wed, 19 May 2010 15:12:27 -0700 Message-ID: Subject: Re: [dnsext] Relaxing CNAME was RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) From: Matthew Dempsky To: Edward Lewis Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, May 19, 2010 at 2:57 PM, Edward Lewis wrote: > No, no. =A0My mail was (evidently poorly) trying to "prove by contradicti= on" > that a cache cannot be programmed to make a decision based on the presenc= e > of multiple RRsets at a name. =A0What I was trying to illustrate was that= if a > cache had a CNAME for a name, it would be a pain to maintain the DNAME > because of a vicious cycle of having to retrieve the other to know that > there were both. CNAME+DNAME-aware caches could better handle the situation, and legacy caches would still work, if suboptimally. I don't see an issue. >> However, it's standard practice for caches to only return records that >> are already in the cache (unless there are none, then an upstream >> query is in order). =A0E.g., > > And that is correct and a reason why an approach that depends on relaxing > the CNAME restrictions won't work. Please elaborate. I fail to see how this would be a problem for CNAME+DNAM= E. From owner-namedroppers@ops.ietf.org Wed May 19 15:42:01 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 63D453A6A96; Wed, 19 May 2010 15:42:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.148 X-Spam-Level: X-Spam-Status: No, score=-0.148 tagged_above=-999 required=5 tests=[AWL=-1.349, BAYES_50=0.001, J_CHICKENPOX_15=0.6, J_CHICKENPOX_55=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C6Onz1F6mZis; Wed, 19 May 2010 15:42:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2D4813A6A00; Wed, 19 May 2010 15:41:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OErtk-0008Cy-9t for namedroppers-data0@psg.com; Wed, 19 May 2010 22:37:56 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OErth-0008CV-3j for namedroppers@ops.ietf.org; Wed, 19 May 2010 22:37:53 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id CA55FEC5B8; Wed, 19 May 2010 22:37:34 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4JMbNPm046054; Thu, 20 May 2010 08:37:25 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005192237.o4JMbNPm046054@drugs.dv.isc.org> To: Olafur Gudmundsson Cc: Vaggelis Segredakis , =?ISO-8859-2?Q?=27Ond=F8ej_Sur=FD=27?= , namedroppers@ops.ietf.org From: Mark Andrews References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <6B9E392052064A9D9284E22DFE6FC86D@ics.forth.gr> <4BF3ED73.30402@nic.cz> <74A29EA61AA44111BD84919F2AAC04D2@ics.forth.gr> <4BF3FAA6.2010201@ogud.com> Subject: Re: [dnsext] RE: On adoption of two drafts In-reply-to: Your message of "Wed, 19 May 2010 10:50:14 -0400." <4BF3FAA6.2010201@ogud.com> Date: Thu, 20 May 2010 08:37:23 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <4BF3FAA6.2010201@ogud.com>, Olafur Gudmundsson writes: > > > The main question in my mind when comparing xNAME vs C+DNAME is > where is the cost ? > In xNAME we need to change all DNS protocol implementations (eventually). > In C+DNAME the cost falls on the authoritative side as only signers > and authoritative servers need to be changed. Not true. I'm aware of changes that need to be made to the resolver side of BIND for C+DNAME. I posted the minimum changes to get the authoritative side of BIND working for C+DNAME. When doing that I noted that similar changes need to be made for cache lookups. They are small changes but changes never the less. Whether one can live with the side effects of not making that change remains to be seen. > Resolvers will not get confused as "exact match" queries get CNAME > answer and "partial match" get DNAME answer. > > The only failure mode for C+D that I see: > is the possible lack of DNAME support in resolvers > recursive validators rejecting NSEC/NSEC3 records with both > DNAME and CNAME bits set. One needs to do lots of experimentation and testing. > Olafur > > On 19/05/2010 10:05 AM, Vaggelis Segredakis wrote: > > It is not technical but rather an "adoption-phase" problem: If there will > > not be a distinct DNS command with specific characteristics but instead a > > differentiation of the protocol from a version and beyond, we will have for > > years people asking "Why it is not working on my machine but it is ok on > > yours?". If this is not considered a prohibiting factor, I cannot raise any > > other objections now, I haven't thought it through yet. > > > > We tried to test CNAME+DNAME but the Bind does not accept the zone as valid > . > > If you manage to get it to work, please share your results. > > > > Vaggelis > > > > -----Original Message----- > > From: Ondøej Surý [mailto:ondrej.sury@nic.cz] > > Sent: Wednesday, May 19, 2010 4:54 PM > > To: Vaggelis Segredakis > > Cc: 'Alex Bligh'; namedroppers@ops.ietf.org > > Subject: Re: On adoption of two drafts > > > > On 19.5.2010 12:49, Vaggelis Segredakis wrote: > >> I am afraid that just changing the restriction of CNAME+DNAME will create > >> havoc. You would not be able to determine if a domain name is resolved as > > it > >> should be, it would depend on the version of the resolver but without any > >> warning. > > > > Could you elaborate on that? I still didn't have a time to do thorough > > testing, but initial tests showed no impact on resolvers. I promise to > > do more testing soon. > > > >> Other than this, the CNAME+DNAME is actually pretty much the xNAME we ask > >> for. > > > > Ondrej > > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Wed May 19 17:27:02 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED4BD3A6A6E; Wed, 19 May 2010 17:27:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.705 X-Spam-Level: ** X-Spam-Status: No, score=2.705 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_55=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n4XOBls+TEYD; Wed, 19 May 2010 17:27:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E9E5D3A6927; Wed, 19 May 2010 17:27:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEtTZ-000Ga2-6o for namedroppers-data0@psg.com; Thu, 20 May 2010 00:19:01 +0000 Received: from [89.16.176.221] (helo=mail.avalus.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEtTV-000GZa-Nt for namedroppers@ops.ietf.org; Thu, 20 May 2010 00:18:58 +0000 Received: from [10.113.78.195] (unknown [142.131.242.100]) by mail.avalus.com (Postfix) with ESMTPSA id 4E8E3C568F7; Thu, 20 May 2010 01:18:53 +0100 (BST) Date: Wed, 19 May 2010 17:18:51 -0700 From: Alex Bligh Reply-To: Alex Bligh To: Mark Andrews cc: Vaggelis Segredakis , 'Andrew Sullivan' , namedroppers@ops.ietf.org, 'Sotiris Panaretou' , Alex Bligh Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Message-ID: In-Reply-To: <201005191354.o4JDsfOp034332@drugs.dv.isc.org> References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --On 19 May 2010 23:54:41 +1000 Mark Andrews wrote: >> Were the prohibition on having CNAME+DNAME together lifted, together with >> appropriate signalling (which can be no harder than the signalling to >> support xNAME), would this resolve the problem you describe any less >> well than xNAME? If it's no worse, it seems to me it would be >> substantially easier. > > I don't believe that there is appropriate signaling for CNAME + DNAME. > If you have a method please post the details. There clearly isn't now. I was wondering whether developing one would be easier than xNAME proposals, but there would be no point wasting brain cycles on the idea if it didn't do the job, hence the question. -- Alex Bligh From owner-namedroppers@ops.ietf.org Wed May 19 17:49:03 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CB7EC3A6916; Wed, 19 May 2010 17:49:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.11 X-Spam-Level: X-Spam-Status: No, score=-0.11 tagged_above=-999 required=5 tests=[AWL=-1.311, BAYES_50=0.001, J_CHICKENPOX_15=0.6, J_CHICKENPOX_55=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SOtNI15hmKSI; Wed, 19 May 2010 17:49:03 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C67183A63C9; Wed, 19 May 2010 17:49:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEtr7-000IfK-Cv for namedroppers-data0@psg.com; Thu, 20 May 2010 00:43:21 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEtr4-000IeB-Fa for namedroppers@ops.ietf.org; Thu, 20 May 2010 00:43:18 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id B9AD0EC5DE; Thu, 20 May 2010 00:43:15 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4K0hCEn048787; Thu, 20 May 2010 10:43:12 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005200043.o4K0hCEn048787@drugs.dv.isc.org> To: Alex Bligh Cc: Vaggelis Segredakis , "'Andrew Sullivan'" , namedroppers@ops.ietf.org, "'Sotiris Panaretou'" From: Mark Andrews References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) In-reply-to: Your message of "Wed, 19 May 2010 17:18:51 MST." Date: Thu, 20 May 2010 10:43:12 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Alex Bligh writes: > > > --On 19 May 2010 23:54:41 +1000 Mark Andrews wrote: > > >> Were the prohibition on having CNAME+DNAME together lifted, together with > >> appropriate signalling (which can be no harder than the signalling to > >> support xNAME), would this resolve the problem you describe any less > >> well than xNAME? If it's no worse, it seems to me it would be > >> substantially easier. > > > > I don't believe that there is appropriate signaling for CNAME + DNAME. > > If you have a method please post the details. > > There clearly isn't now. I was wondering whether developing one would > be easier than xNAME proposals, but there would be no point wasting > brain cycles on the idea if it didn't do the job, hence the question. Define the job? Bundled names or being able to redirect a name and it decendents independently. We keep thinking "is this a solution to the idn tld problem" when we should be thinking is this a good tool to have in the tool chest. cname+dname is a useful tool (with known issues) bname is a different tool (with known issues) Which one is better depends on what you want to do. If you want to bundle namespaces bname is a better tool as you can say bname or ns as you don't provide the opportunity to redirect the differently. If you are not trying to bundle namespaces then c+dname may be a better tool for you as it provides more freedom. The chairs are too focused on what is good for "idn tlds" rather than being focused on "are these good tools in their own right". shadow also needs to be looked at in the "is this a good tool" light. I'm undecided on that. soa+ns+cname is another potential tool to have in the tool chest. This has similar issues to cname+dname. For both cname+dname and soa+ns+cname we need to ask, is the possible pain worth the benefit that comes from relaxing the cname and other data rules for these types. We answered "yes" with DNSSEC to this question for nsec/nxt/key. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Wed May 19 20:04:33 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CDB673A6BCC; Wed, 19 May 2010 20:04:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.493 X-Spam-Level: * X-Spam-Status: No, score=1.493 tagged_above=-999 required=5 tests=[AWL=-1.507, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xbIwDP4-kmr2; Wed, 19 May 2010 20:04:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BF9013A6A77; Wed, 19 May 2010 20:04:32 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEvxd-0003I7-Kh for namedroppers-data0@psg.com; Thu, 20 May 2010 02:58:13 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEvxa-0003Hr-PC for namedroppers@ops.ietf.org; Thu, 20 May 2010 02:58:11 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id A92E11ECB41D for ; Thu, 20 May 2010 02:58:06 +0000 (UTC) Date: Wed, 19 May 2010 22:58:02 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: [dnsext] One chair's focus (was: On adoption of two drafts) Message-ID: <20100520025801.GA1194@shinkuro.com> References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <201005200043.o4K0hCEn048787@drugs.dv.isc.org> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Speaking only for myself. On Thu, May 20, 2010 at 10:43:12AM +1000, Mark Andrews wrote: > The chairs are too focused on what is good for "idn tlds" rather > than being focused on "are these good tools in their own right". I'm a little dismayed (and actually, if I didn't trust Mark's earnestness as I do, I'd be a little insulted) that the above is the impression I've given. So let me try to be clearer: we are not going to solve any general issue with IDN TLDs, and I'm not trying to. Neither, however, am I willing to ask only whether BNAME or shadow zones are good tools in their own right. I've no doubt they are. That's not all of what engineering questions are about. The questions I see before us come down to these: 1. Is there a problem? 2. Is it one that can't be solved already? 3. Is it something we are in a position to solve? (How completely?) 4. What are the consequences of solving it? I think we agreed in our interim back in February that the answer to (1) was "yes". I thought we had reason to believe that the answer to (2) was "yes", also, except that some registries (ICANN among but not alone among them) seem to have worked around this. The answer to question (3) is still open, in my view, because we still haven't a strong and clear statement of what problem(s) we are trying to solve. And finally, question (4) is wide open. It's what I've been talking about most in this recent thread. Owing to its inherent flexibility, the DNS can probably be altered enough to solve just about any issue that arises. That does not mean that it ought to be: just because we can does not mean that we should. Owing to its age and consequent ossification, the DNS resists additions and modifications. We've seen this repeatedly. As a salient example, the DNAME-bis draft has been kicking around for some time, and we still don't have clear agreement because there are details about which there are some disagreements. DNAME is not some novelty, and yet there are significant though narrow issues that haven't been resolved completely. And anyway, people still claim that DNAME is bad not just on performance grounds, but because there are systems that look like they support it but don't. (It makes no difference if there are actually such systems, because if people believe there are, it's as great an impediment to deployment.) Moreover, _one_ of the consequences of taking on new work is that we actually take it on. This WG does not have a stellar record of work progression. Ed Lewis will perhaps send me another observation that the work progress record is due to lack of leadership, and I cheerfully accept his judgement. But regardless, we don't seem to come to quick agreement even on narrow and focussed issues, and I worry that something as dramatic as the BNAME and shadow zone proposals just won't get the extensive review they desperately need. Such an outcome would serve nobody. This WG is nominally asleep, and we took the decision to enter that state because we thought the protocol was effectively done. I am not asking whether these proposed tools solve a special problem: I've gone out of my way to ensure we framed the question differently than that. But I'm also not asking whether these tools are good on their own. The question is whether on the whole they are good for the DNS. I am having a hard time coming to a conclusion about that. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Wed May 19 20:39:23 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 039953A6BFA; Wed, 19 May 2010 20:39:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.242 X-Spam-Level: X-Spam-Status: No, score=0.242 tagged_above=-999 required=5 tests=[AWL=-0.753, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RU3xNULkutoa; Wed, 19 May 2010 20:39:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0696D3A6802; Wed, 19 May 2010 20:39:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEwYB-0006AA-Bf for namedroppers-data0@psg.com; Thu, 20 May 2010 03:35:59 +0000 Received: from [74.125.82.52] (helo=mail-ww0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEwY8-00069t-9P for namedroppers@ops.ietf.org; Thu, 20 May 2010 03:35:56 +0000 Received: by wwb22 with SMTP id 22so1258756wwb.11 for ; Wed, 19 May 2010 20:35:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=QqfC1EDXEGwnix3WvAQ4WmoiZ3LKOXbzlKNUvn7wRRs=; b=DtKZD7bXpK/c2QPdm9/hWB2JJr3h3QqAyS12GAGeyahIxUIliEirhXdlbtVSmRLG0w xtFDXBOg+QwPiT54MC3kUsNIkfnDPlDcDxMAGSqO9o2tf1dIjiUyOmkH3nXKm3JscTBR twEnRswH29487k/Ylz0Uy5eAS/UbicvmNBBns= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=O3N/oe8rgMuVcFuEsTgalLkHOq/o472AYFTfVa2QhuLUl+R892KKn7xeRZ2kaMlxhJ a1Rzepxf36huymWBDLq/zCB13UcgNQ+AT8B7qW6XAJQWIpM3NjtYATQmMvIawHZle3Sg VQ0ZFClGqTNlLK3/WWUZObNU84Uy/BV4M6eLM= MIME-Version: 1.0 Received: by 10.216.93.20 with SMTP id k20mr243783wef.109.1274326554656; Wed, 19 May 2010 20:35:54 -0700 (PDT) Received: by 10.216.229.210 with HTTP; Wed, 19 May 2010 20:35:54 -0700 (PDT) In-Reply-To: <20100514150514.GG65855@shinkuro.com> References: <473778789.26681@cnnic.cn> <20100514150514.GG65855@shinkuro.com> Date: Wed, 19 May 2010 23:35:54 -0400 Message-ID: Subject: Re: [dnsext] DNSEXT @ IETF-78 From: Donald Eastlake To: Andrew Sullivan Cc: namedroppers@ops.ietf.org Content-Type: multipart/alternative; boundary=0016e6d641c79e3fcb0486fe455f Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --0016e6d641c79e3fcb0486fe455f Content-Type: text/plain; charset=ISO-8859-1 On Fri, May 14, 2010 at 11:05 AM, Andrew Sullivan wrote: > On Fri, May 14, 2010 at 10:21:52AM +0800, Jiankang YAO wrote: > > > > I suggest to discuss the drafts" bname and zone clone " in IETF-78 > > What is there to discuss in the drafts? > > We have not yet made a determination about whether there is work to be > done at all on this general topic. The Chairs are preparing an > outline of what we think the discussion has yielded. (We hope to have > a draft on this topic posted soon.) > Seems like there is enough controversy in this area to warrant some prepared presentations and face-to-face discussion. Donald > ... > > Best, > > A (speaking for myself, but as co-chair) > > -- > Andrew Sullivan > ajs@shinkuro.com > Shinkuro, Inc. > --0016e6d641c79e3fcb0486fe455f Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
On Fri, May 14, 2010 at 11:05 AM, Andrew Sulliva= n <ajs@shinkuro.co= m> wrote:
On Fri, May 14, 2010 at 10:21:52AM +0800, Jiankang YAO wr= ote:
>
> I suggest to discuss the drafts" bname and zone clone " in I= ETF-78

What is there to discuss in the drafts?

We have not yet made a determination about whether there is work to be
done at all on this general topic. =A0The Chairs are preparing an
outline of what we think the discussion has yielded. =A0(We hope to have a draft on this topic posted soon.)

See= ms like there is enough controversy in this area to warrant some prepared p= resentations and face-to-face discussion.

Donald
=A0
...

Best,

A (speaking for myself, but as co-chair)

--
Andrew Sullivan
ajs@shinkuro.com
Shinkuro, Inc.
--0016e6d641c79e3fcb0486fe455f-- From owner-namedroppers@ops.ietf.org Wed May 19 20:39:35 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8445C3A6C27; Wed, 19 May 2010 20:39:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.675 X-Spam-Level: X-Spam-Status: No, score=-0.675 tagged_above=-999 required=5 tests=[AWL=-0.676, BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cN1DRg6U1yja; Wed, 19 May 2010 20:39:34 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8D1ED3A6BFA; Wed, 19 May 2010 20:39:30 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEwXA-00066B-Mw for namedroppers-data0@psg.com; Thu, 20 May 2010 03:34:56 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OEwX8-00065s-4Q for namedroppers@ops.ietf.org; Thu, 20 May 2010 03:34:54 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 65CFEEC61B for ; Thu, 20 May 2010 03:34:47 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4K3YiAD050837 for ; Thu, 20 May 2010 13:34:45 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005200334.o4K3YiAD050837@drugs.dv.isc.org> To: namedroppers@ops.ietf.org From: Mark Andrews References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520025801.GA1194@shinkuro.com> Subject: Re: [dnsext] One chair's focus (was: On adoption of two drafts) In-reply-to: Your message of "Wed, 19 May 2010 22:58:02 -0400." <20100520025801.GA1194@shinkuro.com> Date: Thu, 20 May 2010 13:34:44 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <20100520025801.GA1194@shinkuro.com>, Andrew Sullivan writes: > Speaking only for myself. > > On Thu, May 20, 2010 at 10:43:12AM +1000, Mark Andrews wrote: > > > The chairs are too focused on what is good for "idn tlds" rather > > than being focused on "are these good tools in their own right". > > I'm a little dismayed (and actually, if I didn't trust Mark's > earnestness as I do, I'd be a little insulted) that the above is the > impression I've given. So let me try to be clearer: we are not going > to solve any general issue with IDN TLDs, and I'm not trying to. > > Neither, however, am I willing to ask only whether BNAME or shadow > zones are good tools in their own right. I've no doubt they are. > That's not all of what engineering questions are about. > > The questions I see before us come down to these: > > 1. Is there a problem? > > 2. Is it one that can't be solved already? > > 3. Is it something we are in a position to solve? (How completely?) > > 4. What are the consequences of solving it? > > I think we agreed in our interim back in February that the answer to > (1) was "yes". I thought we had reason to believe that the answer to > (2) was "yes", also, except that some registries (ICANN among but not > alone among them) seem to have worked around this. The answer to > question (3) is still open, in my view, because we still haven't a > strong and clear statement of what problem(s) we are trying to solve. > And finally, question (4) is wide open. It's what I've been talking > about most in this recent thread. > > Owing to its inherent flexibility, the DNS can probably be altered > enough to solve just about any issue that arises. That does not mean > that it ought to be: just because we can does not mean that we should. > > Owing to its age and consequent ossification, the DNS resists > additions and modifications. We've seen this repeatedly. As a > salient example, the DNAME-bis draft has been kicking around for some > time, and we still don't have clear agreement because there are > details about which there are some disagreements. None of which impacts actual deployment. The only real change in the draft is the relaxation of the TTL of the synthesised CNAME. > DNAME is not some > novelty, and yet there are significant though narrow issues that > haven't been resolved completely. And anyway, people still claim that > DNAME is bad not just on performance grounds, but because there are > systems that look like they support it but don't. (It makes no > difference if there are actually such systems, because if people > believe there are, it's as great an impediment to deployment.) Yep, there is lots of FUD floating around about DNAME. > Moreover, _one_ of the consequences of taking on new work is that we > actually take it on. This WG does not have a stellar record of work > progression. Ed Lewis will perhaps send me another observation that > the work progress record is due to lack of leadership, and I > cheerfully accept his judgement. But regardless, we don't seem to > come to quick agreement even on narrow and focussed issues, and I > worry that something as dramatic as the BNAME and shadow zone > proposals just won't get the extensive review they desperately need. > Such an outcome would serve nobody. > > This WG is nominally asleep, and we took the decision to enter that > state because we thought the protocol was effectively done. I am not > asking whether these proposed tools solve a special problem: I've > gone out of my way to ensure we framed the question differently than > that. But I'm also not asking whether these tools are good on their > own. The question is whether on the whole they are good for the DNS. > I am having a hard time coming to a conclusion about that. Which just makes you undecided. It shouldn't stop them proceeding if there is consenus that they are useful and should be worked on. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Wed May 19 21:21:15 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F391A3A688F; Wed, 19 May 2010 21:21:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.963 X-Spam-Level: * X-Spam-Status: No, score=1.963 tagged_above=-999 required=5 tests=[AWL=-0.142, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Luo0IpKncq-7; Wed, 19 May 2010 21:21:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0619A3A67F0; Wed, 19 May 2010 21:21:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OExAq-0009l6-Hu for namedroppers-data0@psg.com; Thu, 20 May 2010 04:15:56 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OExAn-0009ki-6k for namedroppers@ops.ietf.org; Thu, 20 May 2010 04:15:53 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4K4FgQ7007530; Thu, 20 May 2010 00:15:44 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [192.168.1.104] by Work-Laptop-2.local (PGP Universal service); Thu, 20 May 2010 00:15:49 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Thu, 20 May 2010 00:15:49 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: <20100520025801.GA1194@shinkuro.com> References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520025801.GA1194@shinkuro.com> Date: Thu, 20 May 2010 00:15:38 -0400 To: Andrew Sullivan From: Edward Lewis Subject: Re: [dnsext] One chair's focus (was: On adoption of two drafts) Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 22:58 -0400 5/19/10, Andrew Sullivan wrote: >Owing to its inherent flexibility, the DNS can probably be altered >enough to solve just about any issue that arises. That does not mean >that it ought to be: just because we can does not mean that we should. I don't think that flexibility is one of the inherent traits of the DNS. Scaleability, quick response are. The DNS has fundamentally been inflexible due to at least two of it's founding aspects - poor ordering of the fields (specifically the class coming after the name in the envelop) and the use of fixed size fields (necessary for the old processing budgets but rather constraining today). The latter was helped by EDNS, the former is a lost cause. >Owing to its age and consequent ossification, the DNS resists >additions and modifications. We've seen this repeatedly. In my opinion, the reason it is hard to modify the DNS is not age and ossification, it's the fact that underlies much of the rest of the Internet architecture. If you are in a boat and someone is rocking it at the center you will feel it much more than if the rocking is at the edge. If you built a system like DNS today (new and improved!) and then had all of the other Internet apps use it, you'd still have troubles extending it. Except that you could use the class to create IDNs and life would be good. >As a >salient example, the DNAME-bis draft has been kicking around for some >time, and we still don't have clear agreement because there are >details about which there are some disagreements. DNAME is not some >novelty, and yet there are significant though narrow issues that >haven't been resolved completely. And anyway, people still claim that >DNAME is bad not just on performance grounds, but because there are >systems that look like they support it but don't. (It makes no >difference if there are actually such systems, because if people >believe there are, it's as great an impediment to deployment.) The problem is that DNAME was poorly specified to begin with (it was only PS) and still became widely deployed. There's nothing wrong with DNAME on paper that can't be fixed with a few keystrokes but the impact in deployed code is said to be great. >Moreover, _one_ of the consequences of taking on new work is that we >actually take it on. This WG does not have a stellar record of work >progression. Ed Lewis will perhaps send me another observation that >the work progress record is due to lack of leadership, and I >cheerfully accept his judgement. But regardless, we don't seem to >come to quick agreement even on narrow and focussed issues, and I >worry that something as dramatic as the BNAME and shadow zone >proposals just won't get the extensive review they desperately need. >Such an outcome would serve nobody. Dang, this is why I don't usually read this far into messages, because I hate to see folks mention me. Yes, I think that the WG could benefit from firmer guidance through the workload but there are other dilemmas. We have a lot of Proposed Standard documents that haven't progressed to Draft Standard because they need fixes - but frequently fixes are shot down based on there being some existing code base. DNAME is one example of that. Just about any "-clarify" has faced that problem. >This WG is nominally asleep, and we took the decision to enter that >state because we thought the protocol was effectively done. I am not >asking whether these proposed tools solve a special problem: I've >gone out of my way to ensure we framed the question differently than >that. But I'm also not asking whether these tools are good on their >own. The question is whether on the whole they are good for the DNS. >I am having a hard time coming to a conclusion about that. It's true that the discussion to date has co-mingled solving for a particular and ill-defined "business case" (IDN) and solutions offered so far. There are other reasons to make "two zones work the same" but we just haven't talked about them. The DNS is a simple protocol and that is its genius. That's not to say that we can't improve it, but mission creep has a negative connotation. Such as adding night vision to a weapon system resulting in adding weight and thus lessening mobility. DNS benefits so many in so many ways, small changes can have large consequences, so lots of old codgers like to say "are you really sure you want that?" before accepting new work. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Wed May 19 21:26:03 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6007D3A68B3; Wed, 19 May 2010 21:26:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.267 X-Spam-Level: ** X-Spam-Status: No, score=2.267 tagged_above=-999 required=5 tests=[AWL=-0.438, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_55=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OvypUaMRbsRY; Wed, 19 May 2010 21:26:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id EAB3A3A67F0; Wed, 19 May 2010 21:26:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OExHk-000AJj-KQ for namedroppers-data0@psg.com; Thu, 20 May 2010 04:23:04 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OExHh-000AJP-SM for namedroppers@ops.ietf.org; Thu, 20 May 2010 04:23:02 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4K4Mm5u014704; Thu, 20 May 2010 00:22:49 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [192.168.1.104] by Work-Laptop-2.local (PGP Universal service); Thu, 20 May 2010 00:22:56 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Thu, 20 May 2010 00:22:56 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <48770.1267431355@nsa.vix.com> <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> Date: Thu, 20 May 2010 00:18:43 -0400 To: Matthew Dempsky From: Edward Lewis Subject: Re: [dnsext] Relaxing CNAME was RE: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Cc: Edward Lewis , namedroppers@ops.ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 15:12 -0700 5/19/10, Matthew Dempsky wrote: >Please elaborate. I fail to see how this would be a problem for CNAME+DNAME. Tomorrow I can expound more - but the answer lies in "why was the CNAME restriction was put in place to start with?" E.g, what is the response to "/class/DNAME> directed to an owner name with a CNAME+DNAME at the authority and the cache only has the CNAME? -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Wed May 19 21:51:10 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EEFFB3A6C64; Wed, 19 May 2010 21:51:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.176 X-Spam-Level: X-Spam-Status: No, score=-3.176 tagged_above=-999 required=5 tests=[AWL=-1.339, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zd1J1S-1lDwF; Wed, 19 May 2010 21:51:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E52EC3A6B04; Wed, 19 May 2010 21:51:07 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OExfG-000Cr5-L9 for namedroppers-data0@psg.com; Thu, 20 May 2010 04:47:22 +0000 Received: from [204.152.189.190] (helo=virtualized.org) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OExfD-000CqM-VO for namedroppers@ops.ietf.org; Thu, 20 May 2010 04:47:20 +0000 Received: from localhost (localhost [127.0.0.1]) by virtualized.org (Postfix) with ESMTP id DF014C273ED; Wed, 19 May 2010 21:47:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at virtualized.org Received: from virtualized.org ([127.0.0.1]) by localhost (trantor.virtualized.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uW+rWcckY0Zx; Wed, 19 May 2010 21:47:15 -0700 (PDT) Received: from [10.0.1.4] (c-24-130-210-17.hsd1.ca.comcast.net [24.130.210.17]) by virtualized.org (Postfix) with ESMTP id 92210C273DD; Wed, 19 May 2010 21:47:15 -0700 (PDT) Subject: Re: [dnsext] One chair's focus (was: On adoption of two drafts) Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: David Conrad In-Reply-To: <20100520025801.GA1194@shinkuro.com> Date: Wed, 19 May 2010 21:47:14 -0700 Cc: namedroppers@ops.ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <9CB7D39F-BDDA-4E09-8894-9C1DCD0CEB36@virtualized.org> References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520025801.GA1194@shinkuro.com> To: Andrew Sullivan X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Andrew, On May 19, 2010, at 7:58 PM, Andrew Sullivan wrote: > On Thu, May 20, 2010 at 10:43:12AM +1000, Mark Andrews wrote: >> The chairs are too focused on what is good for "idn tlds" rather >> than being focused on "are these good tools in their own right". >=20 > I'm a little dismayed (and actually, if I didn't trust Mark's > earnestness as I do, I'd be a little insulted) that the above is the > impression I've given. To be honest, I've gotten the same impression as Mark and it has been a = bit frustrating. I'm glad to hear that impression is mistaken. > 1. Is there a problem? > 2. Is it one that can't be solved already? > 3. Is it something we are in a position to solve? (How = completely?) > 4. What are the consequences of solving it? >=20 > I think we agreed in our interim back in February that the answer to > (1) was "yes". I thought we had reason to believe that the answer to > (2) was "yes", also, except that some registries (ICANN among but not > alone among them) seem to have worked around this. =20 Err, it is a work around because a problem exists. It would be = unfortunate that the work around be used as an excuse not to solve the = problem in a more appropriate way. Or do you believe administratively = synchronized domains is a scalable, general, long-term solution? > The answer to > question (3) is still open, in my view, because we still haven't a > strong and clear statement of what problem(s) we are trying to solve. I'll admit some confusion here. I thought I saw at least two people = provide a fairly clear statement of the problems they'd like to see = solved and since you agree (1) is "yes", it would seem to imply that at = least one problem was positively identified. Are you saying (3) is open = because there is more than one problem to solve? > And finally, question (4) is wide open. It's what I've been talking = about most in this recent thread. Confused here too. The discussions regarding consequences is a direct = result of analysis of proposed solutions to perceived problems, which = would appear to suggest (1) through (3) have answered positively (after = all, you wouldn't discuss consequences if you weren't discussing = potential solutions to problems). > Moreover, _one_ of the consequences of taking on new work is that we > actually take it on. This WG does not have a stellar record of work > progression. =20 Well, yes, but that is hardly unique to DNSEXT. It seems quite easy for = the IETF to get trapped in design-by-committee spinning, attempts to = create ivory tower perfect solutions, and non-productive navel gazing, = but this isn't the right venue for that discussion. > I worry that something as dramatic as the BNAME and shadow zone > proposals just won't get the extensive review they desperately need. > Such an outcome would serve nobody. A valid concern. However, it is worth noting that there appear to be = folks with active interest in addressing the problem(s) that have been = identified as their businesses depend on it. As such, a solution will be = created. Failure to standardize on a particular solution would likely = mean we'd either have a de facto standard defined by one or two vendors = or interoperability failures or both. This is also a non-optimal = outcome. > The question is whether on the whole they are good for the DNS. > I am having a hard time coming to a conclusion about that. I don't understand the question. What does it mean to be "good for the = DNS"? To me, the questions we need to answer are quite simple: 0) is the base protocol defined by the IETF? 1) is there a problem? 2) do multiple independent parties need a standardized solution to that = problem? 3) are there folks who will work on a solution within the context of an = IETF working group? If the answer to these are yes, then the work should be undertaken by = the IETF. Value judgements of "good for X" seem to me to be a breeding = ground for Ratholes Of Unusual Size. Regards, -drc From owner-namedroppers@ops.ietf.org Wed May 19 21:59:08 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D41FC3A6C7C; Wed, 19 May 2010 21:59:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.798 X-Spam-Level: X-Spam-Status: No, score=-0.798 tagged_above=-999 required=5 tests=[AWL=-0.799, BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0p9LHFP5MN-t; Wed, 19 May 2010 21:59:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D7CC33A6C7B; Wed, 19 May 2010 21:59:07 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OExnH-000Dkd-Cv for namedroppers-data0@psg.com; Thu, 20 May 2010 04:55:39 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OExnF-000DkD-Ac for namedroppers@ops.ietf.org; Thu, 20 May 2010 04:55:37 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id DFFB1A61EC for ; Thu, 20 May 2010 04:55:35 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: dns drinking game? (was Re: [dnsext] One chair's focus (was: ...) ) In-Reply-To: Your message of "Thu, 20 May 2010 00:15:38 -0400." References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520025801.GA1194@shinkuro.com> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Thu, 20 May 2010 04:55:35 +0000 Message-ID: <34784.1274331335@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Thu, 20 May 2010 00:15:38 -0400 > From: Edward Lewis > > ... poor ordering of the fields (specifically the class coming after the > name in the envelop) and the use of fixed size fields (necessary for the > old processing budgets but rather constraining today). The latter was > helped by EDNS, the former is a lost cause. is this a new drinking game? deal me in. there should never have been an RRCLASS field, since all records in a message must have the same class as QCLASS. (as all records in a zone must have the zone's class.) and worse, rrsets should have been slabbed on the wire. finally, for now anyway, we should have had a character encoding for on-the-wire, specifying USASCII case insensitivity as one option, and specifying binary names otherwise. if anybody tops those i'll have to chug a beer or something, after which i will start in on dns's "presentation layer". From owner-namedroppers@ops.ietf.org Thu May 20 02:10:42 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 54C1C3A6939; Thu, 20 May 2010 02:10:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.595 X-Spam-Level: X-Spam-Status: No, score=-1.595 tagged_above=-999 required=5 tests=[AWL=-0.854, BAYES_20=-0.74] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NzpNnZK6mnbV; Thu, 20 May 2010 02:10:38 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 686F23A6845; Thu, 20 May 2010 02:10:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF1e9-000Gbp-6w for namedroppers-data0@psg.com; Thu, 20 May 2010 09:02:29 +0000 Received: from [2001:7b8:206:1:216:76ff:feb8:3c02] (helo=bartok.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF1e2-000GXQ-8S for namedroppers@ops.ietf.org; Thu, 20 May 2010 09:02:23 +0000 Received: from bartok.nlnetlabs.nl (localhost [127.0.0.1]) by bartok.nlnetlabs.nl (8.14.4/8.14.4) with ESMTP id o4K92H3S031119 for ; Thu, 20 May 2010 11:02:17 +0200 (CEST) (envelope-from jaap@bartok.nlnetlabs.nl) Message-Id: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> To: "namedroppers@ops.ietf.org" Subject: [dnsext] draft-kerr-ixfr-only-01 Date: Thu, 20 May 2010 11:02:17 +0200 From: Jaap Akkerhuis X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.2.5 (bartok.nlnetlabs.nl [127.0.0.1]); Thu, 20 May 2010 11:02:17 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: I quickly scanned this document and was surprised to see in Section 2. IXRF Server Side: A IXFR server receiving a DNS message requesting IXFR-ONLY will reply as described in RFC 1995 [RFC1995] if it is able to produce an IXFR for the serial number requested. Maybe I'm wrong but I always thought that an IXRF request had as data the current serial from the requester and that the server only when it is "higher" (according to the serial arithmetic). I guess should read the draft (and also the original IXFR RFC) more closely. jaap PS. These remarks make me a reviewer. From owner-namedroppers@ops.ietf.org Thu May 20 02:10:44 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 063E03A6939; Thu, 20 May 2010 02:10:44 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Duplicate header field: "Message-ID" X-Spam-Flag: NO X-Spam-Score: 3.7 X-Spam-Level: *** X-Spam-Status: No, score=3.7 tagged_above=-999 required=5 tests=[AWL=-0.449, BAYES_50=0.001, FH_RELAY_NODNS=1.451, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DspHylwuFdgY; Thu, 20 May 2010 02:10:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6EF033A6A5B; Thu, 20 May 2010 02:10:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF1do-000GVm-Pn for namedroppers-data0@psg.com; Thu, 20 May 2010 09:02:08 +0000 Received: from [159.226.7.146] (helo=cnnic.cn) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF1dk-000GV2-Af for namedroppers@ops.ietf.org; Thu, 20 May 2010 09:02:04 +0000 Received: (eyou send program); Thu, 20 May 2010 17:02:03 +0800 Message-ID: <474346123.30162@cnnic.cn> X-EYOUMAIL-SMTPAUTH: yaojk@cnnic.cn Received: from unknown (HELO lenovo47e041cf) (127.0.0.1) by 127.0.0.1 with SMTP; Thu, 20 May 2010 17:02:03 +0800 Message-ID: From: "Jiankang YAO" To: "David Conrad" , "Andrew Sullivan" Cc: References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520025801.GA1194@shinkuro.com> <474331558.12807@cnnic.cn> Subject: Re: [dnsext] One chair's focus (was: On adoption of two drafts) Date: Thu, 20 May 2010 17:02:07 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5931 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIkRhdmlkIENvbnJhZCIgPGRy Y0B2aXJ0dWFsaXplZC5vcmc+DQpUbzogIkFuZHJldyBTdWxsaXZhbiIgPGFqc0BzaGlua3Vyby5j b20+DQpDYzogPG5hbWVkcm9wcGVyc0BvcHMuaWV0Zi5vcmc+DQpTZW50OiBUaHVyc2RheSwgTWF5 IDIwLCAyMDEwIDEyOjQ3IFBNDQpTdWJqZWN0OiBSZTogW2Ruc2V4dF0gT25lIGNoYWlyJ3MgZm9j dXMgKHdhczogT24gYWRvcHRpb24gb2YgdHdvIGRyYWZ0cykNCg0KDQoNCj5JIGRvbid0IHVuZGVy c3RhbmQgdGhlIHF1ZXN0aW9uLiAgV2hhdCBkb2VzIGl0IG1lYW4gdG8gYmUgImdvb2QgZm9yIHRo ZSBETlMiPw0KDQo+VG8gbWUsIHRoZSBxdWVzdGlvbnMgd2UgbmVlZCB0byBhbnN3ZXIgYXJlIHF1 aXRlIHNpbXBsZToNCg0KPjApIGlzIHRoZSBiYXNlIHByb3RvY29sIGRlZmluZWQgYnkgdGhlIElF VEY/DQo+MSkgaXMgdGhlcmUgYSBwcm9ibGVtPw0KPjIpIGRvIG11bHRpcGxlIGluZGVwZW5kZW50 IHBhcnRpZXMgbmVlZCBhIHN0YW5kYXJkaXplZCBzb2x1dGlvbiB0byB0aGF0IHByb2JsZW0/DQo+ MykgYXJlIHRoZXJlIGZvbGtzIHdobyB3aWxsIHdvcmsgb24gYSBzb2x1dGlvbiB3aXRoaW4gdGhl IGNvbnRleHQgb2YgYW4gSUVURiB3b3JraW5nIGdyb3VwPw0KPg0KPg0KDQpZb3VyIHF1ZXN0aW9u cyBhcmUgcXVpdGUgY2xlYXIgdG8gbWUuDQoNCkkgbGlrZSB5b3VyIHF1ZXN0aW9uIHN0eWxlcyBh Ym92ZS4gSXQgc2VlbXMgdGhhdCB5b3VyIHF1ZXN0aW9ucyBhcmUgdGhlIG5vcm1hbCBxdWVzdGlv bnMgbWFueSBvdGhlciBXR3MgZG8gbGlrZSBhc2sgd2hlbiB0aGV5IGVuY291bnRlciB0aGUgc2lt aWxhciBzaXR1YXRpb25zLg0KDQoNCkppYW5rYW5nIFlhbw0KDQo+SWYgdGhlIGFuc3dlciB0byB0 aGVzZSBhcmUgeWVzLCB0aGVuIHRoZSB3b3JrIHNob3VsZCBiZSB1bmRlcnRha2VuIGJ5IHRoZSBJ RVRGLiAgVmFsdWUganVkZ2VtZW50cyBvZiAiZ29vZCBmb3IgWCIgc2VlbSB0byBtZSB0byBiZSBh IGJyZWVkaW5nIGdyb3VuZCBmb3IgPlJhdGhvbGVzIE9mIFVudXN1YWwgU2l6ZS4NCj4NCj4NCg0K From owner-namedroppers@ops.ietf.org Thu May 20 04:45:53 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EB34E3A69FA; Thu, 20 May 2010 04:45:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.028 X-Spam-Level: X-Spam-Status: No, score=-1.028 tagged_above=-999 required=5 tests=[AWL=-0.288, BAYES_20=-0.74] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iAe5wj6AR-eA; Thu, 20 May 2010 04:45:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1DEF43A68FA; Thu, 20 May 2010 04:45:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF47O-000E3i-9K for namedroppers-data0@psg.com; Thu, 20 May 2010 11:40:50 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF47L-000E3E-3r for namedroppers@ops.ietf.org; Thu, 20 May 2010 11:40:47 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id C6045EC6AD; Thu, 20 May 2010 11:40:43 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4KBef0f054066; Thu, 20 May 2010 21:40:41 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005201140.o4KBef0f054066@drugs.dv.isc.org> To: Jaap Akkerhuis Cc: "namedroppers@ops.ietf.org" From: Mark Andrews References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-reply-to: Your message of "Thu, 20 May 2010 11:02:17 +0200." <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> Date: Thu, 20 May 2010 21:40:41 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl>, Jaap Akkerhuis wr ites: > I quickly scanned this document and was surprised to see in Section > 2. IXRF Server Side: > > > A IXFR server receiving a DNS message requesting IXFR-ONLY will reply > as described in RFC 1995 [RFC1995] if it is able to produce an IXFR > for the serial number requested. > > Maybe I'm wrong but I always thought that an IXRF request had as > data the current serial from the requester and that the server only > when it is "higher" (according to the serial arithmetic). A IXFR server can return up-to-date, a delta style response or a axfr style responses. IXFR-ONLY removes the latter. > I guess should read the draft (and also the original IXFR RFC) more > closely. > > jaap > > PS. These remarks make me a reviewer. > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Thu May 20 05:07:04 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E4DC73A696F; Thu, 20 May 2010 05:07:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.495 X-Spam-Level: X-Spam-Status: No, score=-1.495 tagged_above=-999 required=5 tests=[AWL=-0.385, BAYES_05=-1.11] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wCuPwF6bAZbS; Thu, 20 May 2010 05:07:04 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 55FF73A6BC3; Thu, 20 May 2010 05:06:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF4SP-000HAJ-UL for namedroppers-data0@psg.com; Thu, 20 May 2010 12:02:33 +0000 Received: from [2001:7b8:206:1:216:76ff:feb8:3c02] (helo=bartok.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF4SL-000H87-9a for namedroppers@ops.ietf.org; Thu, 20 May 2010 12:02:30 +0000 Received: from bartok.nlnetlabs.nl (localhost [127.0.0.1]) by bartok.nlnetlabs.nl (8.14.4/8.14.4) with ESMTP id o4KC2NQ6055728 for ; Thu, 20 May 2010 14:02:23 +0200 (CEST) (envelope-from jaap@bartok.nlnetlabs.nl) Message-Id: <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> To: "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-reply-to: <201005201140.o4KBef0f054066@drugs.dv.isc.org> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> Comments: In-reply-to Mark Andrews message dated "Thu, 20 May 2010 21:40:41 +1000." Date: Thu, 20 May 2010 14:02:23 +0200 From: Jaap Akkerhuis X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.2.5 (bartok.nlnetlabs.nl [127.0.0.1]); Thu, 20 May 2010 14:02:23 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > I quickly scanned this document and was surprised to see in Section > 2. IXRF Server Side: > > > A IXFR server receiving a DNS message requesting IXFR-ONLY will reply > as described in RFC 1995 [RFC1995] if it is able to produce an IXFR > for the serial number requested. > > Maybe I'm wrong but I always thought that an IXRF request had as > data the current serial from the requester and that the server only > when it is "higher" (according to the serial arithmetic). A IXFR server can return up-to-date, a delta style response or a axfr style responses. IXFR-ONLY removes the latter. Yes, but that is not the point. The draft says "the serial number requested" but as far as I know you doesn't send the serial number you want, you sent the serial you have. To give a full citation of RFC 1995: 3. Query Format The IXFR query packet format is the same as that of a normal DNS query, but with the query type being IXFR and the authority section containing the SOA record of client's version of the zone. This is quite different then what the draft states. jaap From owner-namedroppers@ops.ietf.org Thu May 20 05:50:37 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 779A73A6B7C; Thu, 20 May 2010 05:50:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100 X-Spam-Level: X-Spam-Status: No, score=-100 tagged_above=-999 required=5 tests=[BAYES_50=0.001, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ztFv-VRvrwQU; Thu, 20 May 2010 05:50:36 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5D87A3A6992; Thu, 20 May 2010 05:50:34 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF57e-000MpM-Vc for namedroppers-data0@psg.com; Thu, 20 May 2010 12:45:11 +0000 Received: from [2001:7b8:206:1::1] (helo=open.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF57b-000Mow-Nt for namedroppers@ops.ietf.org; Thu, 20 May 2010 12:45:08 +0000 Received: from [IPv6:2001:7b8:206:1:215:afff:fed2:e121] ([IPv6:2001:7b8:206:1:215:afff:fed2:e121]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.3/8.14.3) with ESMTP id o4KCj3Jg003394 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 20 May 2010 14:45:05 +0200 (CEST) (envelope-from matthijs@nlnetlabs.nl) Message-ID: <4BF52F40.6070401@nlnetlabs.nl> Date: Thu, 20 May 2010 14:46:56 +0200 From: Matthijs Mekking Organization: NLnet Labs User-Agent: Thunderbird 2.0.0.24 (X11/20100317) MIME-Version: 1.0 To: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <20100514145956.GF65855@shinkuro.com> In-Reply-To: <20100514145956.GF65855@shinkuro.com> X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.3 (open.nlnetlabs.nl [IPv6:2001:7b8:206:1::1]); Thu, 20 May 2010 14:45:05 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm still not convinced of why we need a protocol change for this. I think this problem can be tackled configuration-wise. For the client: NSD already has configuration settings for turning off AXFR fallback. For the server: You need to update the server in order to understand IXFR-ONLY. Well, in that case the server software might just as well implement a ixfr-only option, instead of this technical solution, in order to implement this behavior. Best regards, Matthijs Andrew Sullivan wrote: > Dear colleagues, > > There has previously been some interest expressed in the draft > draft-kerr-ixfr-only-01, and we've had a request to adopt it. > However, we have not had the requisite five people committing to > review through WGLC. > > In my opinion, the document is mostly complete. We could knock this > off pretty quickly if we had committed reviewers. So far we have two > people who said they'd review, with a third conditional offer. > > If we do _not_ have committed reviewers by 17:00 UTC on 2010-05-21, > the Chairs will take that as an indication of a lack of interest in > the draft, and will assume that the WG does not want to do this work. > > Best regards, > > Andrew > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEcBAEBAgAGBQJL9S8+AAoJEA8yVCPsQCW5ymAH/3Ik7EyMcNWvlAyctYJMoAcQ /zMAK2/W6r+6niGrJcYdDuO9i3QjFejifQje1y2kpMVGK2f+YLJ23TuAHdjo7vHN 3u5MBQWUMH+4PeYsWdCcplDnGqyXIUmbKnxVsmXCU+JEkyE74JgtibjQoLOC6mpH w4XcO3PWD4x4q8j3Jt+Q8/rNaxlixn81yGv9cZJP2N+ciWv/6J3fYXyDWbxLNUem XM45MxGCCB3zvqPqkkCJQJq630qec76WmlpiOd3b2Nj73tlcZo1IWFS9TljtchH9 XQHUA8lRKvMgj9QZQT92gLwLq/aV02UMRM2W/lq2+m2ooAJ2ICU1vgNU73MicVk= =8t1/ -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Thu May 20 06:17:40 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1675B3A6CA1; Thu, 20 May 2010 06:17:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.084 X-Spam-Level: X-Spam-Status: No, score=-2.084 tagged_above=-999 required=5 tests=[AWL=0.515, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8mn2AVC5Yb76; Thu, 20 May 2010 06:17:39 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 00D4E3A6BFE; Thu, 20 May 2010 06:16:50 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF5Yz-0001EF-Cs for namedroppers-data0@psg.com; Thu, 20 May 2010 13:13:25 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF5Yw-0001D9-Tc for namedroppers@ops.ietf.org; Thu, 20 May 2010 13:13:22 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id BE88FA628F for ; Thu, 20 May 2010 13:13:21 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] One chair's focus (was: On adoption of two drafts) In-Reply-To: Your message of "Thu, 20 May 2010 17:02:07 +0800." <474346123.30162@cnnic.cn> References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520025801.GA1194@shinkuro.com> <474331558.12807@cnnic.cn> <474346123.30162@cnnic.cn> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Thu, 20 May 2010 13:13:21 +0000 Message-ID: <55299.1274361201@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: "Jiankang YAO" > Date: Thu, 20 May 2010 17:02:07 +0800 > > ----- Original Message ----- > From: "David Conrad" > Sent: Thursday, May 20, 2010 12:47 PM > > >To me, the questions we need to answer are quite simple: > > >0) is the base protocol defined by the IETF? > >1) is there a problem? > >2) do multiple independent parties need a standardized solution to that > >problem? > >3) are there folks who will work on a solution within the context of an > >IETF working group? > > Your questions are quite clear to me. > > I like your question styles above. It seems that your questions are the > normal questions many other WGs do like ask when they encounter the > similar situations. +1. From owner-namedroppers@ops.ietf.org Thu May 20 06:38:34 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B14FE3A6BAC; Thu, 20 May 2010 06:38:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.1 X-Spam-Level: X-Spam-Status: No, score=-99.1 tagged_above=-999 required=5 tests=[BAYES_50=0.001, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RCBouZE2MhQI; Thu, 20 May 2010 06:38:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9A0E93A6A18; Thu, 20 May 2010 06:37:50 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF5sK-0003uD-FU for namedroppers-data0@psg.com; Thu, 20 May 2010 13:33:24 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF5sD-0003ow-OX for namedroppers@ops.ietf.org; Thu, 20 May 2010 13:33:17 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id 83F8A73426E; Thu, 20 May 2010 15:33:00 +0200 (CEST) Message-ID: <4BF53A0C.2040607@nic.cz> Date: Thu, 20 May 2010 15:33:00 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: "Rose, Scott W." CC: IETF DNSEXT WG Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <4BF1B0CD.2090205@nzrs.net.nz> <75EFC58A-260F-4432-9587-EC18E9A21D58@nist.gov> In-Reply-To: <75EFC58A-260F-4432-9587-EC18E9A21D58@nist.gov> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 19.5.2010 19:45, Rose, Scott W. wrote: > On May 17, 2010, at 5:10 PM, Sebastian Castro wrote: > >> Ray Bellis wrote: >>> On 14/05/2010 15:59, "Andrew Sullivan" wrote: >>> >>>> Dear colleagues, >>>> >>>> There has previously been some interest expressed in the draft >>>> draft-kerr-ixfr-only-01, and we've had a request to adopt it. >>>> However, we have not had the requisite five people committing to >>>> review through WGLC. >>>> >>>> In my opinion, the document is mostly complete. We could knock this >>>> off pretty quickly if we had committed reviewers. So far we have two >>>> people who said they'd review, with a third conditional offer. >>> >>> +1 for another conditional offer. >> >> Count with me as reviewer. >> > Considering I just read the draft, I guess I'm now a reviewer too. > >>> >> >> And just being picky: Why the choice for CannotIXFR instead of >> IXFRNotAvail, for example? Cannot sounds to me like "I can't give you >> this for some reason", "NotAvail" sounds more like "I can't give it to >> you because I don't have it". >> > > For that matter, why not use rcode= NotImp? Isn't that why it's there since the document defines a new Opcode? Because it has another meaning. CannotIXFR (or IXFRNotAvail) indicates that server is willing to provide IXFR, but it doesn't have needed data. The new RCODE allows client to mark server as temporarily unable to provide IXFR-ONLY and it will try to do it in next run. NotImp indicates lack of IXFR-ONLY support at all. Ondrej -- Ondřej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Thu May 20 07:38:59 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CE55D3A6781; Thu, 20 May 2010 07:38:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.981 X-Spam-Level: * X-Spam-Status: No, score=1.981 tagged_above=-999 required=5 tests=[AWL=-0.124, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ffFPEUP0VKp2; Thu, 20 May 2010 07:38:59 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D79A63A67B7; Thu, 20 May 2010 07:38:58 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF6nc-000D7x-PN for namedroppers-data0@psg.com; Thu, 20 May 2010 14:32:36 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF6na-000D7W-EZ for namedroppers@ops.ietf.org; Thu, 20 May 2010 14:32:34 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4KEW93I081205; Thu, 20 May 2010 10:32:09 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [192.168.1.104] by Work-Laptop-2.local (PGP Universal service); Thu, 20 May 2010 10:32:14 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Thu, 20 May 2010 10:32:14 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: <34784.1274331335@nsa.vix.com> References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520025801.GA1194@shinkuro.com> <34784.1274331335@nsa.vix.com> Date: Thu, 20 May 2010 10:28:50 -0400 To: Paul Vixie From: Edward Lewis Subject: Re: dns drinking game? (was Re: [dnsext] One chair's focus (was: ...) ) Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 4:55 +0000 5/20/10, Paul Vixie wrote: >> Date: Thu, 20 May 2010 00:15:38 -0400 >> From: Edward Lewis >> >> ... poor ordering of the fields (specifically the class coming after the >> name in the envelop) and the use of fixed size fields (necessary for the >> old processing budgets but rather constraining today). The latter was >> helped by EDNS, the former is a lost cause. > >is this a new drinking game? deal me in. there should never have been an >RRCLASS field, since all records in a message must have the same class as >QCLASS. (as all records in a zone must have the zone's class.) and worse, >rrsets should have been slabbed on the wire. finally, for now anyway, we >should have had a character encoding for on-the-wire, specifying USASCII >case insensitivity as one option, and specifying binary names otherwise. > >if anybody tops those i'll have to chug a beer or something, after which >i will start in on dns's "presentation layer". Well, the point was, I wouldn't say that flexibility was one of DNS's strengths. There are a lot of things we could do better on in the second design but are constrained because of the installed base, that is, DNS isn't all that flexible. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Thu May 20 07:57:48 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 499733A690A; Thu, 20 May 2010 07:57:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.11 X-Spam-Level: X-Spam-Status: No, score=-101.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M2p3HXqHg1BO; Thu, 20 May 2010 07:57:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 066763A6887; Thu, 20 May 2010 07:57:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF77R-000GJJ-GG for namedroppers-data0@psg.com; Thu, 20 May 2010 14:53:05 +0000 Received: from [2001:4f8:3:36::28] (helo=white.flame.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF77P-000GIp-93 for namedroppers@ops.ietf.org; Thu, 20 May 2010 14:53:03 +0000 Received: from white.flame.org (localhost [127.0.0.1]) by white.flame.org (Postfix) with ESMTP id C12EF17D213; Thu, 20 May 2010 14:53:02 +0000 (UTC) Received: from bigmac.home.flame.org (unknown [IPv6:2001:470:b8d7:13:21d:4fff:fe47:6790]) (using SSLv3 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by white.flame.org (Postfix) with ESMTPSA id DFE3A17D1CC; Thu, 20 May 2010 14:53:01 +0000 (UTC) Message-ID: <4BF54CCC.5050504@isc.org> Date: Thu, 20 May 2010 09:53:00 -0500 From: Michael Graff User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Jaap Akkerhuis CC: "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> In-Reply-To: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> X-Enigmail-Version: 1.0.1 OpenPGP: id=BE9E0FA6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV using ClamSMTP Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2010-05-20 4:02 AM, Jaap Akkerhuis wrote: > I quickly scanned this document and was surprised to see in Section > 2. IXRF Server Side: > > > A IXFR server receiving a DNS message requesting IXFR-ONLY will reply > as described in RFC 1995 [RFC1995] if it is able to produce an IXFR > for the serial number requested. > > Maybe I'm wrong but I always thought that an IXRF request had as > data the current serial from the requester and that the server only > when it is "higher" (according to the serial arithmetic). I'm not certain if others have answered this to your satisfaction or not, so I'll give it a go. The server may not have a delta chain stored for what the client has and the current version. This would normally cause an AXFR-type response. This draft would cause it to return an error indicating this. All other IXFR characteristics seem to remain unchanged from my quick read. - --Michael -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkv1TMwACgkQ+NNi0s9NRJ2Q5ACfYhH0B0zCCI08Rc2Vrr5PAMkA 1dsAn2apskgaXN4jElbjeT84F8SGMRua =MyOR -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Thu May 20 08:18:34 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 87A253A6B6F; Thu, 20 May 2010 08:18:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101 X-Spam-Level: X-Spam-Status: No, score=-101 tagged_above=-999 required=5 tests=[AWL=-1.600, BAYES_50=0.001, J_CHICKENPOX_15=0.6, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lv0swpS3j2Ql; Thu, 20 May 2010 08:18:32 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4D85D3A67AB; Thu, 20 May 2010 08:18:19 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF7SE-000Jni-VN for namedroppers-data0@psg.com; Thu, 20 May 2010 15:14:34 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF7SC-000Jlp-Jb for namedroppers@ops.ietf.org; Thu, 20 May 2010 15:14:32 +0000 Received: by farside.isc.org (Postfix, from userid 10265) id 0E0FCEC703; Thu, 20 May 2010 15:14:27 +0000 (UTC) Date: Thu, 20 May 2010 15:14:26 +0000 From: Suzanne Woolf To: Mark Andrews Cc: Alex Bligh , Vaggelis Segredakis , 'Andrew Sullivan' , namedroppers@ops.ietf.org, 'Sotiris Panaretou' Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) Message-ID: <20100520151426.GA22640@farside.isc.org> References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <201005200043.o4K0hCEn048787@drugs.dv.isc.org> User-Agent: Mutt/1.4.2.3i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Thu, May 20, 2010 at 10:43:12AM +1000, Mark Andrews wrote: > We keep thinking "is this a solution > to the idn tld problem" when we should be thinking is this a good > tool to have in the tool chest. Mark, I think I agree with you in principle, but it would be helpful if you (or anyone) could provide an example of a case where one or another of the tools we've been discussing is "a good tool to have in the tool chest" outside of the IDN context. > Which one is better depends on what you want to do. > > If you want to bundle namespaces bname is a better tool as you can > say bname or ns as you don't provide the opportunity to redirect > the differently. > > If you are not trying to bundle namespaces then c+dname may be a > better tool for you as it provides more freedom. What does "bundle namespaces" mean, besides "what bname does"? I've only heard references to "bundling names" or "bundling namespaces" in the IDN context, so again it would clarify things to have an additional case. > The chairs are too focused on what is good for "idn tlds" rather > than being focused on "are these good tools in their own right". I suspect it looks this way because the use cases we're presented with have been wrapped in IDN (not just TLD) considerations. If that's the defining use case for whatever we're actually doing here, we should admit it. If not, let's see some others. Suzanne From owner-namedroppers@ops.ietf.org Thu May 20 09:03:02 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 59A373A699D; Thu, 20 May 2010 09:03:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.143 X-Spam-Level: X-Spam-Status: No, score=-2.143 tagged_above=-999 required=5 tests=[AWL=0.456, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vzdJ7TtSSqXL; Thu, 20 May 2010 09:03:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 367183A68EB; Thu, 20 May 2010 09:03:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF887-0000LC-SX for namedroppers-data0@psg.com; Thu, 20 May 2010 15:57:51 +0000 Received: from [2001:7b8:206:1:216:76ff:feb8:3c02] (helo=bartok.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF884-0000Ke-QC for namedroppers@ops.ietf.org; Thu, 20 May 2010 15:57:49 +0000 Received: from bartok.nlnetlabs.nl (localhost [127.0.0.1]) by bartok.nlnetlabs.nl (8.14.4/8.14.4) with ESMTP id o4KFvidO020475 for ; Thu, 20 May 2010 17:57:44 +0200 (CEST) (envelope-from jaap@bartok.nlnetlabs.nl) Message-Id: <201005201557.o4KFvidO020475@bartok.nlnetlabs.nl> To: "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-reply-to: <4BF54CCC.5050504@isc.org> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <4BF54CCC.5050504@isc.org> Comments: In-reply-to Michael Graff message dated "Thu, 20 May 2010 09:53:00 -0500." Date: Thu, 20 May 2010 17:57:44 +0200 From: Jaap Akkerhuis X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.2.5 (bartok.nlnetlabs.nl [127.0.0.1]); Thu, 20 May 2010 17:57:44 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Maybe I'm wrong but I always thought that an IXRF request had as > data the current serial from the requester and that the server only > when it is "higher" (according to the serial arithmetic). I'm not certain if others have answered this to your satisfaction or not, so I'll give it a go. And fail as well. I know what it is supposed to do. However, the text is plain wrong. It implies that the has the desired serial number in the query. And that is incorrect as far as I know. jaap From owner-namedroppers@ops.ietf.org Thu May 20 09:16:00 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 64C743A6C6D; Thu, 20 May 2010 09:15:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.855 X-Spam-Level: X-Spam-Status: No, score=-101.855 tagged_above=-999 required=5 tests=[AWL=0.745, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id prG2+wHQqj6R; Thu, 20 May 2010 09:15:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2D65B3A6AA7; Thu, 20 May 2010 09:15:20 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF8LX-0002Xy-Cf for namedroppers-data0@psg.com; Thu, 20 May 2010 16:11:43 +0000 Received: from [2001:4f8:3:36::28] (helo=white.flame.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF8LV-0002XV-0L for namedroppers@ops.ietf.org; Thu, 20 May 2010 16:11:41 +0000 Received: from white.flame.org (localhost [127.0.0.1]) by white.flame.org (Postfix) with ESMTP id 87A1917D20C; Thu, 20 May 2010 16:11:40 +0000 (UTC) Received: from bigmac.home.flame.org (unknown [IPv6:2001:470:b8d7:13:21d:4fff:fe47:6790]) (using SSLv3 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by white.flame.org (Postfix) with ESMTPSA id D2C6817D20A; Thu, 20 May 2010 16:11:39 +0000 (UTC) Message-ID: <4BF55F3B.8060803@isc.org> Date: Thu, 20 May 2010 11:11:39 -0500 From: Michael Graff User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Jaap Akkerhuis CC: "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <4BF54CCC.5050504@isc.org> <201005201557.o4KFvidO020475@bartok.nlnetlabs.nl> In-Reply-To: <201005201557.o4KFvidO020475@bartok.nlnetlabs.nl> X-Enigmail-Version: 1.0.1 OpenPGP: id=BE9E0FA6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV using ClamSMTP Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2010-05-20 10:57 AM, Jaap Akkerhuis wrote: > > Maybe I'm wrong but I always thought that an IXRF request had as > > data the current serial from the requester and that the server only > > when it is "higher" (according to the serial arithmetic). > > I'm not certain if others have answered this to your satisfaction or > not, so I'll give it a go. > > And fail as well. I know what it is supposed to do. However, the > text is plain wrong. It implies that the has the desired serial > number in the query. > > And that is incorrect as far as I know. Ahh, when I read that text I read it as: The client requested serial X. I have X+N. If I have a path between X and X+N, then I can respond with IXFR. So, the client DOES send what it has, and the server DOES determine "for the client's serial" can it construct a path from where the client is to where the zone is now. It sounds like there are words to change to make this clear. - --Michael -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEUEARECAAYFAkv1XzoACgkQ+NNi0s9NRJ2wEwCY3U7CAu0eCqw5EeXnP0ISSvbl cACfbq1yZCsxIvmjqbpYAjr5f3jT15A= =Uusq -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Thu May 20 09:43:57 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B780F3A6A38; Thu, 20 May 2010 09:43:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.093 X-Spam-Level: X-Spam-Status: No, score=-2.093 tagged_above=-999 required=5 tests=[AWL=0.506, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oKkHAsjzxguF; Thu, 20 May 2010 09:43:56 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A99D23A6965; Thu, 20 May 2010 09:43:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF8mj-0006ou-2v for namedroppers-data0@psg.com; Thu, 20 May 2010 16:39:49 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF8mh-0006oR-3F for namedroppers@ops.ietf.org; Thu, 20 May 2010 16:39:47 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id BEE27A62F2 for ; Thu, 20 May 2010 16:39:46 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-Reply-To: Your message of "Thu, 20 May 2010 11:11:39 EST." <4BF55F3B.8060803@isc.org> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <4BF54CCC.5050504@isc.org> <201005201557.o4KFvidO020475@bartok.nlnetlabs.nl> <4BF55F3B.8060803@isc.org> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Thu, 20 May 2010 16:39:46 +0000 Message-ID: <64912.1274373586@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Thu, 20 May 2010 11:11:39 -0500 > From: Michael Graff > > > And fail as well. I know what it is supposed to do. However, the > > text is plain wrong. It implies that the has the desired serial > > number in the query. > > > > And that is incorrect as far as I know. it is. > Ahh, when I read that text I read it as: The client requested serial X. > I have X+N. If I have a path between X and X+N, then I can respond > with IXFR. the client is including X in its request, but is NOT "requesting" X. > So, the client DOES send what it has, and the server DOES determine "for > the client's serial" can it construct a path from where the client is to > where the zone is now. yes. > It sounds like there are words to change to make this clear. +1. From owner-namedroppers@ops.ietf.org Thu May 20 10:22:05 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3DDF83A6B98; Thu, 20 May 2010 10:22:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.153 X-Spam-Level: X-Spam-Status: No, score=-2.153 tagged_above=-999 required=5 tests=[AWL=0.446, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AQTeHCOs7Cv1; Thu, 20 May 2010 10:21:49 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DDABD3A6B3D; Thu, 20 May 2010 10:20:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF9KK-000C8D-Tz for namedroppers-data0@psg.com; Thu, 20 May 2010 17:14:32 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF9KI-000C7b-EB for namedroppers@ops.ietf.org; Thu, 20 May 2010 17:14:30 +0000 Received: from [199.212.90.24] (helo=dh24.r1.owls.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OF9KE-0008SM-R8; Thu, 20 May 2010 17:14:28 +0000 Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley In-Reply-To: <4BF52F40.6070401@nlnetlabs.nl> Date: Thu, 20 May 2010 13:14:23 -0400 Cc: namedroppers@ops.ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <05A58828-A355-4716-8BBC-A10227B4D982@hopcount.ca> References: <20100514145956.GF65855@shinkuro.com> <4BF52F40.6070401@nlnetlabs.nl> To: Matthijs Mekking X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 199.212.90.24 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-20, at 08:46, Matthijs Mekking wrote: > I'm still not convinced of why we need a protocol change for this. > I think this problem can be tackled configuration-wise. >=20 > For the client: > NSD already has configuration settings for turning off AXFR fallback. What if you want to disable AXFR responses to IXFR queries only for = certain servers, or at certain times of day, or at times of low network = congestion, or due to some other heuristic that the authority-only = server author did not think of? There is more flexibility to be found by allowing clients to specify the = type of zone transfer response they can tolerate than in configuring the = server. Joe From owner-namedroppers@ops.ietf.org Thu May 20 12:33:19 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 04DC83A6BEF; Thu, 20 May 2010 12:33:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1 X-Spam-Level: X-Spam-Status: No, score=-1 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, J_CHICKENPOX_23=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rZEicemqbu3W; Thu, 20 May 2010 12:32:34 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 410823A6A98; Thu, 20 May 2010 12:32:27 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFBM7-0004wm-Qc for namedroppers-data0@psg.com; Thu, 20 May 2010 19:24:31 +0000 Received: from [2001:7b8:206:1::1] (helo=open.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFBM5-0004vW-9J for namedroppers@ops.ietf.org; Thu, 20 May 2010 19:24:29 +0000 Received: from [192.168.1.9] (ip123-112-174-82.adsl2.static.versatel.nl [82.174.112.123]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.3/8.14.3) with ESMTP id o4KJOJv2050347 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 20 May 2010 21:24:21 +0200 (CEST) (envelope-from matthijs@nlnetlabs.nl) Message-ID: <4BF58CDD.60209@nlnetlabs.nl> Date: Thu, 20 May 2010 21:26:21 +0200 From: Matthijs Mekking Organization: NLnet Labs User-Agent: Thunderbird 2.0.0.24 (X11/20100317) MIME-Version: 1.0 To: Joe Abley CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <20100514145956.GF65855@shinkuro.com> <4BF52F40.6070401@nlnetlabs.nl> <05A58828-A355-4716-8BBC-A10227B4D982@hopcount.ca> In-Reply-To: <05A58828-A355-4716-8BBC-A10227B4D982@hopcount.ca> X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.3 (open.nlnetlabs.nl [213.154.224.1]); Thu, 20 May 2010 21:24:23 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Joe Abley wrote: > On 2010-05-20, at 08:46, Matthijs Mekking wrote: > >> I'm still not convinced of why we need a protocol change for this. >> I think this problem can be tackled configuration-wise. >> >> For the client: >> NSD already has configuration settings for turning off AXFR fallback. > > What if you want to disable AXFR responses to IXFR queries only for certain servers, or at certain times of day, or at times of low network congestion, or due to some other heuristic that the authority-only server author did not think of? Point taken, but imho this is irrelevant: the IXFR-ONLY draft does not implement these heuristics either. The problem definition in my eyes is that you want to prevent a full zone transfer. I can see perfectly valid reasons why you want to. I think a turn on|off configuration option suits more than a technical solution to solve this. Best regards, Matthijs > > There is more flexibility to be found by allowing clients to specify the type of zone transfer response they can tolerate than in configuring the server. > > > Joe > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEcBAEBAgAGBQJL9YzXAAoJEA8yVCPsQCW5dnMH/RWO5paf9UN0kQ/qcgLNZlBv FHTXQtHO714MQ7pujyJ43C4Sy0d4FJXbcP9IH2ClU0Xq3nGHoQQ1X4cbwyY/IyA0 GaTzNrF+3+kTVIUO3O+35rDkbEr6cxwvqbY5irxI0A2k7WtnpwbuCrbZkZAUtGeb k7Tb+7QFrqMYW8HZqCgRAhbI7aEyEyyE1bBLnt2BLZa3Eopxzh6sG7i2aW0CFFtA H9x3flJclfc59jlgPMk5c7s4SIABd6sXCq2CcfZ/Fr4AZm64dmitr4aBdvOhXyTW SxCjhqNgr7OwdKs4YJ1mf4iIMfv3wWgF8SGKiQp9LyDX+13eK4qUnrNXC6JGTN4= =lJ+g -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Thu May 20 13:08:07 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 512123A684A; Thu, 20 May 2010 13:08:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.927 X-Spam-Level: X-Spam-Status: No, score=-1.927 tagged_above=-999 required=5 tests=[AWL=0.072, BAYES_00=-2.599, J_CHICKENPOX_23=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZFu2woo9rGEF; Thu, 20 May 2010 13:08:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 18C873A6783; Thu, 20 May 2010 13:08:05 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFByU-000AeT-4f for namedroppers-data0@psg.com; Thu, 20 May 2010 20:04:10 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFByQ-000Adu-7U for namedroppers@ops.ietf.org; Thu, 20 May 2010 20:04:06 +0000 Received: from [199.212.90.24] (helo=dh24.r1.owls.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFByN-000DTH-P8; Thu, 20 May 2010 20:04:04 +0000 Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley In-Reply-To: <4BF58CDD.60209@nlnetlabs.nl> Date: Thu, 20 May 2010 16:04:01 -0400 Cc: namedroppers@ops.ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <7542AD90-8315-41BC-98B2-D63B0C7B15C2@hopcount.ca> References: <20100514145956.GF65855@shinkuro.com> <4BF52F40.6070401@nlnetlabs.nl> <05A58828-A355-4716-8BBC-A10227B4D982@hopcount.ca> <4BF58CDD.60209@nlnetlabs.nl> To: Matthijs Mekking X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 199.212.90.24 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-20, at 15:26, Matthijs Mekking wrote: > Joe Abley wrote: >> On 2010-05-20, at 08:46, Matthijs Mekking wrote: >>=20 >>> I'm still not convinced of why we need a protocol change for this. >>> I think this problem can be tackled configuration-wise. >>>=20 >>> For the client: >>> NSD already has configuration settings for turning off AXFR = fallback. >>=20 >> What if you want to disable AXFR responses to IXFR queries only for = certain servers, or at certain times of day, or at times of low network = congestion, or due to some other heuristic that the authority-only = server author did not think of? >=20 > Point taken, but imho this is irrelevant: the IXFR-ONLY draft does not > implement these heuristics either. The point is not whether those heuristics are anticipated by the = IXFR-ONLY proposal, but that some mechanism exists for a client to = request an IXFR without receiving an AXFR response. he important bit to understand is that it's the client that ought to = make the decision, and that the decision is in the general case not = predictable by the server. > The problem definition in my eyes is that you want to prevent a full > zone transfer. I can see perfectly valid reasons why you want to. I > think a turn on|off configuration option suits more than a technical > solution to solve this. Sure, an on/off configuration option on the client seems like an = entirely reasonable way (amongst others) to implement this. But the = client still needs a way to signal to the server that it does not want = to receive an AXFR response. This proposal seems to encapsulate a clean = way of carrying out that signalling. Joe From owner-namedroppers@ops.ietf.org Thu May 20 14:24:16 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E7A603A68AA; Thu, 20 May 2010 14:24:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.763 X-Spam-Level: ** X-Spam-Status: No, score=2.763 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, J_CHICKENPOX_23=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vMI+C2K5TA8n; Thu, 20 May 2010 14:24:14 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0E8473A6884; Thu, 20 May 2010 14:24:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFD8w-000Jum-LI for namedroppers-data0@psg.com; Thu, 20 May 2010 21:19:02 +0000 Received: from [85.17.60.159] (helo=madras.curryboys.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFD8t-000Ju7-6w for namedroppers@ops.ietf.org; Thu, 20 May 2010 21:18:59 +0000 Received: from localhost (localhost [127.0.0.1]) by madras.curryboys.net (Postfix) with ESMTP id 3A62ED892; Thu, 20 May 2010 23:18:58 +0200 (CEST) Received: from madras.curryboys.net ([127.0.0.1]) by localhost (madras.curryboys.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xN8pweO6sDXA; Thu, 20 May 2010 23:18:57 +0200 (CEST) Received: from dhcp1.sanxion.org (dhcp1.sanxion.org [199.212.91.151]) by madras.curryboys.net (Postfix) with ESMTPSA id 589B783C6; Thu, 20 May 2010 23:18:56 +0200 (CEST) Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Dave Knight In-Reply-To: <7542AD90-8315-41BC-98B2-D63B0C7B15C2@hopcount.ca> Date: Thu, 20 May 2010 17:18:53 -0400 Cc: namedroppers@ops.ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <9EC61B80-841C-4DFB-968C-1F880CED5A4C@knig.ht> References: <20100514145956.GF65855@shinkuro.com> <4BF52F40.6070401@nlnetlabs.nl> <05A58828-A355-4716-8BBC-A10227B4D982@hopcount.ca> <4BF58CDD.60209@nlnetlabs.nl> <7542AD90-8315-41BC-98B2-D63B0C7B15C2@hopcount.ca> To: Joe Abley X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-20, at 4:04 PM, Joe Abley wrote: >=20 > On 2010-05-20, at 15:26, Matthijs Mekking wrote: >=20 >> Joe Abley wrote: >>> On 2010-05-20, at 08:46, Matthijs Mekking wrote: >>>=20 >>> What if you want to disable AXFR responses to IXFR queries only for = certain servers, or at certain times of day, or at times of low network = congestion, or due to some other heuristic that the authority-only = server author did not think of? >>=20 >> Point taken, but imho this is irrelevant: the IXFR-ONLY draft does = not >> implement these heuristics either. >=20 > The point is not whether those heuristics are anticipated by the = IXFR-ONLY proposal, but that some mechanism exists for a client to = request an IXFR without receiving an AXFR response. >=20 > he important bit to understand is that it's the client that ought to = make the decision, and that the decision is in the general case not = predictable by the server. >=20 >> The problem definition in my eyes is that you want to prevent a full >> zone transfer. I can see perfectly valid reasons why you want to. I >> think a turn on|off configuration option suits more than a technical >> solution to solve this. >=20 > Sure, an on/off configuration option on the client seems like an = entirely reasonable way (amongst others) to implement this. But the = client still needs a way to signal to the server that it does not want = to receive an AXFR response. This proposal seems to encapsulate a clean = way of carrying out that signalling. It's not that the client doesn't ever want an AXFR response, rather it = wants the opportunity to get an IXFR by walking through each master to = see if one of them can provide the required delta. In the case where no = master can provide the required delta the client may then want to fall = back to AXFR.=20 I an conceive of a situation where a client will walk through the set of = masters for a zone, each time requesting IXFR-ONLY, and each time = receiving CannotIXFR, then going back to the first master and requesting = IXFR as a last resort. In this scenario a master server is required to exhibit different = behaviour to the same client for the same zone, this needs to be = signalled to the server by the client. dave= From owner-namedroppers@ops.ietf.org Thu May 20 15:41:38 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E01413A696C; Thu, 20 May 2010 15:41:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -94.462 X-Spam-Level: X-Spam-Status: No, score=-94.462 tagged_above=-999 required=5 tests=[AWL=-1.312, BAYES_50=0.001, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xDnjh68Fd+yJ; Thu, 20 May 2010 15:41:38 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E26C53A693A; Thu, 20 May 2010 15:41:37 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFELf-0002Sx-6z for namedroppers-data0@psg.com; Thu, 20 May 2010 22:36:15 +0000 Received: from [213.178.172.147] (helo=TR-Sys.de) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFELc-0002SW-AK for namedroppers@ops.ietf.org; Thu, 20 May 2010 22:36:13 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3.2) id AA106434920; Fri, 21 May 2010 00:35:20 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id AAA16483; Fri, 21 May 2010 00:35:19 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <201005202235.AAA16483@TR-Sys.de> Subject: Re: [dnsext] draft-kerr-ixfr-only-01 To: namedroppers@ops.ietf.org Date: Fri, 21 May 2010 00:35:19 +0200 (MESZ) X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Folks, a simple, fundamental, provoking question, and follow-up considerations: What is the real benefit of (server-side) IXFR fallback to AXFR at all? A slave could easily decide to retry via AXFR, based on any policy desired, if it always got an error response when IXFR cannot be served. The additional delay by this procedure would be negligible vs. typical times for AXFR. I.e.: Why not making IXFR-only the normal behavior for IXFR? What do deployed secondaries in case all IXFR attempts fail (with any error code)? Do they fall back to AXFR (on the client side) anyway? Please note that I already had mentioned twice on this list that after axfr-clarify (now in RFC-EDITOR state) is out, significant parts of RFC 1995 regarding AXFR will be moot anyway; this WG has decided in Spring 2008 (IIRC) that AXFR MUST NOT happen over UDP; RFC 1995 seems to request supporting that. :-( As already indicated, IMO a thorough revision of RFC 1995 should be the pathway to hell to go; if it turns out that backward compatibility requirements do not allow changing IXFR to IXFR-only behavior (at the IXFR server), IXFR-ONLY could be defined in a single document with IXFR, otherwise a standalone document would not be needed anyway. Kind regards, Alfred. -- +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From owner-namedroppers@ops.ietf.org Thu May 20 15:55:11 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 05EAF3A6827; Thu, 20 May 2010 15:55:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.821 X-Spam-Level: ** X-Spam-Status: No, score=2.821 tagged_above=-999 required=5 tests=[AWL=-0.623, BAYES_50=0.001, FH_RELAY_NODNS=1.451, J_CHICKENPOX_23=0.6, MISSING_HEADERS=1.292, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NbnDKOHUHXVs; Thu, 20 May 2010 15:55:10 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 01D013A6358; Thu, 20 May 2010 15:55:10 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFEaw-000464-A3 for namedroppers-data0@psg.com; Thu, 20 May 2010 22:52:02 +0000 Received: from [202.46.183.22] (helo=srsomail.nzrs.net.nz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFEat-00045n-8J for namedroppers@ops.ietf.org; Thu, 20 May 2010 22:51:59 +0000 Received: from localhost (srsomail.office.nzrs.net.nz [202.46.183.22]) by srsomail.nzrs.net.nz (Postfix) with ESMTP id 2EBA82DB197 for ; Fri, 21 May 2010 10:51:58 +1200 (NZST) Received: from srsomail.nzrs.net.nz ([202.46.183.22]) by localhost (srsomail.office.nzrs.net.nz [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id REWN10s0aZDm for ; Fri, 21 May 2010 10:51:58 +1200 (NZST) Received: from [192.168.22.190] (unknown [202.46.183.35]) (Authenticated sender: sebastian) by srsomail.nzrs.net.nz (Postfix) with ESMTPSA id E161F2DA91A for ; Fri, 21 May 2010 10:51:57 +1200 (NZST) Message-ID: <4BF5BD0A.3090206@nzrs.net.nz> Date: Fri, 21 May 2010 10:51:54 +1200 From: Sebastian Castro User-Agent: Thunderbird 2.0.0.24 (X11/20100411) MIME-Version: 1.0 CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <20100514145956.GF65855@shinkuro.com> <4BF52F40.6070401@nlnetlabs.nl> <05A58828-A355-4716-8BBC-A10227B4D982@hopcount.ca> <4BF58CDD.60209@nlnetlabs.nl> <7542AD90-8315-41BC-98B2-D63B0C7B15C2@hopcount.ca> <9EC61B80-841C-4DFB-968C-1F880CED5A4C@knig.ht> In-Reply-To: <9EC61B80-841C-4DFB-968C-1F880CED5A4C@knig.ht> X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dave Knight wrote: > On 2010-05-20, at 4:04 PM, Joe Abley wrote: >> On 2010-05-20, at 15:26, Matthijs Mekking wrote: >> >>> Joe Abley wrote: >>>> On 2010-05-20, at 08:46, Matthijs Mekking wrote: >>>> >>>> What if you want to disable AXFR responses to IXFR queries only >>>> for certain servers, or at certain times of day, or at times of >>>> low network congestion, or due to some other heuristic that the >>>> authority-only server author did not think of? >>> Point taken, but imho this is irrelevant: the IXFR-ONLY draft >>> does not implement these heuristics either. >> The point is not whether those heuristics are anticipated by the >> IXFR-ONLY proposal, but that some mechanism exists for a client to >> request an IXFR without receiving an AXFR response. >> >> he important bit to understand is that it's the client that ought >> to make the decision, and that the decision is in the general case >> not predictable by the server. >> >>> The problem definition in my eyes is that you want to prevent a >>> full zone transfer. I can see perfectly valid reasons why you >>> want to. I think a turn on|off configuration option suits more >>> than a technical solution to solve this. >> Sure, an on/off configuration option on the client seems like an >> entirely reasonable way (amongst others) to implement this. But the >> client still needs a way to signal to the server that it does not >> want to receive an AXFR response. This proposal seems to >> encapsulate a clean way of carrying out that signalling. > > It's not that the client doesn't ever want an AXFR response, rather > it wants the opportunity to get an IXFR by walking through each > master to see if one of them can provide the required delta. In the > case where no master can provide the required delta the client may > then want to fall back to AXFR. > > I an conceive of a situation where a client will walk through the set > of masters for a zone, each time requesting IXFR-ONLY, and each time > receiving CannotIXFR, then going back to the first master and > requesting IXFR as a last resort. I envisioned similar scenario, that's why I think the following part of the text should be changed: ----------------------------------------- If the IXFR result is larger than an AXFR, then an IXFR server MAY reply with an AXFR result instead. This is an optimization, and IXFR servers MAY only reply with AXFR if they are certain that the reply using AXFR is smaller than an equivalent IXFR reply. ----------------------------------------- and, instead of sending the AXFR, the IXFR server signals the client that the AXFR result size is smaller than the IXFR result size, allowing the client to take the final decision of what to do. > > In this scenario a master server is required to exhibit different > behaviour to the same client for the same zone, this needs to be > signalled to the server by the client. > > dave -- Sebastian Castro DNS Specialist .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535 From owner-namedroppers@ops.ietf.org Thu May 20 16:02:47 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2B1443A67B5; Thu, 20 May 2010 16:02:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[AWL=0.498, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uW7S5L-Prdzq; Thu, 20 May 2010 16:02:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0A12D3A67B2; Thu, 20 May 2010 16:02:46 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFEiY-00052G-79 for namedroppers-data0@psg.com; Thu, 20 May 2010 22:59:54 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFEiV-00051w-Qe for namedroppers@ops.ietf.org; Thu, 20 May 2010 22:59:51 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 7DA1BA630E; Thu, 20 May 2010 22:59:51 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: Alfred =?us-ascii?Q?=3D=3Fhp-roman8=3FB=3FSM5uZXM=3D=3F=3D?= cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-Reply-To: Your message of "Fri\, 21 May 2010 00\:35\:19 +0200." <201005202235.AAA16483@TR-Sys.de> References: <201005202235.AAA16483@TR-Sys.de> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Thu, 20 May 2010 22:59:51 +0000 Message-ID: <80834.1274396391@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Alfred H=C3=B6nes > Date: Fri, 21 May 2010 00:35:19 +0200 (MESZ) > ... > I.e.: Why not making IXFR-only the normal behavior for IXFR? because there's a degenerate case of single packet axfr (for very small zones) that was thought interesting by the WG at the time of RFC 1995. > Please note that I already had mentioned twice on this list that after > axfr-clarify (now in RFC-EDITOR state) is out, significant parts of RFC > 1995 regarding AXFR will be moot anyway; this WG has decided in Spring > 2008 (IIRC) that AXFR MUST NOT happen over UDP; RFC 1995 seems to request > supporting that. :-( good catch. > As already indicated, IMO a thorough revision of RFC 1995 should be > the pathway to hell to go; if it turns out that backward compatibility > requirements do not allow changing IXFR to IXFR-only behavior (at the > IXFR server), IXFR-ONLY could be defined in a single document with > IXFR, otherwise a standalone document would not be needed anyway. i agree. From owner-namedroppers@ops.ietf.org Thu May 20 17:13:13 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 234B83A69EE; Thu, 20 May 2010 17:13:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.87 X-Spam-Level: X-Spam-Status: No, score=-0.87 tagged_above=-999 required=5 tests=[AWL=-0.430, BAYES_20=-0.74, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4E-BRr8Vxtee; Thu, 20 May 2010 17:13:11 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E30653A6826; Thu, 20 May 2010 17:13:10 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFFkf-000CCP-13 for namedroppers-data0@psg.com; Fri, 21 May 2010 00:06:09 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFFkc-000CBk-Lc for namedroppers@ops.ietf.org; Fri, 21 May 2010 00:06:06 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id DE5FFEC7B4; Fri, 21 May 2010 00:06:02 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4L05xBk065970; Fri, 21 May 2010 10:06:00 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005210006.o4L05xBk065970@drugs.dv.isc.org> To: Alfred =?hp-roman8?B?SM5uZXM=?= Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <201005202235.AAA16483@TR-Sys.de> Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-reply-to: Your message of "Fri, 21 May 2010 00:35:19 +0200." <201005202235.AAA16483@TR-Sys.de> Date: Fri, 21 May 2010 10:05:59 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <201005202235.AAA16483@TR-Sys.de>, Alfred =?hp-roman8?B?SM5uZXM=?= w rites: > Folks, > a simple, fundamental, provoking question, and follow-up considerations: > > What is the real benefit of (server-side) IXFR fallback to AXFR at all? The master is the only entity in a position to determine which response style is bigger. Extra work for single masters and recovery from other events where the history is not available. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Thu May 20 17:16:09 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B29F33A6A13; Thu, 20 May 2010 17:16:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.339 X-Spam-Level: X-Spam-Status: No, score=-0.339 tagged_above=-999 required=5 tests=[AWL=-0.940, BAYES_50=0.001, J_CHICKENPOX_15=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2ME50NEi6rTe; Thu, 20 May 2010 17:16:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4DAFF3A6A00; Thu, 20 May 2010 17:16:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFFpd-000Ce6-Rb for namedroppers-data0@psg.com; Fri, 21 May 2010 00:11:17 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFFpb-000CdA-8s for namedroppers@ops.ietf.org; Fri, 21 May 2010 00:11:15 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 37CE2EC7B3; Fri, 21 May 2010 00:11:14 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4L0B6iS066080; Fri, 21 May 2010 10:11:06 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005210011.o4L0B6iS066080@drugs.dv.isc.org> To: Suzanne Woolf Cc: Alex Bligh , Vaggelis Segredakis , "'Andrew Sullivan'" , namedroppers@ops.ietf.org, "'Sotiris Panaretou'" From: Mark Andrews References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520151426.GA22640@farside.isc.org> Subject: Re: On adoption of two drafts (was: (bname)Re: [dnsext] shadow zones) In-reply-to: Your message of "Thu, 20 May 2010 15:14:26 GMT." <20100520151426.GA22640@farside.isc.org> Date: Fri, 21 May 2010 10:11:06 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <20100520151426.GA22640@farside.isc.org>, Suzanne Woolf writes: > On Thu, May 20, 2010 at 10:43:12AM +1000, Mark Andrews wrote: > > We keep thinking "is this a solution > > to the idn tld problem" when we should be thinking is this a good > > tool to have in the tool chest. > > Mark, I think I agree with you in principle, but it would be helpful > if you (or anyone) could provide an example of a case where one or > another of the tools we've been discussing is "a good tool to have in > the tool chest" outside of the IDN context. BNAME in for classless in-addr.arpa delegations. It permits you to redirect the name and the namespace under the name. DNAME doesn't work for classless in-addr.arpa in the /25-/32 range. > > Which one is better depends on what you want to do. > > > > If you want to bundle namespaces bname is a better tool as you can > > say bname or ns as you don't provide the opportunity to redirect > > the differently. > > > > If you are not trying to bundle namespaces then c+dname may be a > > better tool for you as it provides more freedom. > > What does "bundle namespaces" mean, besides "what bname does"? I've > only heard references to "bundling names" or "bundling namespaces" in > the IDN context, so again it would clarify things to have an > additional case. See classless in-addr.arpa delegations for other examples. > > The chairs are too focused on what is good for "idn tlds" rather > > than being focused on "are these good tools in their own right". > > I suspect it looks this way because the use cases we're presented with > have been wrapped in IDN (not just TLD) considerations. If that's the > defining use case for whatever we're actually doing here, we should > admit it. If not, let's see some others. > > Suzanne > > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Thu May 20 17:39:09 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ADFC63A6CF4; Thu, 20 May 2010 17:39:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.482 X-Spam-Level: X-Spam-Status: No, score=-101.482 tagged_above=-999 required=5 tests=[AWL=-0.372, BAYES_05=-1.11, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S4bEAYLQGW00; Thu, 20 May 2010 17:39:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 112913A6D16; Thu, 20 May 2010 17:33:33 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFG5j-000EUS-8o for namedroppers-data0@psg.com; Fri, 21 May 2010 00:27:55 +0000 Received: from [2001:4f8:3:36::28] (helo=white.flame.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFG5f-000EU5-Pt for namedroppers@ops.ietf.org; Fri, 21 May 2010 00:27:51 +0000 Received: from white.flame.org (localhost [127.0.0.1]) by white.flame.org (Postfix) with ESMTP id 4D41117D20A; Fri, 21 May 2010 00:27:51 +0000 (UTC) Received: from bigmac.home.flame.org (unknown [IPv6:2001:470:b8d7:13:21d:4fff:fe47:6790]) (using SSLv3 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by white.flame.org (Postfix) with ESMTPSA id 9C63717D208; Fri, 21 May 2010 00:27:50 +0000 (UTC) Message-ID: <4BF5D385.3090306@isc.org> Date: Thu, 20 May 2010 19:27:49 -0500 From: Michael Graff User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Mark Andrews CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005202235.AAA16483@TR-Sys.de> <201005210006.o4L05xBk065970@drugs.dv.isc.org> In-Reply-To: <201005210006.o4L05xBk065970@drugs.dv.isc.org> X-Enigmail-Version: 1.0.1 OpenPGP: id=BE9E0FA6 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV using ClamSMTP Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2010-05-20 7:05 PM, Mark Andrews wrote: > In message <201005202235.AAA16483@TR-Sys.de>, Alfred =?hp-roman8?B?SM5uZXM=?= w > rites: >> Folks, >> a simple, fundamental, provoking question, and follow-up considerations: >> >> What is the real benefit of (server-side) IXFR fallback to AXFR at all? > > The master is the only entity in a position to determine which > response style is bigger. Bigger is not the only metric to determine which is better. If there is only one master, then I suspect IXFR-only is a loss. That's not what this feature is intended for. It's for complicated configurations where you have more than one master and full deltas between those masters are not available. In that case, you want to try both masters with IXFR before resorting to AXFR. - --Michael -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkv104UACgkQ+NNi0s9NRJ0IHwCgnVe7yt4Ece1fRqwImkRj5wk+ DOsAmQF35l1NmvdC+FfCk4sD4XlNT8L+ =kvw6 -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Thu May 20 17:44:22 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5DB363A6C43; Thu, 20 May 2010 17:44:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.916 X-Spam-Level: X-Spam-Status: No, score=-1.916 tagged_above=-999 required=5 tests=[AWL=0.683, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dtPiNBqG-3FO; Thu, 20 May 2010 17:44:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 79C493A6CE9; Thu, 20 May 2010 17:38:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFGCx-000FJE-Vh for namedroppers-data0@psg.com; Fri, 21 May 2010 00:35:23 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFGCv-000FIR-16 for namedroppers@ops.ietf.org; Fri, 21 May 2010 00:35:21 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id A5A07EC7BE; Fri, 21 May 2010 00:35:18 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4L0ZEH9066468; Fri, 21 May 2010 10:35:16 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005210035.o4L0ZEH9066468@drugs.dv.isc.org> To: Jaap Akkerhuis Cc: "namedroppers@ops.ietf.org" From: Mark Andrews References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <4BF54CCC.5050504@isc.org> <201005201557.o4KFvidO020475@bartok.nlnetlabs.nl> Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-reply-to: Your message of "Thu, 20 May 2010 17:57:44 +0200." <201005201557.o4KFvidO020475@bartok.nlnetlabs.nl> Date: Fri, 21 May 2010 10:35:14 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <201005201557.o4KFvidO020475@bartok.nlnetlabs.nl>, Jaap Akkerhuis wr ites: > > Maybe I'm wrong but I always thought that an IXRF request had as > > data the current serial from the requester and that the server only > > when it is "higher" (according to the serial arithmetic). > > I'm not certain if others have answered this to your satisfaction or > not, so I'll give it a go. > > And fail as well. I know what it is supposed to do. However, the > text is plain wrong. It implies that the has the desired serial > number in the query. Add a "s" to "number". servers have the zone with same serial number for that zone. In this servers have the zone with same serial numbers for that zone. In this > And that is incorrect as far as I know. > > jaap > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Thu May 20 17:53:44 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DECD23A68D7; Thu, 20 May 2010 17:53:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.932 X-Spam-Level: X-Spam-Status: No, score=-1.932 tagged_above=-999 required=5 tests=[AWL=0.667, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kV77JFsQvs5v; Thu, 20 May 2010 17:53:44 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0093F3A694E; Thu, 20 May 2010 17:53:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFGR2-000HHv-RV for namedroppers-data0@psg.com; Fri, 21 May 2010 00:49:56 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFGQv-000HGz-Hs for namedroppers@ops.ietf.org; Fri, 21 May 2010 00:49:49 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 9C3A8EC7C4; Fri, 21 May 2010 00:49:43 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4L0nflb066721; Fri, 21 May 2010 10:49:41 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005210049.o4L0nflb066721@drugs.dv.isc.org> To: Paul Vixie Cc: "namedroppers@ops.ietf.org" From: Mark Andrews References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <4BF54CCC.5050504@isc.org> <201005201557.o4KFvidO020475@bartok.nlnetlabs.nl> <4BF55F3B.8060803@isc.org> <64912.1274373586@nsa.vix.com> Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-reply-to: Your message of "Thu, 20 May 2010 16:39:46 GMT." <64912.1274373586@nsa.vix.com> Date: Fri, 21 May 2010 10:49:40 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <64912.1274373586@nsa.vix.com>, Paul Vixie writes: > > Date: Thu, 20 May 2010 11:11:39 -0500 > > From: Michael Graff > > > > > And fail as well. I know what it is supposed to do. However, the > > > text is plain wrong. It implies that the has the desired serial > > > number in the query. > > > > > > And that is incorrect as far as I know. > > it is. > > > Ahh, when I read that text I read it as: The client requested serial X. > > I have X+N. If I have a path between X and X+N, then I can respond > > with IXFR. > > the client is including X in its request, but is NOT "requesting" X. It's requesting the changes from X. > > So, the client DOES send what it has, and the server DOES determine "for > > the client's serial" can it construct a path from where the client is to > > where the zone is now. > > yes. > > > It sounds like there are words to change to make this clear. > > +1. > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Thu May 20 21:49:39 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8D2F03A784B; Thu, 20 May 2010 21:49:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.796 X-Spam-Level: ** X-Spam-Status: No, score=2.796 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_JP=1.244, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pNJrV7hqvZIp; Thu, 20 May 2010 21:49:38 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A97DA3A7184; Thu, 20 May 2010 20:41:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFJ1h-000A0j-Ot for namedroppers-data0@psg.com; Fri, 21 May 2010 03:35:57 +0000 Received: from [131.112.32.132] (helo=necom830.hpcl.titech.ac.jp) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFJ1f-000A0L-Au for namedroppers@ops.ietf.org; Fri, 21 May 2010 03:35:55 +0000 Received: (qmail 11163 invoked from network); 21 May 2010 03:51:39 -0000 Received: from p16136-ipbffx02marunouchi.tokyo.ocn.ne.jp (HELO ?192.168.0.74?) (221.189.115.136) by necom830.hpcl.titech.ac.jp with SMTP; 21 May 2010 03:51:39 -0000 Message-ID: <4BF5FF6B.80801@necom830.hpcl.titech.ac.jp> Date: Fri, 21 May 2010 12:35:07 +0900 From: Masataka Ohta User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: ah@TR-Sys.de CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005202235.AAA16483@TR-Sys.de> In-Reply-To: <201005202235.AAA16483@TR-Sys.de> Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: A lfred; > a simple, fundamental, provoking question, and follow-up considerations: > > What is the real benefit of (server-side) IXFR fallback to AXFR at all? Simplicity by ignoring performance loss in very rare cases. But, the proper question is "what is the real benefit of ixfr-only" and the answer is "nothing". An IXFR client will receive AXFR from an IXFR server, if: 1) the client has very old copy of a zone but the copy has not yet expired or 2) the server has recently received AXFR or 3) the server has condensed differences 1) is a rare case (unless the zone is very small or changes very frequently, the copy should have been expired) and, it is likely that the client won't be able to receive IXFR from any other server (unless some servers have longer memory of difference information than others and such servers are queried after less capable servers, which is not a reasonable configuration of clients) that there is no point to introduce complication to try all the servers. 2) is even more rare case occurs only for a short period after the server experienced case 1) *AND* the server is the first available server chosen by the client, which means, is negligible. It should be noted that the client should be configured to avoid servers (at least as the first server to try) which has been down for a very long period. For 3), is condensation used by some? Note also that, trying all the servers (including dead ones) requires retries and time-out, which reduces the merit of NOTIFY. Masataka Ohta From owner-namedroppers@ops.ietf.org Fri May 21 02:18:43 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2E8A03A770A; Fri, 21 May 2010 02:18:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.87 X-Spam-Level: X-Spam-Status: No, score=-0.87 tagged_above=-999 required=5 tests=[AWL=-0.130, BAYES_20=-0.74] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xl+kuJZyu2iL; Fri, 21 May 2010 02:18:41 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 019053A82B0; Thu, 20 May 2010 23:39:31 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFLnY-0004ST-7y for namedroppers-data0@psg.com; Fri, 21 May 2010 06:33:32 +0000 Received: from [2001:7b8:206:1::1] (helo=open.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFLnV-0004QG-LG for namedroppers@ops.ietf.org; Fri, 21 May 2010 06:33:30 +0000 Received: from [192.168.1.9] (ip123-112-174-82.adsl2.static.versatel.nl [82.174.112.123]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.3/8.14.3) with ESMTP id o4L6XOnn027229 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 21 May 2010 08:33:25 +0200 (CEST) (envelope-from matthijs@nlnetlabs.nl) Message-ID: <4BF629AD.6040909@nlnetlabs.nl> Date: Fri, 21 May 2010 08:35:25 +0200 From: Matthijs Mekking Organization: NLnet Labs User-Agent: Thunderbird 2.0.0.24 (X11/20100317) MIME-Version: 1.0 To: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005202235.AAA16483@TR-Sys.de> In-Reply-To: <201005202235.AAA16483@TR-Sys.de> X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.3 (open.nlnetlabs.nl [213.154.224.1]); Fri, 21 May 2010 08:33:26 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +1 Alfred � wrote: > Folks, > a simple, fundamental, provoking question, and follow-up considerations: > > What is the real benefit of (server-side) IXFR fallback to AXFR at all? > > A slave could easily decide to retry via AXFR, based on any > policy desired, if it always got an error response when IXFR > cannot be served. The additional delay by this procedure > would be negligible vs. typical times for AXFR. > > I.e.: Why not making IXFR-only the normal behavior for IXFR? > > What do deployed secondaries in case all IXFR attempts fail > (with any error code)? > Do they fall back to AXFR (on the client side) anyway? > > > Please note that I already had mentioned twice on this list that > after axfr-clarify (now in RFC-EDITOR state) is out, significant > parts of RFC 1995 regarding AXFR will be moot anyway; this WG has > decided in Spring 2008 (IIRC) that AXFR MUST NOT happen over UDP; > RFC 1995 seems to request supporting that. :-( > > As already indicated, IMO a thorough revision of RFC 1995 should be > the pathway to hell to go; if it turns out that backward compatibility > requirements do not allow changing IXFR to IXFR-only behavior (at the > IXFR server), IXFR-ONLY could be defined in a single document with > IXFR, otherwise a standalone document would not be needed anyway. > > Kind regards, > Alfred. > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEcBAEBAgAGBQJL9imnAAoJEA8yVCPsQCW54fUH/2oigl9QZGjIUEw6N0wKHuXj zetLTtifCCiKE3duc13Bvr3o0VjiiQJjqWDzJsr+K54JQL9qUU5SCm+rnSlq0LUp n4agMzSFPwBBezNL21q3+SPonc84Dl2doyiYmCRYWwuAR6BtbyzpyYpNpppCDpEb 4yLVZjUcQST/r9150ItjD1xgj2rZzW+wUEGetg1QldM21KO/qPtPXrwvs3jngfJk 1dD2l/b7DE3ozjbh3oJHdG4aV27XppetC64oN4aIUmwD8YCYGiZkZlOnTDG9noDk HcTj/s0DCqIQBInMVa5lxu6JV3wyjzAv2TBNdEMMMna2dLAMddicsbLL5BaN+OI= =Ybkp -----END PGP SIGNATURE----- From dnsext-archive@ietf.org Fri May 21 07:13:22 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C9C133A8296 for ; Fri, 21 May 2010 07:13:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -23.779 X-Spam-Level: X-Spam-Status: No, score=-23.779 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_RELAY_NODNS=1.451, GB_I_LETTER=-2, HELO_IS_SMALL6=0.556, HELO_MISMATCH_ORG=0.611, HTML_IMAGE_ONLY_24=1.552, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nHahi5OEbWTU for ; Fri, 21 May 2010 07:13:21 -0700 (PDT) Received: from ah.org (unknown [81.199.90.2]) by core3.amsl.com (Postfix) with SMTP id 9B9853A83EC for ; Fri, 21 May 2010 02:46:30 -0700 (PDT) From: RX-Store Subject: Special Code for 77% for dnsext-archive@ietf.org To: MIME-Version: 1.0 Content-Type: text/html Message-Id: <20100521094631.9B9853A83EC@core3.amsl.com> Date: Fri, 21 May 2010 02:46:30 -0700 (PDT)
Delivery department work across the Globe.
Please click here if the e-mail below is not displayed correctly.

This feature will help you stay in touch with friends and family. We will continually work to add new services over time.
http://letternoun.com/ Stay Connected with Family and Friends!

ABRA LLC. All Rights Reserved
ABRA Inc. does not authorize the use of its proprietary computers and computer network (the 11526 Network") to accept, transmit or distribute unsolicited bulk e-mail sent from the Internet to ASDuuq members. In addition, Internet e-mail sent, or caused to be sent, to or through the 42597 that makes use of or contains invalid or forged headers, invalid or non-existent domain names or other means of deceptive addressing will be deemed to be counterfeit. Any attempt to send or cause such counterfeit e-mail to be sent to or through the 87482 is unauthorized. 18660

From owner-namedroppers@ops.ietf.org Fri May 21 08:47:33 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C0F5A3A66B4; Fri, 21 May 2010 08:47:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.985 X-Spam-Level: * X-Spam-Status: No, score=1.985 tagged_above=-999 required=5 tests=[AWL=-0.120, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xJ5AFXh6dBdd; Fri, 21 May 2010 08:47:32 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5F52E3A81F0; Fri, 21 May 2010 07:03:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFSj4-000K2h-6D for namedroppers-data0@psg.com; Fri, 21 May 2010 13:57:22 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFSiz-000K1C-4k for namedroppers@ops.ietf.org; Fri, 21 May 2010 13:57:17 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o4LDv7h2090805; Fri, 21 May 2010 09:57:08 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [10.31.200.147] by Work-Laptop-2.local (PGP Universal service); Fri, 21 May 2010 09:57:13 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Fri, 21 May 2010 09:57:13 -0400 Mime-Version: 1.0 Message-Id: Date: Fri, 21 May 2010 09:55:34 -0400 To: namedroppers@ops.ietf.org From: Edward Lewis Subject: [dnsext] Lookup ambiguity of CNAME and DNAME Cc: ed.lewis@neustar.biz Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is a follow up to the claim that CNAME + DNAME would cause problems at caches because we can't make a rule that says "once at a matching domain name, if RRSET X and RRSET Y are present, here's what to do". The rule in RFC 1034 concerning CNAME is this: # The domain system provides such a feature using the canonical name # (CNAME) RR. A CNAME RR identifies its owner name as an alias, and # specifies the corresponding canonical name in the RDATA section of the # RR. If a CNAME RR is present at a node, no other data should be # present; this ensures that the data for a canonical name and its aliases # cannot be different. This rule also insures that a cached CNAME can be # used without checking with an authoritative server for other RR types. If we break the rule to allow just the DNAME (DNSSEC's NSEC/RRSIG have already been special cased), then the above text applies to the DNAME. In the example below, the crucial element is that the DNAME's RDATA differ between name1 and the CNAME-RDATA-referenced name2. Zonefile has (please excuse typos, I can't verify this with running code because this presumes that CNAME and DNAME can co-exist at an owner). example.tld. 9000 IN SOA example.tld. 9000 IN NS example.tld. 9000 IN NS name1.example.tld. 7000 IN CNAME name2.example.tld. name1.example.tld. 5000 IN DNAME name3.example.tld. name2.example.tld. 9000 IN DNAME name4.example.tld. name3.example.tld. 9000 IN NS server-0.example.com. name3.example.tld. 9000 IN NS server-1.example.com. name4.example.tld. 9000 IN NS server-a.example.com. name4.example.tld. 9000 IN NS server-b.example.com. A cache has this at some point in time: name1.example.tld. 1000 IN CNAME name2.example.tld. A query comes in for "name1.example.tld./IN/DNAME". What does the cache do? A cache following existing rules would return: name1.example.tld. 1000 IN CNAME name2.example.tld. name2.example.tld. 9000 IN DNAME name4.example.tld. But the desired effect would probably have been: name1.example.tld. 5000 IN DNAME name3.example.tld. This is one ambiguity that would arise from having special processing happen when the lookup hinges on there being the presence of two different RRsets at a name. We also have another complication - what happens at with wildcards. See RFC 4592, sections 4.3 and 4.4. We can handle a CNAME at a wildcard but the behavior of a DNAME at a wildcard is "to be avoided." (Please see the referenced text for more on that.) I'll say the most alluring thought is that CNAME only restricts records at the same name but allow for data to be held below, DNAME only restricts names below the same name. The only cross over is that CNAME says it can't live with the DNAME. If a CNAME is at a (non-empty) non-terminal then the co-existing DNAME would have a problem but this is an issue only at the authoritative servers that see the entire zone. Depending on how an authority reacts to this, it is possible that a cache wouldn't be "set up for a failure." (That is, if the DNAME occludes the records below, then the cache won't face an ambiguous state.) PS - I anticipate the "oh, but who would do this?" and the ever popular "but this would only be seen when testing because that's the only time you ask for $foo records." But such arguments have not succeeded in the past in changing quirks in the protocol. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Fri May 21 09:44:41 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 74ED33A6DF2; Fri, 21 May 2010 09:44:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.545 X-Spam-Level: * X-Spam-Status: No, score=1.545 tagged_above=-999 required=5 tests=[AWL=-1.460, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, J_CHICKENPOX_47=0.6, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7wwfcBlRvTpc; Fri, 21 May 2010 09:44:40 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2AA433A7EE4; Fri, 21 May 2010 05:55:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFReU-0008q7-HE for namedroppers-data0@psg.com; Fri, 21 May 2010 12:48:34 +0000 Received: from [209.85.217.215] (helo=mail-gx0-f215.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFReQ-0008pY-8g for namedroppers@ops.ietf.org; Fri, 21 May 2010 12:48:30 +0000 Received: by gxk7 with SMTP id 7so556736gxk.17 for ; Fri, 21 May 2010 05:48:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=WQ+Tse/Sfm6n3WI95i1fNoO9VVsLbuHAe9nLM3r1SPk=; b=ntvCGclLeyVvHL4TzhBFogLoFVPnE3AFGvr17+Np+jkbVY5OFr41TorgdzKFVG3kca 798RGzwcBN3bwqwUsiaV/HCfZAfsoWFiGNXziy1zt0oGEjXLDj6zn6u9Hsye81hBeQ2j 3v0ygWn+y08h2sY2arIMIMYAgXxdb1IT5slRc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=uQaiAIYYXh6L6ki0+XaCmQaVhSyDmP4n5wF1/lLYMkgBRoP0jfhzvJoRvDTIGhemmF pGcxN+j0BMSEWIhDmU3LfABFoRRb7W/jBvH8FQwN96xR57s5rYzEWSUL6tjOXcFISLr5 ZkKvBGcnfA2GkLuxDINHq27k5sy3Og0fj7d40= MIME-Version: 1.0 Received: by 10.101.105.35 with SMTP id h35mr2269396anm.116.1274446109158; Fri, 21 May 2010 05:48:29 -0700 (PDT) Received: by 10.100.163.17 with HTTP; Fri, 21 May 2010 05:48:28 -0700 (PDT) In-Reply-To: <201005202235.AAA16483@TR-Sys.de> References: <201005202235.AAA16483@TR-Sys.de> Date: Fri, 21 May 2010 09:48:28 -0300 Message-ID: Subject: Re: [dnsext] draft-kerr-ixfr-only-01 From: Brian Dickson To: =?ISO-8859-1?Q?Alfred_H=CEnes?= Cc: namedroppers@ops.ietf.org Content-Type: multipart/alternative; boundary=001636c5bdd29f2f0004871a1bf6 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --001636c5bdd29f2f0004871a1bf6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On Thu, May 20, 2010 at 7:35 PM, Alfred H=CEnes wrote: > Folks, > a simple, fundamental, provoking question, and follow-up considerations: > > What is the real benefit of (server-side) IXFR fallback to AXFR at all? > > A slave could easily decide to retry via AXFR, based on any > policy desired, if it always got an error response when IXFR > cannot be served. The additional delay by this procedure > would be negligible vs. typical times for AXFR. > > I.e.: Why not making IXFR-only the normal behavior for IXFR? > > I can think of one reason not to pursue this to its (il)logical conclusion: The very existence of code+servers that do IXFR->AXFR fallback, means that the ONLY way to know for sure that an IXFR is IXFR-only, is if IXFR-only (the present ID under discussion) becomes a new standard. Updating the IXFR standard to say no fallback, could result in clients thinking IXFR means IXFR-only, while servers might still think fallback is okay. Unless IXFR-only is adopted, in which case the other arguments about reasons/benefits for fallback (even over UDP) are likely to prevail. Brian > > Please note that I already had mentioned twice on this list that > after axfr-clarify (now in RFC-EDITOR state) is out, significant > parts of RFC 1995 regarding AXFR will be moot anyway; this WG has > decided in Spring 2008 (IIRC) that AXFR MUST NOT happen over UDP; > RFC 1995 seems to request supporting that. :-( > > As already indicated, IMO a thorough revision of RFC 1995 should be > the pathway to hell to go; if it turns out that backward compatibility > requirements do not allow changing IXFR to IXFR-only behavior (at the > IXFR server), IXFR-ONLY could be defined in a single document with > IXFR, otherwise a standalone document would not be needed anyway. > > Kind regards, > Alfred. > > -- > > +------------------------+--------------------------------------------+ > | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | > | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | > | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | > +------------------------+--------------------------------------------+ > > > --001636c5bdd29f2f0004871a1bf6 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

On Thu, May 20, 2010 at 7:35 PM, Alfred = H=CEnes <ah@tr-sys.de<= /a>> wrote:
Folks,
a simple, fundamental, provoking question, and follow-up considerations:
What is the real benefit of (server-side) IXFR fallback to AXFR at all?

A slave could easily decide to retry via AXFR, based on any
policy desired, if it always got an error response when IXFR
cannot be served. =A0The additional delay by this procedure
would be negligible vs. typical times for AXFR.

I.e.: Why not making IXFR-only the normal behavior for IXFR?



I can think of one reason not to pursue this = to its (il)logical conclusion:

The very existence of code+servers th= at do IXFR->AXFR fallback,
means that the ONLY way to know for sure t= hat an IXFR is IXFR-only,
is if IXFR-only (the present ID under discussion) becomes a new standard.
Updating the IXFR standard to say no fallback, could result in client= s thinking
IXFR means IXFR-only, while servers might still think fallbac= k is okay.

Unless IXFR-only is adopted, in which case the other arguments aboutreasons/benefits for fallback (even over UDP) are likely to prevail.
Brian
=A0

Please note that I already had mentioned twice on this list that
after axfr-clarify (now in RFC-EDITOR state) is out, significant
parts of RFC 1995 regarding AXFR will be moot anyway; this WG has
decided in Spring 2008 (IIRC) that AXFR MUST NOT happen over UDP;
RFC 1995 seems to request supporting that. =A0:-(

As already indicated, IMO a thorough revision of RFC 1995 should be
the pathway to hell to go; if it turns out that backward compatibility
requirements do not allow changing IXFR to IXFR-only behavior (at the
IXFR server), IXFR-ONLY could be defined in a single document with
IXFR, otherwise a standalone document would not be needed anyway.

Kind regards,
=A0Alfred.

--

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes =A0 | =A0Alfred Hoenes =A0 Dipl.-Math., Dipl.-Phys. = =A0|
| Gerlinger Strasse 12 =A0 | =A0Phone: (+49)7156/9635-0, Fax: -18 =A0 =A0 = =A0 =A0 |
| D-71254 =A0Ditzingen =A0 =A0 | =A0E-Mail: =A0ah@TR-Sys.de =A0 =A0 =A0 =A0= =A0 =A0 =A0 =A0 =A0 =A0 |
+------------------------+--------------------------------------------+



--001636c5bdd29f2f0004871a1bf6-- From owner-namedroppers@ops.ietf.org Fri May 21 10:08:07 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5218428C4DE; Fri, 21 May 2010 10:08:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.705 X-Spam-Level: ** X-Spam-Status: No, score=2.705 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_55=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7dQolXoecs6B; Fri, 21 May 2010 10:08:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7F0CF3A847F; Fri, 21 May 2010 07:47:38 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFTR9-0001MI-SN for namedroppers-data0@psg.com; Fri, 21 May 2010 14:42:55 +0000 Received: from [89.16.176.221] (helo=mail.avalus.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFTR7-0001Lm-35 for namedroppers@ops.ietf.org; Fri, 21 May 2010 14:42:53 +0000 Received: from [10.113.78.195] (unknown [142.131.241.131]) by mail.avalus.com (Postfix) with ESMTPSA id 7A607C568FA; Fri, 21 May 2010 15:42:50 +0100 (BST) Date: Fri, 21 May 2010 07:42:48 -0700 From: Alex Bligh Reply-To: Alex Bligh To: Edward Lewis , namedroppers@ops.ietf.org cc: ed.lewis@neustar.biz, Alex Bligh Subject: Re: [dnsext] Lookup ambiguity of CNAME and DNAME Message-ID: <75CDE882710C88176DEF7EEA@nimrod.local> In-Reply-To: References: X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --On 21 May 2010 09:55:34 -0400 Edward Lewis wrote: > We also have another complication - what happens at with wildcards. See > RFC 4592, sections 4.3 and 4.4. We can handle a CNAME at a wildcard but > the behavior of a DNAME at a wildcard is "to be avoided." (Please see > the referenced text for more on that.) I'm not even sure what a wildcard CNAME and wildcard DNAME together would be meant to do. Were we to go down the CNAME+DNAME route, I do not imagine drastic loss of functionality and rioting in the streets if we said it didn't work with wildcard CNAME. -- Alex Bligh From owner-namedroppers@ops.ietf.org Fri May 21 13:15:35 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8C6003A6D47; Fri, 21 May 2010 13:12:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.75 X-Spam-Level: X-Spam-Status: No, score=-99.75 tagged_above=-999 required=5 tests=[AWL=-0.950, BAYES_50=0.001, J_CHICKENPOX_54=0.6, J_CHICKENPOX_55=0.6, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z64yBlxz8+jU; Fri, 21 May 2010 13:12:05 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DCE513A8342; Fri, 21 May 2010 07:23:54 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFT4j-000NPx-FK for namedroppers-data0@psg.com; Fri, 21 May 2010 14:19:45 +0000 Received: from [2001:7b8:206:1::1] (helo=open.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFT4b-000NP9-On for namedroppers@ops.ietf.org; Fri, 21 May 2010 14:19:38 +0000 Received: from gary.nlnetlabs.nl (gary.nlnetlabs.nl [IPv6:2001:7b8:206:1:216:76ff:feb8:1853]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.3/8.14.3) with ESMTP id o4LEJWBX000778 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO); Fri, 21 May 2010 16:19:32 +0200 (CEST) (envelope-from wouter@nlnetlabs.nl) Message-ID: <4BF69674.9070006@nlnetlabs.nl> Date: Fri, 21 May 2010 16:19:32 +0200 From: "W.C.A. Wijngaards" User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100430 Fedora/3.0.4-2.fc11 Thunderbird/3.0.4 MIME-Version: 1.0 To: Edward Lewis CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] Lookup ambiguity of CNAME and DNAME References: In-Reply-To: X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.3 (open.nlnetlabs.nl [IPv6:2001:7b8:206:1::1]); Fri, 21 May 2010 16:19:33 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Ed, Agreed that a query for qtype=DNAME would in this situation not give the expected answer with older versions of software. But I previously posted some CNAME text for dnssec-bis-updates that proposes to solve an almost identical case but with a NSEC or RRSIG next to the CNAME and with qtype=NSEC. So, current caches follow the CNAME but this is not good for answers that can be proven. I believe this similarity is what Ondrej was trying to convey to you. Reliable elicitation of the types can be gotten due to their special processing. For DNAME prepend a label, for NSEC ask for qtype=Null, for RRSIG set DO flag. Not that this is pretty and I'm dodging the wildcards :-) Best regards, Wouter -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkv2lnQACgkQkDLqNwOhpPjXaACeNEDtnFcJ3tmCETrVr7buY3np q2AAn1IVSAUTtKvNvxSOfwFkm/9AKQVy =atwJ -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Fri May 21 13:43:08 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BBA5B3A68A7; Fri, 21 May 2010 13:43:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.356 X-Spam-Level: X-Spam-Status: No, score=-102.356 tagged_above=-999 required=5 tests=[AWL=2.384, BAYES_20=-0.74, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cLuASHzjPZzT; Fri, 21 May 2010 13:43:07 -0700 (PDT) Received: from psg.com (psg.com [147.28.0.62]) by core3.amsl.com (Postfix) with ESMTP id CFA943A6B46; Fri, 21 May 2010 13:09:18 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFX7C-000CRR-T3 for namedroppers-data0@psg.com; Fri, 21 May 2010 18:38:34 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFX7A-000CQx-9H for namedroppers@ops.ietf.org; Fri, 21 May 2010 18:38:32 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id D417E1ECB41D; Fri, 21 May 2010 18:38:30 +0000 (UTC) Date: Fri, 21 May 2010 14:38:29 -0400 From: Andrew Sullivan To: Carlo Contavalli Cc: IETF DNSEXT WG , Olafur Gudmundsson , Sean Leach , Wilmer van der Gaast , "Rodden, Darryl" Subject: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Message-ID: <20100521183829.GG9257@shinkuro.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 21, 2010 at 11:29:27AM -0700, Carlo Contavalli wrote: > The end result is that the document is still called edns-client-ip, > but the option is called edns-client-subnet. Hope this won't cause too > much confusion. -02 of the draft will address this issue. This is a common issue. No worries. > If still possible, we'd like to discuss this at IETF 78? We haven't even decided whether we're having a meeting there yet :) I'll put you in the queue if we decide we will. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Fri May 21 13:43:13 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D41AB3A6AEE for ; Fri, 21 May 2010 13:43:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -97.273 X-Spam-Level: X-Spam-Status: No, score=-97.273 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mOXE4LEA9uAq for ; Fri, 21 May 2010 13:43:13 -0700 (PDT) Received: from psg.com (psg.com [147.28.0.62]) by core3.amsl.com (Postfix) with ESMTP id 0D4D03A6AC5 for ; Fri, 21 May 2010 13:10:10 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFWyt-000BAN-8F for namedroppers-data0@psg.com; Fri, 21 May 2010 18:29:59 +0000 Received: from [74.125.121.35] (helo=smtp-out.google.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFWyp-000B9p-5c for namedroppers@ops.ietf.org; Fri, 21 May 2010 18:29:56 +0000 Received: from kpbe15.cbf.corp.google.com (kpbe15.cbf.corp.google.com [172.25.105.79]) by smtp-out.google.com with ESMTP id o4LITo6k003264 for ; Fri, 21 May 2010 11:29:51 -0700 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1274466591; bh=RCu1uhxGC68vA2jzf+78OrUzifw=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type:Content-Transfer-Encoding; b=gP2D8GhoZrfJYDkUUOJ1VcsPpxRW072l2iwImH4vMfbZuBCg5U523GrhBJJtO1cMy jLdyPa/mZ3U7bwFB42KPA== DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=mime-version:in-reply-to:references:from:date:message-id: subject:to:cc:content-type:content-transfer-encoding:x-system-of-record; b=WlpB9BEm0tCMR7BTB6TKkoJwmvxp0HzgMP+l2Unz3+JjSxUIqRXai1lJANnaW+aWx vR+nzbAmQ6Rt91VvcPXxQ== Received: from vws15 (vws15.prod.google.com [10.241.21.143]) by kpbe15.cbf.corp.google.com with ESMTP id o4LITmau002657 for ; Fri, 21 May 2010 11:29:48 -0700 Received: by vws15 with SMTP id 15so273222vws.15 for ; Fri, 21 May 2010 11:29:48 -0700 (PDT) Received: by 10.220.63.78 with SMTP id a14mr1320747vci.144.1274466587848; Fri, 21 May 2010 11:29:47 -0700 (PDT) MIME-Version: 1.0 Received: by 10.220.128.139 with HTTP; Fri, 21 May 2010 11:29:27 -0700 (PDT) In-Reply-To: References: From: Carlo Contavalli Date: Fri, 21 May 2010 11:29:27 -0700 Message-ID: Subject: [dnsext] draft-vandergaast-edns-client-ip-01 To: IETF DNSEXT WG Cc: Olafur Gudmundsson , ajs@shinkuro.com, Sean Leach , Wilmer van der Gaast , "Rodden, Darryl" Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-System-Of-Record: true Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Hello, we just uploaded a second version of edns-client-ip: http://www.ietf.org/id/draft-vandergaast-edns-client-ip-01.txt We believe it addresses many of the comments that were raised on namedroppers previously, please have a look and let us know. Also, we had a little fight with the upload script, as we tried to rename the option (and the draft) to edns-client-subnet, as was suggested. The end result is that the document is still called edns-client-ip, but the option is called edns-client-subnet. Hope this won't cause too much confusion. -02 of the draft will address this issue. If still possible, we'd like to discuss this at IETF 78? Thanks, Carlo ---------- Forwarded message ---------- From: IETF I-D Submission Tool Date: Fri, May 21, 2010 at 10:56 AM Subject: New Version Notification for draft-vandergaast-edns-client-ip-01 To: wilmer@google.com Cc: ccontavalli@google.com, sleach@name.com, darryl.rodden@neustar.com A new version of I-D, draft-vandergaast-edns-client-ip-01.txt has been successfully submitted by Wilmer van der Gaast and posted to the IETF repository. Filename: =A0 =A0 =A0 =A0draft-vandergaast-edns-client-ip Revision: =A0 =A0 =A0 =A001 Title: =A0 =A0 =A0 =A0 =A0 Client IP information in DNS requests Creation_date: =A0 2010-05-21 WG ID: =A0 =A0 =A0 =A0 =A0 Independent Submission Number_of_pages: 23 Abstract: This draft defines an EDNS0 extension to carry relevant network range information. =A0In a query, it conveys the network address of the originator. =A0In a response, it conveys the scope of network addresses that the answer is intended. The IETF Secretariat. From owner-namedroppers@ops.ietf.org Fri May 21 13:44:04 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5E8683A6A62; Fri, 21 May 2010 13:44:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -94.121 X-Spam-Level: X-Spam-Status: No, score=-94.121 tagged_above=-999 required=5 tests=[AWL=-1.571, BAYES_50=0.001, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, J_CHICKENPOX_31=0.6, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NkvJcpVQaUt6; Fri, 21 May 2010 13:44:03 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 089E83A6D19; Fri, 21 May 2010 13:17:20 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFX6b-000CKB-9T for namedroppers-data0@psg.com; Fri, 21 May 2010 18:37:57 +0000 Received: from [213.178.172.147] (helo=TR-Sys.de) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFX6X-000CJa-Pw for namedroppers@ops.ietf.org; Fri, 21 May 2010 18:37:54 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3.2) id AA111727022; Fri, 21 May 2010 20:37:02 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id UAA17926; Fri, 21 May 2010 20:37:01 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <201005211837.UAA17926@TR-Sys.de> Subject: Re: [dnsext] draft-kerr-ixfr-only-01 To: marka@isc.org Date: Fri, 21 May 2010 20:37:00 +0200 (MESZ) Cc: namedroppers@ops.ietf.org In-Reply-To: <201005210006.o4L05xBk065970@drugs.dv.isc.org> from Mark Andrews at May "21," 2010 "10:05:59" am X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Mark Andrews wrote: > > In message <201005202235.AAA16483@TR-Sys.de>, Alfred HÎnes writes: >> Folks, >> a simple, fundamental, provoking question, and follow-up considerations: >> >> What is the real benefit of (server-side) IXFR fallback to AXFR at all? > > The master is the only entity in a position to determine which > response style is bigger. Correct. > > Extra work for single masters and recovery from other events where > the history is not available. I fear you misunderstood me; I did not call for *unconditional* IXFR, but asked for the reason(s) of *automatic* fallback to AXFR *by the IXFR server*, i.e. why not sending an indication to the IXFR client and let'm decide what he wants to do -- i.e. the idea of IXFR-only. > Mark > -- > Mark Andrews, ISC > 1 Seymour St., Dundas Valley, NSW 2117, Australia > PHONE: +61 2 9871 4742 INTERNET: marka@isc.org Mark, I'm particularly interested in hints from you (or your colleagues) regarding my subsequent questions on implementation practice: >> What do deployed secondaries in case all IXFR attempts fail >> (with any error code)? >> Do they fall back to AXFR (on the client side) anyway? Kind regards, Alfred. From owner-namedroppers@ops.ietf.org Fri May 21 13:44:04 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9C8913A6A59; Fri, 21 May 2010 13:44:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.989 X-Spam-Level: * X-Spam-Status: No, score=1.989 tagged_above=-999 required=5 tests=[AWL=-0.116, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gjIn4mDuUYvt; Fri, 21 May 2010 13:44:03 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 963753A6E1E; Fri, 21 May 2010 13:17:23 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFXxt-000L7T-37 for namedroppers-data0@psg.com; Fri, 21 May 2010 19:33:01 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFXxq-000L6l-Rt for namedroppers@ops.ietf.org; Fri, 21 May 2010 19:32:59 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4LJWnd3004273; Fri, 21 May 2010 15:32:50 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [10.31.200.147] by Work-Laptop-2.local (PGP Universal service); Fri, 21 May 2010 15:32:55 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Fri, 21 May 2010 15:32:55 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: <4BF6D80E.1090604@isc.org> References: <201005211837.UAA17926@TR-Sys.de> <4BF6D80E.1090604@isc.org> Date: Fri, 21 May 2010 15:32:45 -0400 To: namedroppers@ops.ietf.org From: Edward Lewis Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Cc: ed.lewis@neustar.biz Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 13:59 -0500 5/21/10, Michael Graff wrote: >The idea is you can shop around first, and if you can get an IXFR you go >for that. The assumption is that this shopping around consumes less >resources or maintains a better service level in other ways than just >falling back to AXFR on the first try. Or, if you can't IXFR the zone, you just don't do an AXFR - e.g., instead you page for out-of-band intervention to use a file transfer mechanisms to get the zone file over the wire. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Fri May 21 13:44:06 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 750F93A69E0; Fri, 21 May 2010 13:44:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.023 X-Spam-Level: X-Spam-Status: No, score=-101.023 tagged_above=-999 required=5 tests=[AWL=-0.583, BAYES_20=-0.74, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jP60xxM64je3; Fri, 21 May 2010 13:44:05 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2C80E3A6E2D; Fri, 21 May 2010 13:17:27 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFXRT-000Frt-U2 for namedroppers-data0@psg.com; Fri, 21 May 2010 18:59:31 +0000 Received: from [2001:4f8:3:36::28] (helo=white.flame.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFXRQ-000FrV-JT for namedroppers@ops.ietf.org; Fri, 21 May 2010 18:59:28 +0000 Received: from white.flame.org (localhost [127.0.0.1]) by white.flame.org (Postfix) with ESMTP id 1910117D21B; Fri, 21 May 2010 18:59:28 +0000 (UTC) Received: from bigmac.home.flame.org (unknown [IPv6:2001:470:b8d7:13:21d:4fff:fe47:6790]) (using SSLv3 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by white.flame.org (Postfix) with ESMTPSA id 59A2817D21A; Fri, 21 May 2010 18:59:26 +0000 (UTC) Message-ID: <4BF6D80E.1090604@isc.org> Date: Fri, 21 May 2010 13:59:26 -0500 From: Michael Graff User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: =?UTF-8?B?QWxmcmVkIO+/vQ==?= CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005211837.UAA17926@TR-Sys.de> In-Reply-To: <201005211837.UAA17926@TR-Sys.de> X-Enigmail-Version: 1.0.1 OpenPGP: id=BE9E0FA6 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Virus-Scanned: ClamAV using ClamSMTP Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2010-05-21 1:37 PM, Alfred � wrote: > I'm particularly interested in hints from you (or your colleagues) > regarding my subsequent questions on implementation practice: > >>> What do deployed secondaries in case all IXFR attempts fail >>> (with any error code)? >>> Do they fall back to AXFR (on the client side) anyway? The short answer is yes, you would eventually have to fall back to AXFR. The idea is you can shop around first, and if you can get an IXFR you go for that. The assumption is that this shopping around consumes less resources or maintains a better service level in other ways than just falling back to AXFR on the first try. - --Michael -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkv22A0ACgkQ+NNi0s9NRJ2SMQCcDXKc2BLPidse/f9oZhTaV2oD JMsAn1RZuyz3pxoWsnnO4GqQnMh5+O70 =hhCX -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Fri May 21 13:46:40 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CEDA03A6AF9; Fri, 21 May 2010 13:46:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.106 X-Spam-Level: ** X-Spam-Status: No, score=2.106 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dgWegeOniPLR; Fri, 21 May 2010 13:46:36 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 220EC3A7033; Fri, 21 May 2010 13:36:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFYsv-0004aT-FR for namedroppers-data0@psg.com; Fri, 21 May 2010 20:31:57 +0000 Received: from [156.154.16.88] (helo=neustar.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OFYsr-0004a3-GZ for namedroppers@ops.ietf.org; Fri, 21 May 2010 20:31:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neustar.biz; s=neustarbiz; t=1274473906; x=1589824917; q=dns/txt; h=From:Date:Subject:Message-ID:Content-Language: Content-Type; bh=gTdDPz5qNtIXj+SP0543ya8QJvu/vAkC8lx4/9bQhZI=; b=eiONgC6sOuu6x5ZJgAFu+x8v6PturCT7baFD/JgpZk+gNsp8NA+sTKdsK9Kboh Ukrf7b/1FDk0h8M3HN4iUPtA== Received: from ([10.31.13.31]) by stihiron2.va.neustar.com with ESMTP id 5202732.32692197; Fri, 21 May 2010 16:31:45 -0400 Received: from STNTEXCHHT03.cis.neustar.com ([10.31.13.242]) by stntexch12.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 21 May 2010 16:31:45 -0400 Received: from STNTEXCH02.cis.neustar.com ([fe80::f828:7b2d:14aa:84b7]) by STNTEXCHHT03.cis.neustar.com ([::1]) with mapi; Fri, 21 May 2010 16:31:45 -0400 From: "Damick, Jeffrey" To: YAO Jiankang , David Conrad , Andrew Sullivan CC: "namedroppers@ops.ietf.org" Date: Fri, 21 May 2010 16:31:41 -0400 Subject: Re: [dnsext] One chair's focus (was: On adoption of two drafts) Thread-Topic: [dnsext] One chair's focus (was: On adoption of two drafts) Thread-Index: Acr3/T4VqbjK4DWrRWOErN86kK7PPABJ2Cao Message-ID: In-Reply-To: Accept-Language: en-US Content-Language: en X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US x-ems-proccessed: R64IxjzeHPwwd+efoj3ZcA== x-ems-stamp: kqC9UbdyGqFocfMl+/QX9Q== Content-Type: multipart/alternative; boundary="_000_C81C65ED1E57jeffreydamickneustarbiz_" MIME-Version: 1.0 X-OriginalArrivalTime: 21 May 2010 20:31:45.0979 (UTC) FILETIME=[A1A870B0:01CAF924] Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --_000_C81C65ED1E57jeffreydamickneustarbiz_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable We (UltraDNS) have also developed a feature that is very similar to the BNA= ME proposal. So I will just throw our particular use case into the mix.. Customers want to create an alias for an existing (primary) domain such tha= t they can modify a (primary) domain and all changes will be reflected in t= he results from any alias domains. The results are then sent back as if th= ey belong to the alias domain. Based on feedback it appears that this is desirable feature, so I'm sure a= standard solution like BNAME would be useful, particularly for exchanging = these aliases. On 5/20/10 5:02 AM, "YAO Jiankang" wrote: ----- Original Message ----- From: "David Conrad" To: "Andrew Sullivan" Cc: Sent: Thursday, May 20, 2010 12:47 PM Subject: Re: [dnsext] One chair's focus (was: On adoption of two drafts) >I don't understand the question. What does it mean to be "good for the DN= S"? >To me, the questions we need to answer are quite simple: >0) is the base protocol defined by the IETF? >1) is there a problem? >2) do multiple independent parties need a standardized solution to that pr= oblem? >3) are there folks who will work on a solution within the context of an IE= TF working group? > > Your questions are quite clear to me. I like your question styles above. It seems that your questions are the nor= mal questions many other WGs do like ask when they encounter the similar si= tuations. Jiankang Yao >If the answer to these are yes, then the work should be undertaken by the = IETF. Value judgements of "good for X" seem to me to be a breeding ground = for >Ratholes Of Unusual Size. > > --_000_C81C65ED1E57jeffreydamickneustarbiz_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Re: [dnsext] One chair's focus (was: On adoption of two drafts)</TIT= LE> </HEAD> <BODY> <FONT FACE=3D"Calibri, Verdana, Helvetica, Arial"><SPAN STYLE=3D'font-size:= 11pt'>We (UltraDNS) have also developed a feature that is very similar to t= he BNAME proposal.  So I will just throw our particular use case into = the mix..<BR> <BR> Customers want to create an alias for an existing (primary) domain such tha= t they can modify a (primary) domain and all changes will be reflected in t= he results from any alias domains.  The results are then sent back as = if they belong to the alias domain.  <BR> <BR> Based on feedback it appears that this is desirable feature, so  IR= 17;m sure a standard solution like BNAME would be useful, particularly for = exchanging these aliases.<BR> <BR> <BR> <BR> <BR> On 5/20/10 5:02 AM, "YAO Jiankang" <<a href=3D"yaojk@cnnic.cn"= >yaojk@cnnic.cn</a>> wrote:<BR> <BR> </SPAN></FONT><BLOCKQUOTE><FONT FACE=3D"Calibri, Verdana, Helvetica, Arial"= ><SPAN STYLE=3D'font-size:11pt'><BR> <BR> ----- Original Message -----<BR> From: "David Conrad" <<a href=3D"drc@virtualized.org">drc@virt= ualized.org</a>><BR> To: "Andrew Sullivan" <<a href=3D"ajs@shinkuro.com">ajs@shinku= ro.com</a>><BR> Cc: <<a href=3D"namedroppers@ops.ietf.org">namedroppers@ops.ietf.org</a>= ><BR> Sent: Thursday, May 20, 2010 12:47 PM<BR> Subject: Re: [dnsext] One chair's focus (was: On adoption of two drafts)<BR= > <BR> <BR> <BR> >I don't understand the question.  What does it mean to be "go= od for the DNS"?<BR> <BR> >To me, the questions we need to answer are quite simple:<BR> <BR> >0) is the base protocol defined by the IETF?<BR> >1) is there a problem?<BR> >2) do multiple independent parties need a standardized solution to that= problem?<BR> >3) are there folks who will work on a solution within the context of an= IETF working group?<BR> ><BR> ><BR> <BR> Your questions are quite clear to me.<BR> <BR> I like your question styles above. It seems that your questions are the nor= mal questions many other WGs do like ask when they encounter the similar si= tuations.<BR> <BR> <BR> Jiankang Yao<BR> <BR> >If the answer to these are yes, then the work should be undertaken by t= he IETF.  Value judgements of "good for X" seem to me to be = a breeding ground for >Ratholes Of Unusual Size.<BR> ><BR> ><BR> <BR> <BR> </SPAN></FONT></BLOCKQUOTE> </BODY> </HTML> --_000_C81C65ED1E57jeffreydamickneustarbiz_-- From owner-namedroppers@ops.ietf.org Fri May 21 14:56:25 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 82BD03A67F6; Fri, 21 May 2010 14:56:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.841 X-Spam-Level: ** X-Spam-Status: No, score=2.841 tagged_above=-999 required=5 tests=[AWL=0.555, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, HELO_EQ_JP=1.244, J_CHICKENPOX_31=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rENmaKBh7aoB; Fri, 21 May 2010 14:56:24 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 90BB63A6407; Fri, 21 May 2010 14:56:18 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OFa7e-000FpB-TN for namedroppers-data0@psg.com; Fri, 21 May 2010 21:51:14 +0000 Received: from [131.112.32.132] (helo=necom830.hpcl.titech.ac.jp) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from <mohta@necom830.hpcl.titech.ac.jp>) id 1OFa7a-000FnI-Gr for namedroppers@ops.ietf.org; Fri, 21 May 2010 21:51:10 +0000 Received: (qmail 66796 invoked from network); 21 May 2010 22:07:07 -0000 Received: from softbank219001188004.bbtec.net (HELO ?192.168.1.27?) (219.1.188.4) by necom830.hpcl.titech.ac.jp with SMTP; 21 May 2010 22:07:07 -0000 Message-ID: <4BF6FFE0.9030200@necom830.hpcl.titech.ac.jp> Date: Sat, 22 May 2010 06:49:20 +0900 From: Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Alfred <ah@TR-Sys.de> CC: marka@isc.org, namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005211837.UAA17926@TR-Sys.de> In-Reply-To: <201005211837.UAA17926@TR-Sys.de> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> (2010/05/22 3:37), Alfred wrote: > i.e. why not sending an indication to the > IXFR client and let'm decide what he wants to do -- i.e. the idea > of IXFR-only. Because it means considerable amount of extra complexity *and* delay for almost nothing. Masataka Ohta From owner-namedroppers@ops.ietf.org Fri May 21 16:47:07 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 63A773A68DA; Fri, 21 May 2010 16:47:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.348 X-Spam-Level: X-Spam-Status: No, score=-0.348 tagged_above=-999 required=5 tests=[AWL=-0.949, BAYES_50=0.001, J_CHICKENPOX_55=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qvBsHhu4rCa6; Fri, 21 May 2010 16:47:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8EDC23A6895; Fri, 21 May 2010 16:47:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OFboq-00039a-CM for namedroppers-data0@psg.com; Fri, 21 May 2010 23:39:56 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <marka@isc.org>) id 1OFbom-00039K-VP for namedroppers@ops.ietf.org; Fri, 21 May 2010 23:39:52 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 3BAF8EC97E; Fri, 21 May 2010 23:39:50 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4LNdhsl026314; Sat, 22 May 2010 09:39:44 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005212339.o4LNdhsl026314@drugs.dv.isc.org> To: Alex Bligh <alex@alex.org.uk> Cc: Edward Lewis <Ed.Lewis@neustar.biz>, namedroppers@ops.ietf.org From: Mark Andrews <marka@isc.org> References: <a06240800c81c3ab1011a@[192.168.1.104]> <75CDE882710C88176DEF7EEA@nimrod.local> Subject: Re: [dnsext] Lookup ambiguity of CNAME and DNAME In-reply-to: Your message of "Fri, 21 May 2010 07:42:48 MST." <75CDE882710C88176DEF7EEA@nimrod.local> Date: Sat, 22 May 2010 09:39:42 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> In message <75CDE882710C88176DEF7EEA@nimrod.local>, Alex Bligh writes: > > > --On 21 May 2010 09:55:34 -0400 Edward Lewis <Ed.Lewis@neustar.biz> wrote: > > > We also have another complication - what happens at with wildcards. See > > RFC 4592, sections 4.3 and 4.4. We can handle a CNAME at a wildcard but > > the behavior of a DNAME at a wildcard is "to be avoided." (Please see > > the referenced text for more on that.) > > I'm not even sure what a wildcard CNAME and wildcard DNAME together would > be meant to do. Were we to go down the CNAME+DNAME route, I do not imagine > drastic loss of functionality and rioting in the streets if we said > it didn't work with wildcard CNAME. > > -- > Alex Bligh It's a non-issue. The same at a CNAME + DNAME can't exist at the apex of a zone as CNAME + DNAME co-existance is not the sole constraining rule. CNAME + DNAME at a wildcard cannot exist. The rules for both types need to be satisfied for them to co-exist. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Fri May 21 18:13:09 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2D7843A6A00; Fri, 21 May 2010 18:13:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.176 X-Spam-Level: X-Spam-Status: No, score=-0.176 tagged_above=-999 required=5 tests=[AWL=-1.077, BAYES_50=0.001, J_CHICKENPOX_31=0.6, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xsuNOGCkGZEf; Fri, 21 May 2010 18:13:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4D7A73A69BC; Fri, 21 May 2010 18:13:07 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OFd8T-000D5A-9q for namedroppers-data0@psg.com; Sat, 22 May 2010 01:04:17 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <marka@isc.org>) id 1OFd87-000CzK-FU for namedroppers@ops.ietf.org; Sat, 22 May 2010 01:03:55 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 65D10EC9A7; Sat, 22 May 2010 01:03:33 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4M13Uwm027604; Sat, 22 May 2010 11:03:30 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005220103.o4M13Uwm027604@drugs.dv.isc.org> To: Alfred =?hp-roman8?B?SM5uZXM=?= <ah@TR-Sys.de> Cc: namedroppers@ops.ietf.org From: Mark Andrews <marka@isc.org> References: <201005211837.UAA17926@TR-Sys.de> Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-reply-to: Your message of "Fri, 21 May 2010 20:37:00 +0200." <201005211837.UAA17926@TR-Sys.de> Date: Sat, 22 May 2010 11:03:29 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> In message <201005211837.UAA17926@TR-Sys.de>, Alfred =?hp-roman8?B?SM5uZXM=?= w rites: > Mark Andrews wrote: > > > > In message <201005202235.AAA16483@TR-Sys.de>, Alfred HÎnes writes: > >> Folks, > >> a simple, fundamental, provoking question, and follow-up considerations: > >> > >> What is the real benefit of (server-side) IXFR fallback to AXFR at all? > > > > The master is the only entity in a position to determine which > > response style is bigger. > > Correct. > > > > > Extra work for single masters and recovery from other events where > > the history is not available. > > I fear you misunderstood me; I did not call for *unconditional* > IXFR, but asked for the reason(s) of *automatic* fallback to AXFR > *by the IXFR server*, i.e. why not sending an indication to the > IXFR client and let'm decide what he wants to do -- i.e. the idea > of IXFR-only. You missed the point. If you only have one master then IXFR-ONLY is a complete waste of time. Normal IXFR is what you want and that includes fallback to AXFR by the master. IXFR-ONLY, IXFR and AXFR all have their places and clients need to choose which one they will use based on a number of factors. I'm also at a loss to see why the WG accepted IXFR-ONLY but rejected EDNS EXPIRE. They are both things designed to support more complex zone transfer graphs. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Sat May 22 09:16:22 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 82A6B3A6D2F; Sat, 22 May 2010 09:16:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.35 X-Spam-Level: *** X-Spam-Status: No, score=3.35 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pqapy-sPH0wU; Sat, 22 May 2010 09:16:20 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E68D23A6CA1; Sat, 22 May 2010 09:16:19 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OFrEe-000Lnr-MW for namedroppers-data0@psg.com; Sat, 22 May 2010 16:07:36 +0000 Received: from [193.227.124.2] (helo=mx01.bfk.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <fweimer@bfk.de>) id 1OFrEb-000Ln2-Iq for namedroppers@ops.ietf.org; Sat, 22 May 2010 16:07:33 +0000 Received: from mx00.int.bfk.de ([10.119.110.2]) by mx01.bfk.de with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) id 1OFrE0-0001fX-Ud; Sat, 22 May 2010 16:06:56 +0000 Received: by bfk.de with local id 1OFrE3-0003k8-Cb; Sat, 22 May 2010 16:06:59 +0000 To: Suzanne Woolf <woolf@isc.org> Cc: Mark Andrews <marka@isc.org>, Alex Bligh <alex@alex.org.uk>, Vaggelis Segredakis <segred@ics.forth.gr>, 'Andrew Sullivan' <ajs@shinkuro.com>, namedroppers@ops.ietf.org, 'Sotiris Panaretou' <sotiris@ucy.ac.cy> Subject: [dnsext] Re: On adoption of two drafts References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <FDF10604930449659CE4C74BA469CEC2@ics.forth.gr> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <EACA79D85688A6B0BE5B0B46@host113.msm.che.vodafone> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <DFBB095877427C98807BC3E8@nimrod.local> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520151426.GA22640@farside.isc.org> From: Florian Weimer <fweimer@bfk.de> Date: Sat, 22 May 2010 16:06:59 +0000 In-Reply-To: <20100520151426.GA22640@farside.isc.org> (Suzanne Woolf's message of "Thu\, 20 May 2010 15\:14\:26 +0000") Message-ID: <82pr0nvs2k.fsf@mid.bfk.de> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> * Suzanne Woolf: > Mark, I think I agree with you in principle, but it would be helpful > if you (or anyone) could provide an example of a case where one or > another of the tools we've been discussing is "a good tool to have in > the tool chest" outside of the IDN context. Somewhere (the dns-operations list) the idea of unsigned zone copies recently came up, to provide some means for end-user-controlled fallback in case of DNSSEC failures. I would also like to know how some form of aliasing helps to address the lack of signalling in IDNA. From what I've read, there are some difficulties transitioning to a new IDNA encoding scheme if you don't want per-TLD rules in clients. (I thought of IDNA as some sort of hashing scheme, it was only recently that I learned that the ability to go back from the hash to the pretty name was part of the spec. >From that perspective, the Greek sigma and German ess-zett issues are indeed problematic.) It seems to me that we still need TLD-specific behavior, and this leads me to the question why we need a DNS-level solution at all. --=20 Florian Weimer <fweimer@bfk.de> BFK edv-consulting GmbH http://www.bfk.de/ Kriegsstra=DFe 100 tel: +49-721-96201-1 D-76133 Karlsruhe fax: +49-721-96201-99 From owner-namedroppers@ops.ietf.org Sat May 22 16:35:36 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CD0563A68D1; Sat, 22 May 2010 16:35:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.688 X-Spam-Level: X-Spam-Status: No, score=0.688 tagged_above=-999 required=5 tests=[AWL=-1.475, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tk6rl0EhjwCK; Sat, 22 May 2010 16:35:36 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0936F3A68CB; Sat, 22 May 2010 16:35:35 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OFy6F-000IZp-Q4 for namedroppers-data0@psg.com; Sat, 22 May 2010 23:27:23 +0000 Received: from [65.122.17.41] (helo=fledge.watson.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <weiler@watson.org>) id 1OFy6D-000IZS-9z for namedroppers@ops.ietf.org; Sat, 22 May 2010 23:27:21 +0000 Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.3) with ESMTP id o4MNR4YJ072545; Sat, 22 May 2010 19:27:04 -0400 (EDT) (envelope-from weiler@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.3/Submit) with ESMTP id o4MNR3Uf072541; Sat, 22 May 2010 19:27:03 -0400 (EDT) (envelope-from weiler@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Sat, 22 May 2010 19:27:03 -0400 (EDT) From: Samuel Weiler <weiler@watson.org> To: "W.C.A. Wijngaards" <wouter@NLnetLabs.nl> cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] dnssec-bis-updates item about CNAME In-Reply-To: <C2374158F4FE4005AC021A67C36C36E4@local> Message-ID: <alpine.BSF.2.00.1005221922470.44694@fledge.watson.org> References: <4BD581A9.3030206@nlnetlabs.nl> <C2374158F4FE4005AC021A67C36C36E4@local> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3 (fledge.watson.org [127.0.0.1]); Sat, 22 May 2010 19:27:04 -0400 (EDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> > Well it is not clear that the answer is wrong. The standard, > possibly deliberately, does not define which answer is correct. This > means that explicit NSEC and RRSIG queries are not very useful - but > that's fine - there is no reason to issue an explicit NSEC or RRSIG > query ( or DNAME or CNAME ). I have a vague recollection of "us" talking about NSEC and RRSIG queries at length, and deciding that it's okay if they break in ways like this: they really are meta-data, and no one should ever be querying for them explicitly. At a first pass, I'm inclined to concur with George Barwood: clarify, but don't define. Anyone else out there with opinions? -- Sam From owner-namedroppers@ops.ietf.org Sat May 22 17:05:00 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1656F3A686E; Sat, 22 May 2010 17:05:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.852 X-Spam-Level: X-Spam-Status: No, score=0.852 tagged_above=-999 required=5 tests=[AWL=-1.311, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vTff7fHQkEcQ; Sat, 22 May 2010 17:04:59 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 088403A681D; Sat, 22 May 2010 17:04:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OFybI-000Lil-3J for namedroppers-data0@psg.com; Sat, 22 May 2010 23:59:28 +0000 Received: from [65.122.17.41] (helo=fledge.watson.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <weiler@watson.org>) id 1OFybF-000LiR-1c for namedroppers@ops.ietf.org; Sat, 22 May 2010 23:59:25 +0000 Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.3) with ESMTP id o4MNxKaK075534; Sat, 22 May 2010 19:59:20 -0400 (EDT) (envelope-from weiler@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.3/Submit) with ESMTP id o4MNxJqU075528; Sat, 22 May 2010 19:59:20 -0400 (EDT) (envelope-from weiler@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Sat, 22 May 2010 19:59:19 -0400 (EDT) From: Samuel Weiler <weiler@watson.org> To: George Barwood <george.barwood@blueyonder.co.uk> cc: Andrew Sullivan <ajs@shinkuro.com>, namedroppers@ops.ietf.org, Michael StJohns <mstjohns@comcast.net> Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data In-Reply-To: <2CC6D6735E144D7EAF749B399E36F361@local> Message-ID: <alpine.BSF.2.00.1005221946290.44694@fledge.watson.org> References: <OFFD77B24F.1DBDAD9C-ON802576EF.007CD412-882576EF.0080592F@nominet.org.uk> <A9136EBA-B023-4262-9885-EB58324F65E4@kirei.se> <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <OF4E2F5E74.7653D184-ON802576F2.00530E07-882576F2.005354EC@nominet.org.uk> <alpine.BSF.2.00.1003271901040.75904@fledge.watson.org> <20100514135457.GA65855@shinkuro.com> <auto-000018612361@execdsl.com> <20100514195525.GL65855@shinkuro.com> <E1OD5Rj-0001Wc-FA@psg.com> <2CC6D6735E144D7EAF749B399E36F361@local> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 Content-Type: MULTIPART/MIXED; BOUNDARY="621616949-1625029464-1274572014=:44694" Content-ID: <alpine.BSF.2.00.1005221954160.44694@fledge.watson.org> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3 (fledge.watson.org [127.0.0.1]); Sat, 22 May 2010 19:59:20 -0400 (EDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --621616949-1625029464-1274572014=:44694 Content-Type: TEXT/PLAIN; CHARSET=ISO-8859-15; FORMAT=flowed Content-Transfer-Encoding: 8BIT Content-ID: <alpine.BSF.2.00.1005221950581.44694@fledge.watson.org> Thank you for this summary. On Sat, 15 May 2010, George Barwood wrote: > The objectives are > (a) As much validation as possible is performed when answering CD=0 queries. > (b) Validation failures are to be avoided when answering CD=1 queries. > (c) The number of upstream queries should be minimised subject to (a) and (b) being satisfied. I concur with all of the above. (Strange wording of B aside, I'm encouraged that we all seem to agree on what's desired when CD=1.) I think the disconnect between me and Mike is over point A. Indeed, I want to be able to use a local resolver with a small set of trust anchors (for islands or high-value zones) while having an "upstream" resolver do the heavy lifting of maintaining a bigger set of trust anchors. So I don't want my setting of a trust anchor to immediately cause CD to be set. Maybe we can find a way to make that optional. The text in -11 also makes the bold new leap of assuming that "if you got a positive answer with CD=0, you don't have to query again with CD=1, even if the incoming query is CD=1". That's in the service of C above. -- Sam --621616949-1625029464-1274572014=:44694-- From owner-namedroppers@ops.ietf.org Sat May 22 17:12:49 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 114013A6880; Sat, 22 May 2010 17:12:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.89 X-Spam-Level: X-Spam-Status: No, score=0.89 tagged_above=-999 required=5 tests=[AWL=-1.087, BAYES_40=-0.185, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yNVx5mGQIG9Z; Sat, 22 May 2010 17:12:48 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 72B403A681D; Sat, 22 May 2010 17:12:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OFykd-000MlV-KP for namedroppers-data0@psg.com; Sun, 23 May 2010 00:09:07 +0000 Received: from [65.122.17.41] (helo=fledge.watson.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <weiler@watson.org>) id 1OFyka-000Mju-4t for namedroppers@ops.ietf.org; Sun, 23 May 2010 00:09:04 +0000 Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.3) with ESMTP id o4N091hh076692; Sat, 22 May 2010 20:09:01 -0400 (EDT) (envelope-from weiler@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.3/Submit) with ESMTP id o4N091gh076689; Sat, 22 May 2010 20:09:01 -0400 (EDT) (envelope-from weiler@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Sat, 22 May 2010 20:09:01 -0400 (EDT) From: Samuel Weiler <weiler@watson.org> To: Michael StJohns <mstjohns@comcast.net> cc: Andrew Sullivan <ajs@shinkuro.com>, namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data In-Reply-To: <E1OElMz-00057c-Ho@psg.com> Message-ID: <alpine.BSF.2.00.1005221952510.44694@fledge.watson.org> References: <OFFD77B24F.1DBDAD9C-ON802576EF.007CD412-882576EF.0080592F@nominet.org.uk> <A9136EBA-B023-4262-9885-EB58324F65E4@kirei.se> <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <OF4E2F5E74.7653D184-ON802576F2.00530E07-882576F2.005354EC@nominet.org.uk> <alpine.BSF.2.00.1003271901040.75904@fledge.watson.org> <20100514135457.GA65855@shinkuro.com> <auto-000018612361@execdsl.com> <20100514195525.GL65855@shinkuro.com> <auto-000018612841@execdsl.com> <20100517143811.GA77756@shinkuro.com> <E1OE82s-000OK6-R6@psg.com> <E1OElMz-00057c-Ho@psg.com> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3 (fledge.watson.org [127.0.0.1]); Sat, 22 May 2010 20:09:01 -0400 (EDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> Thanks to all for your efforts to move this along. On Wed, 19 May 2010, Michael StJohns wrote: > "Security aware intermediate resolvers MUST set the CD bit on any > upstream query for which they have a covering trust anchor (TA) or > for which the downstream query has the CD bit set." ... > For the first paragraph, simply delete the TA if you don't want to > force the setting of the CD bit. There is no way - programatically > or protocol wise to determine if an upstream resolver can do > validation over this query so making this a SHOULD makes no sense > whatsoever. So we disagree about the covering trust anchor. Moving on: I concur that NEW queries needed to respond to CD=1 should be made with CD=1. As in my last message, the text in -11 assumes that cached postive answers are good enough, even if made with CD=0, so a new query may not always be needed. > The second paragraph covers whether or not unvalidated data is > cached and how to treat it. ... This all sounds unnecessarily prescriptive. But, indeed, the text in -11 may not be clear enough. Is there a more concise way to say what's needed here? -- Sam From owner-namedroppers@ops.ietf.org Sat May 22 22:33:53 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F34763A68C3; Sat, 22 May 2010 22:33:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.791 X-Spam-Level: * X-Spam-Status: No, score=1.791 tagged_above=-999 required=5 tests=[AWL=-1.175, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ftxXrUF6597A; Sat, 22 May 2010 22:33:51 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 962183A68C1; Sat, 22 May 2010 22:33:50 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OG3gv-0004ZP-5a for namedroppers-data0@psg.com; Sun, 23 May 2010 05:25:37 +0000 Message-Id: <E1OG3gv-0004ZP-5a@psg.com> Received: from [76.96.62.80] (helo=qmta08.westchester.pa.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <mstjohns@comcast.net>) id 1OG3gt-0004Z5-3R for namedroppers@ops.ietf.org; Sun, 23 May 2010 05:25:35 +0000 Received: from omta14.westchester.pa.mail.comcast.net ([76.96.62.60]) by qmta08.westchester.pa.mail.comcast.net with comcast id LtQu1e0021HzFnQ58tRbPm; Sun, 23 May 2010 05:25:35 +0000 Received: from Mike-PC3.comcast.net ([68.83.217.57]) by omta14.westchester.pa.mail.comcast.net with comcast id LtRa1e0021EtFYL3atRaJQ; Sun, 23 May 2010 05:25:35 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 23 May 2010 01:25:29 -0400 To: Samuel Weiler <weiler@watson.org> From: Michael StJohns <mstjohns@comcast.net> Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Cc: Andrew Sullivan <ajs@shinkuro.com>,namedroppers@ops.ietf.org In-Reply-To: <alpine.BSF.2.00.1005221952510.44694@fledge.watson.org> References: <OFFD77B24F.1DBDAD9C-ON802576EF.007CD412-882576EF.0080592F@nominet.org.uk> <A9136EBA-B023-4262-9885-EB58324F65E4@kirei.se> <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <OF4E2F5E74.7653D184-ON802576F2.00530E07-882576F2.005354EC@nominet.org.uk> <alpine.BSF.2.00.1003271901040.75904@fledge.watson.org> <20100514135457.GA65855@shinkuro.com> <auto-000018612361@execdsl.com> <20100514195525.GL65855@shinkuro.com> <auto-000018612841@execdsl.com> <20100517143811.GA77756@shinkuro.com> <E1OE82s-000OK6-R6@psg.com> <E1OElMz-00057c-Ho@psg.com> <alpine.BSF.2.00.1005221952510.44694@fledge.watson.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> At 08:09 PM 5/22/2010, Samuel Weiler wrote: >>The second paragraph covers whether or not unvalidated data is cached and how to treat it. ... > >This all sounds unnecessarily prescriptive. But, indeed, the text in -11 may not be clear enough. Is there a more concise way to say what's needed here? This is reminiscent of one of my encounters with a car salesman - he invited me to bid against myself by telling me my offer was too low and requested another bid.. Let me turn it around. What of the text do you find "overly prescriptive" and why? How would you change it and why? And while "conciseness" is a desired trait, correctness is even more desirable. I belive the text is correct and complete. Do you have a different take on it? Is it wrong or does it miss key conditions? If you believe the text is incorrect, I'm happen to take suggestions for amending it. Or to even address claims of incorrectness. The -11 text is incomplete for the reasons stated elsewhere. Mike From owner-namedroppers@ops.ietf.org Sat May 22 22:33:56 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7957E3A69C6; Sat, 22 May 2010 22:33:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.959 X-Spam-Level: * X-Spam-Status: No, score=1.959 tagged_above=-999 required=5 tests=[AWL=-1.007, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JCcLKHZE8J8z; Sat, 22 May 2010 22:33:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 681BC3A68C1; Sat, 22 May 2010 22:33:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OG3gr-0004Yt-39 for namedroppers-data0@psg.com; Sun, 23 May 2010 05:25:33 +0000 Message-Id: <E1OG3gr-0004Yt-39@psg.com> Received: from [76.96.62.17] (helo=qmta10.westchester.pa.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <mstjohns@comcast.net>) id 1OG3gn-0004YY-Qa for namedroppers@ops.ietf.org; Sun, 23 May 2010 05:25:30 +0000 Received: from omta21.westchester.pa.mail.comcast.net ([76.96.62.72]) by qmta10.westchester.pa.mail.comcast.net with comcast id LtRW1e0011ZXKqc5AtRWXf; Sun, 23 May 2010 05:25:30 +0000 Received: from Mike-PC3.comcast.net ([68.83.217.57]) by omta21.westchester.pa.mail.comcast.net with comcast id LtRS1e0051EtFYL3htRTSc; Sun, 23 May 2010 05:25:29 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 23 May 2010 01:25:22 -0400 To: Samuel Weiler <weiler@watson.org>, George Barwood <george.barwood@blueyonder.co.uk> From: Michael StJohns <mstjohns@comcast.net> Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Cc: Andrew Sullivan <ajs@shinkuro.com>,namedroppers@ops.ietf.org In-Reply-To: <alpine.BSF.2.00.1005221946290.44694@fledge.watson.org> References: <OFFD77B24F.1DBDAD9C-ON802576EF.007CD412-882576EF.0080592F@nominet.org.uk> <A9136EBA-B023-4262-9885-EB58324F65E4@kirei.se> <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <OF4E2F5E74.7653D184-ON802576F2.00530E07-882576F2.005354EC@nominet.org.uk> <alpine.BSF.2.00.1003271901040.75904@fledge.watson.org> <20100514135457.GA65855@shinkuro.com> <auto-000018612361@execdsl.com> <20100514195525.GL65855@shinkuro.com> <E1OD5Rj-0001Wc-FA@psg.com> <2CC6D6735E144D7EAF749B399E36F361@local> <alpine.BSF.2.00.1005221946290.44694@fledge.watson.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> At 07:59 PM 5/22/2010, Samuel Weiler wrote: >Thank you for this summary. > >On Sat, 15 May 2010, George Barwood wrote: > >>The objectives are >>(a) As much validation as possible is performed when answering CD=0 queries. >>(b) Validation failures are to be avoided when answering CD=1 queries. >>(c) The number of upstream queries should be minimised subject to (a) and (b) being satisfied. > >I concur with all of the above. (Strange wording of B aside, I'm encouraged that we all seem to agree on what's desired when CD=1.) > >I think the disconnect between me and Mike is over point A. Indeed, I want to be able to use a local resolver with a small set of trust anchors (for islands or high-value zones) while having an "upstream" resolver do the heavy lifting of maintaining a bigger set of trust anchors. So I don't want my setting of a trust anchor to immediately cause CD to be set. Maybe we can find a way to make that optional. Hi Sam - You've got two hats here - one as document editor and one as individual contributor. I assume the above is offered as an IC and not the document editor? In any event, over the last few years you've objected to this repeatedly and I've asked repeatedly for analysis from you and others why setting the CD bit if you have a covering TA should be optional especially given the text in section 6 of 4033. So instead, let me offer my own analysis. Feel free to dispute it, but let's get this away from the realm of "don't like" into the realm of "here's what works and why". Assume that we have a non-CD bit query coming to the local resolver for something under "foo.com". Assume the local resolver has a trust point and trust anchor for "foo.com". Let's assume that we don't set the CD bit on the upstream - for whatever reason (Call it the Sam implementation). Let's finally assume that the local resolver does validation on everything covered by its trust anchors (which seems to be the defined approach if you have a TA covering the query) 1) Assume there is an uptream resolver with a trust point also for foo.com. a) Condition: Both local and upstream have the same trust anchor Result: No difference than had you set the CD bit and done local validation b) Condition: local has a good (current, valid) trust anchor, upstream had a bad (old, wrong) trust anchor Result: Upstream returns SERVFAIL in error, client can't connect c) Condition: upstream has a good trust anchor, local has a bad trust anchor Result: local returns SERVFAIL in error, client can't connect. d) Condition: both have bad trust anchors for foo.com Result: upstream returns SERVFAIL, but so would local validation. 2) Assume the upstream resolver has a trust point for .com instead of for foo.com a) Condition: upstream resolver .com TA chains to the same foo.com key as the local trust anchor. Result: no difference than had you done local validation b) Condition: upstream resolver .com TA chains to old DS for foo.com, or has other validation failures in chaining; local has good trust anchor Result: SERVFAIL in error from the upstream c) Condition: local has old trust anchor, upstream chains to valid key and validates Result: SERVFAIL in error from the local resolver d) Condition: both have bad or unchainable trust anchors Result: SERVFAIL, but no different than if you'd done local validation From your comments I'm getting that you seem to some how be implying that its possible for the local resolver to get a trust anchor that will accept invalid data. and that you think the upstream resolver can protect against that. I'm not sure how that happens. Could you care to elaborate? Have I missed the case or cases you care about? If you have an assumption that the local resolver some how knows what trust anchors the upstream resolvers has, you need to explain how that could happen (e.g. configuration, discovery through protocol) and why that changes my analysis. If you are concerned that an upstream resolver might get a TA revocation faster than your local resolver - what would be the impact? And what would be the impact of the local resolver getting the revocation before the upstream resolver? Which is more manageable from the local resolver's point of view? Which gives the more predictable result? Finally, if after all of the above you still think that not setting the CD bit in an upstream query covered by a local TA is optional, you need to precisely define (so it can be implemented) the situations under which the CD bit is cleared. If its cleared all the time, you need to explain why simply removing the local resolvers TA isn't the appropriate action. If its cleared only part of the time, you need to explain how the resolver might choose when to set it. Seriously, if you have a trust anchor that covers the query, set the CD bit in the upstream query and do local validation. If you don't set the CD bit all you're doing is multiplying the possible errors. 1b, and 2b are errors that need not happen. >The text in -11 also makes the bold new leap of assuming that "if you got a positive answer with CD=0, you don't have to query again with CD=1, even if the incoming query is CD=1". That's in the service of C above. I agree with this. But, you still don't address the "if you get a positive answer with CD=1, you should requery again if you get an incoming query of CD=0" issue. That's also in service of c (and a) above. If you query upstream with the CD bit set because the downstream had the CD bit set (per 4035), then you have in cache possibly unvalidated data. If you have no local trust anchor for that cached data, and you then get a CD=0 query you can't return the data in cache because of the lack of validation. Or do you disagree with that statement? Mike >-- Sam From owner-namedroppers@ops.ietf.org Sun May 23 14:37:23 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0B7DD3A6D16; Sun, 23 May 2010 14:37:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.085 X-Spam-Level: ** X-Spam-Status: No, score=2.085 tagged_above=-999 required=5 tests=[AWL=-0.881, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6GlxzkjSdDF8; Sun, 23 May 2010 14:37:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E33B63A6878; Sun, 23 May 2010 14:37:20 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGIlr-000HEo-2S for namedroppers-data0@psg.com; Sun, 23 May 2010 21:31:43 +0000 Message-Id: <E1OGIlr-000HEo-2S@psg.com> Received: from [76.96.62.17] (helo=qmta10.westchester.pa.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <mstjohns@comcast.net>) id 1OGIlm-000HEM-Ps for namedroppers@ops.ietf.org; Sun, 23 May 2010 21:31:39 +0000 Received: from omta17.westchester.pa.mail.comcast.net ([76.96.62.89]) by qmta10.westchester.pa.mail.comcast.net with comcast id M8ZU1e0071vXlb85A9XfSm; Sun, 23 May 2010 21:31:39 +0000 Received: from Mike-PC3.comcast.net ([68.83.217.57]) by omta17.westchester.pa.mail.comcast.net with comcast id M9Xd1e0011EtFYL3d9Xd5B; Sun, 23 May 2010 21:31:38 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 23 May 2010 17:31:31 -0400 To: "George Barwood" <george.barwood@blueyonder.co.uk>, "Samuel Weiler" <weiler@watson.org> From: Michael StJohns <mstjohns@comcast.net> Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Cc: "Andrew Sullivan" <ajs@shinkuro.com>,<namedroppers@ops.ietf.org> In-Reply-To: <F8A964E48CE74748956C958BAE200CDE@local> References: <OFFD77B24F.1DBDAD9C-ON802576EF.007CD412-882576EF.0080592F@nominet.org.uk> <A9136EBA-B023-4262-9885-EB58324F65E4@kirei.se> <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <OF4E2F5E74.7653D184-ON802576F2.00530E07-882576F2.005354EC@nominet.org.uk> <alpine.BSF.2.00.1003271901040.75904@fledge.watson.org> <20100514135457.GA65855@shinkuro.com> <auto-000018612361@execdsl.com> <20100514195525.GL65855@shinkuro.com> <E1OD5Rj-0001Wc-FA@psg.com> <2CC6D6735E144D7EAF749B399E36F361@local> <alpine.BSF.2.00.1005221946290.44694@fledge.watson.org> <4bf8bc49.48c3f10a.3f38.fffff9a3SMTPIN_ADDED@mx.google.com> <F8A964E48CE74748956C958BAE200CDE@local> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> Comments in line. The key question is "why would I trust the upstream resolver more than I would trust my local resolver?" I haven't yet heard an answer to this that I find valid. At 03:20 PM 5/23/2010, George Barwood wrote: >----- Original Message ----- >From: "Michael StJohns" <mstjohns@comcast.net> >To: "Samuel Weiler" <weiler@watson.org>; "George Barwood" <george.barwood@blueyonder.co.uk> >Cc: "Andrew Sullivan" <ajs@shinkuro.com>; <namedroppers@ops.ietf.org> >Sent: Sunday, May 23, 2010 6:25 AM >Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data > > >> At 07:59 PM 5/22/2010, Samuel Weiler wrote: >>>Thank you for this summary. >>> >>>On Sat, 15 May 2010, George Barwood wrote: >>> >>>>The objectives are >>>>(a) As much validation as possible is performed when answering CD=0 queries. >>>>(b) Validation failures are to be avoided when answering CD=1 queries. >>>>(c) The number of upstream queries should be minimised subject to (a) and (b) being satisfied. >>> >>>I concur with all of the above. (Strange wording of B aside, I'm encouraged that we all seem to agree on what's desired when CD=1.) >>> >>>I think the disconnect between me and Mike is over point A. Indeed, I want to be able to use a local resolver with a small set of trust anchors (for islands or high-value zones) while having an "upstream" resolver do the heavy lifting of maintaining a bigger set of trust anchors. So I don't want my setting of a trust anchor to immediately cause CD to be set. Maybe we can find a way to make that optional. >> >> >> Hi Sam - >> >> You've got two hats here - one as document editor and one as individual contributor. I assume the above is offered as an IC and not the document editor? >> >> In any event, over the last few years you've objected to this repeatedly and I've asked repeatedly for analysis from you and others why setting the CD bit if you have a covering TA should be optional especially given the text in section 6 of 4033. >> >> So instead, let me offer my own analysis. Feel free to dispute it, but let's get this away from the realm of "don't like" into the realm of "here's what works and why". > >In my earlier post on this ( http://ops.ietf.org/lists/namedroppers/namedroppers.2010/msg01289.html ), I stated > > But this is a grey area - it's to some extent a matter of local policy whether > CD=1 is set on upstream queries. CD=0/1 is a boolean flag, so nuances canot be expressed. > I don't think the existence of a local trust anchor is decisive : an upstream cache > may have a more dependable ( better validated / closer ) trust anchor. > However, I think the default should be that validation is performed unless > CD=1 has been specified by the final client, or some specific configuration is in effect. > >To expand on this : trust anchors have to be acquired, and may be forged. Yes but: 1) Why would you think that an upstream resolver couldn't also have its TA forged? 2) Why would you install locally a forged trust anchor? 3) Why would you repose more trust in the upstream resolver than the local resolver and still install local TAs? >So in your example below, if the local trust anchor for foo.com has been forged >on the local resolver, but is valid on the upstream, setting CD=1 allows bogus data >through that would otherwise be caught. But also in the example, if you have a forged local trust anchor, all the non-forged data gets dropped at the local resolver - cases 1c and 2c. So the forged trust anchor turns into somewhat of a denial of service in the normal case. So how much of a risk is this extremely contrived case? Let me be blunt - I can't see it as a risk that matters. If your local resolver is compromised, it can tell you whatever it wants regardless of TAs and validation settings. This protocol behavior is not meant to deal with the general issue of compromise or misconfiguration of a resolver - only with the normal, defaul, expected behavior. >But the common case is where the local resolver has a trust anchor for <root> and the >upstream resolver has a trust anchor for the company domain. In this case the local >resolver should not set CD=1 on it's upstream, as configuration on the upstream resolver >indicates that the parent zones of the company zone are not fully trusted. This really isn't a common case AFAIK - the more common case is the upstream encloses the local, not the other way around. The correct way to deal with this - if this is a company specific local resolver - is to install a company specific TA in the local resolver. Yes, there are lots of ways for a resolver system manager to screw up, but this one is just laughable. As I've mentioned before several times - there is no way - absent specific configuration - that a resolver knows whether or not there is an upstream validating resolver. If this is the case you're concerned about, you have two choices - either a) delete the <root> TA locally and ensure that all queries are proxied to an upstream resolver with <root> or b) implement an option to carve a hole in your trust anchor coverage (e.g. pass all <company>.<root> queries upstream without CD, even though you have a TA for <root>. Implementations mostly support a), I'm willing to have someone else write the language to support b) even though I think it will rarely if ever be turned on. >So the "safest" way to proceed is to not set CD=1 on upstream queries when answering CD=0 queries, >and this SHOULD therefore be the default behavior IMO. This is a conclusion - and one I consider false, possibly based on a definition of "safe" foreign to me. The only time this gets you "protected" is if a) someone's hacked the local TA store and installed fake "good" keys (or the manager was too incompetent to use good security practices), and b) if the upstream exists and c) the upstream wasn't also hacked and d) someone tried to give you forged data. Not setting CD on the upstream means that validation failures due to stupidity on the part of a resolver that you don't manage (the upstream resolver) can prevent you from resolving and validating data for which you have the appropriate trust anchor. Shall we talk for a while about the .gov signature issues for example? But seriously, if I can get the fake keys installed in the local TA store, why couldn't I just twiddle with other behavior? Like whether or not to set the CD bit in the upstream for a specific set of queries? >It would be ok to manually override this for performance reasons ( one can expect CD=1 queries >to be faster ), and it could be a flag that is specified when a trust anchor is configured in the local resolver. See above - not just a flag, but a carve out from setting the CD bit (not clearing it as you propose). If you believe the upstream has the same TA as yours and you're willing to have the upstream do the validation, simply delete your local TA. If you believe the upstream has a more specific TA than yours (because you were told out of band that was so), and you want it to be the source of validation for that TA - which you hopefully know - then configure a CD exception that has to be a proper enclosed TA of one of your local TAs. (Hmm... so what happens when the upstream - without warning - deletes that enclosing TA?) >Still, it would also be ok to say it's purely a matter of local policy, and make no specific recommendation >as to the default behavior. I don't have a strong view on that. If its a matter of local policy, you need to describe a behavior that's a default and not depend on X number of vendors to do it all the same way through guess work. Saying its local policy without defining a default is hand-waving of the worst kind. >Regards, >George > > >> >> Assume that we have a non-CD bit query coming to the local resolver for something under "foo.com". Assume the local resolver has a trust point and trust anchor for "foo.com". Let's assume that we don't set the CD bit on the upstream - for whatever reason (Call it the Sam implementation). Let's finally assume that the local resolver does validation on everything covered by its trust anchors (which seems to be the defined approach if you have a TA covering the query) >> >> 1) Assume there is an uptream resolver with a trust point also for foo.com. >> >> a) Condition: Both local and upstream have the same trust anchor >> Result: No difference than had you set the CD bit and done local validation >> >> b) Condition: local has a good (current, valid) trust anchor, upstream had a bad (old, wrong) trust anchor >> Result: Upstream returns SERVFAIL in error, client can't connect >> >> c) Condition: upstream has a good trust anchor, local has a bad trust anchor >> Result: local returns SERVFAIL in error, client can't connect. >> >> d) Condition: both have bad trust anchors for foo.com >> Result: upstream returns SERVFAIL, but so would local validation. >> >> 2) Assume the upstream resolver has a trust point for .com instead of for foo.com >> >> a) Condition: upstream resolver .com TA chains to the same foo.com key as the local trust anchor. >> Result: no difference than had you done local validation >> >> b) Condition: upstream resolver .com TA chains to old DS for foo.com, or has other validation failures in chaining; local has good trust anchor >> Result: SERVFAIL in error from the upstream >> >> c) Condition: local has old trust anchor, upstream chains to valid key and validates >> Result: SERVFAIL in error from the local resolver >> >> d) Condition: both have bad or unchainable trust anchors >> Result: SERVFAIL, but no different than if you'd done local validation >> >> >> From your comments I'm getting that you seem to some how be implying that its possible for the local resolver to get a trust anchor that will accept invalid data. and that you think the upstream resolver can protect against that. I'm not sure how that happens. Could you care to elaborate? >> >> Have I missed the case or cases you care about? >> >> If you have an assumption that the local resolver some how knows what trust anchors the upstream resolvers has, you need to explain how that could happen (e.g. configuration, discovery through protocol) and why that changes my analysis. >> >> If you are concerned that an upstream resolver might get a TA revocation faster than your local resolver - what would be the impact? And what would be the impact of the local resolver getting the revocation before the upstream resolver? Which is more manageable from the local resolver's point of view? Which gives the more predictable result? >> >> Finally, if after all of the above you still think that not setting the CD bit in an upstream query covered by a local TA is optional, you need to precisely define (so it can be implemented) the situations under which the CD bit is cleared. If its cleared all the time, you need to explain why simply removing the local resolvers TA isn't the appropriate action. If its cleared only part of the time, you need to explain how the resolver might choose when to set it. >> >> Seriously, if you have a trust anchor that covers the query, set the CD bit in the upstream query and do local validation. If you don't set the CD bit all you're doing is multiplying the possible errors. 1b, and 2b are errors that need not happen. >> >> >>>The text in -11 also makes the bold new leap of assuming that "if you got a positive answer with CD=0, you don't have to query again with CD=1, even if the incoming query is CD=1". That's in the service of C above. >> >> I agree with this. But, you still don't address the "if you get a positive answer with CD=1, you should requery again if you get an incoming query of CD=0" issue. That's also in service of c (and a) above. If you query upstream with the CD bit set because the downstream had the CD bit set (per 4035), then you have in cache possibly unvalidated data. If you have no local trust anchor for that cached data, and you then get a CD=0 query you can't return the data in cache because of the lack of validation. Or do you disagree with that statement? >> >> Mike >> >> >> >>>-- Sam >> >> From owner-namedroppers@ops.ietf.org Sun May 23 15:59:07 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 45DBF3A6847; Sun, 23 May 2010 15:59:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.483 X-Spam-Level: ** X-Spam-Status: No, score=2.483 tagged_above=-999 required=5 tests=[AWL=-1.083, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, J_CHICKENPOX_44=0.6, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cT5IK8zV2ufH; Sun, 23 May 2010 15:59:05 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id ABF903A6872; Sun, 23 May 2010 15:59:04 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGK2s-0000Wu-Es for namedroppers-data0@psg.com; Sun, 23 May 2010 22:53:22 +0000 Message-Id: <E1OGK2s-0000Wu-Es@psg.com> Received: from [76.96.62.80] (helo=qmta08.westchester.pa.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <mstjohns@comcast.net>) id 1OGK2l-0000WT-Vb for namedroppers@ops.ietf.org; Sun, 23 May 2010 22:53:16 +0000 Received: from omta02.westchester.pa.mail.comcast.net ([76.96.62.19]) by qmta08.westchester.pa.mail.comcast.net with comcast id M84o1e0020QuhwU58AtA0T; Sun, 23 May 2010 22:53:10 +0000 Received: from Mike-PC3.comcast.net ([68.83.217.57]) by omta02.westchester.pa.mail.comcast.net with comcast id MAt81e0041EtFYL3NAt8H4; Sun, 23 May 2010 22:53:10 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 23 May 2010 18:53:03 -0400 To: "George Barwood" <george.barwood@blueyonder.co.uk>, "Samuel Weiler" <weiler@watson.org> From: Michael StJohns <mstjohns@comcast.net> Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Cc: "Andrew Sullivan" <ajs@shinkuro.com>,<namedroppers@ops.ietf.org> In-Reply-To: <A473849776154204BC7CB8C0AA202749@local> References: <OFFD77B24F.1DBDAD9C-ON802576EF.007CD412-882576EF.0080592F@nominet.org.uk> <A9136EBA-B023-4262-9885-EB58324F65E4@kirei.se> <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <OF4E2F5E74.7653D184-ON802576F2.00530E07-882576F2.005354EC@nominet.org.uk> <alpine.BSF.2.00.1003271901040.75904@fledge.watson.org> <20100514135457.GA65855@shinkuro.com> <auto-000018612361@execdsl.com> <20100514195525.GL65855@shinkuro.com> <E1OD5Rj-0001Wc-FA@psg.com> <2CC6D6735E144D7EAF749B399E36F361@local> <alpine.BSF.2.00.1005221946290.44694@fledge.watson.org> <4bf8bc49.48c3f10a.3f38.fffff9a3SMTPIN_ADDED@mx.google.com> <F8A964E48CE74748956C958BAE200CDE@local> <4bf99eba.816bdc0a.7b15.fffff871SMTPIN_ADDED@mx.google.com> <A473849776154204BC7CB8C0AA202749@local> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> At 05:58 PM 5/23/2010, George Barwood wrote: >----- Original Message ----- >From: "Michael StJohns" <mstjohns@comcast.net> >To: "George Barwood" <george.barwood@blueyonder.co.uk>; "Samuel Weiler" <weiler@watson.org> >Cc: "Andrew Sullivan" <ajs@shinkuro.com>; <namedroppers@ops.ietf.org> >Sent: Sunday, May 23, 2010 10:31 PM >Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data > > >> Comments in line. The key question is "why would I trust the upstream resolver more than I would trust my local resolver?" I haven't yet heard an answer to this that I find valid. > >Answer : you don't trust either - you hope that one of them has a non-bogus trust anchor. "hope" is not really a security attribute.... *sigh* OK - we're really out in left field here. And I don't mean to pick on you, but your logic chain is broken. 1) If EITHER of them has a bogus trust anchor - forged or otherwise, the client gets a SERVFAIL, even if one of them has a non-bogus trust anchor. So hoping that one of them has a non-bogus trust anchor is really not all that useful. BOTH need a non-bogus TA to be useful. 2) If you don't trust either, then create a client set of TAs and have your client set the CD on all of its upstream queries including the initial one to the local resolver. >Another point ( that occurred to me after my previous post ) is that even if you have a trust anchor ( say for <root> ), there may be a break in the authentication chain, but the upstream may have a trust anchor that cures that. No, it doesn't. If you have a break in the local, then you get a SERVFAIL from the local, regardless of what you get from the upstream. >Some inline answers below, although maybe the discussion is now losing focus I think. > >George > >> > >>>So in your example below, if the local trust anchor for foo.com has been forged >>>on the local resolver, but is valid on the upstream, setting CD=1 allows bogus data >>>through that would otherwise be caught. >> >> But also in the example, if you have a forged local trust anchor, all the non-forged data gets dropped at the local resolver - cases 1c and 2c. So the forged trust anchor turns into somewhat of a denial of service in the normal case. > >Hmm.. I don't immediately follow here. If you set CD=1 on the upstream query, and the local trust anchor is bogus, then the end client can get bogus reponses, that would otherwise potentially be caught by the upstream resolver. Your comments were about setting requiring CD=0 on upstream queries for CD=0 downstream queries even if you have a local TA covering the query. If you set CD=0 on the upstream query and the upstream has a bogus chain or TA, you get a SERVFAIL which the local then returns to the client. If the upstream has a valid TA or chain and your local has a bogus TA, the local gets validated data from the upstream, but then attempts its own validation and returns SERVFAIL to the client. There is no way for good (validated) data to get to the client unless BOTH have the same good TA or TA chains (for a local CD=0 to the upstream query where the local has a TA covering the query). >> >> So how much of a risk is this extremely contrived case? Let me be blunt - I can't see it as a risk that matters. If your local resolver is compromised, it can tell you whatever it wants regardless of TAs and validation settings. This protocol behavior is not meant to deal with the general issue of compromise or misconfiguration of a resolver - only with the normal, defaul, expected behavior. > >There is no quantitative answer to this question, but it's a non-zero risk. Yup, but the risk is an included risk in the general concept of compromise or misconfiguration - its no greater than that risk and that risk has more possible impacts. "fixing" this issue the way you seem to want to, doesn't really prevent other misconfiguration or compromise issues - and therefore doesn't actually fix anything. > >> >>>But the common case is where the local resolver has a trust anchor for <root> and the >>>upstream resolver has a trust anchor for the company domain. In this case the local >>>resolver should not set CD=1 on it's upstream, as configuration on the upstream resolver >>>indicates that the parent zones of the company zone are not fully trusted. >> >> >> This really isn't a common case AFAIK - the more common case is the upstream encloses the local, not the other way around. The correct way to deal with this - if this is a company specific local resolver - is to install a company specific TA in the local resolver. Yes, there are lots of ways for a resolver system manager to screw up, but this one is just laughable. > >> As I've mentioned before several times - there is no way - absent specific configuration - that a resolver knows whether or not there is an upstream validating resolver. If this is the case you're concerned about, you have two choices - either a) delete the <root> TA locally and ensure that all queries are proxied to an upstream resolver with <root> or b) implement an option to carve a hole in your trust anchor coverage (e.g. pass all <company>.<root> queries upstream without CD, even though you have a TA for <root>. Implementations mostly support a), I'm willing to have someone else write the language to support b) even though I think it will rarely if ever be turned on. >> >>>So the "safest" way to proceed is to not set CD=1 on upstream queries when answering CD=0 queries, >>>and this SHOULD therefore be the default behavior IMO. >> >> This is a conclusion - and one I consider false, possibly based on a definition of "safe" foreign to me. The only time this gets you "protected" is if a) someone's hacked the local TA store and installed fake "good" keys (or the manager was too incompetent to use good security practices), and b) if the upstream exists and c) the upstream wasn't also hacked and d) someone tried to give you forged data. > >Another aspect is that if CD=1 is reserved for "emergency" use, queries to a site resolver with CD=1 set >can trigger warnings to administrators that all may not be well. If using CD=1 on the upstream is standard, >there is no way to enforce authentication at the site level, other than disabling CD=1 entirely. Oh b*******t. Please re-read section 6 of 4033. The CD bit is NOT for emergency use - it is for a resolver to say to the upstream folks - get the hell out of my way and give me the raw data. I assume you mean"name validation" when you say "authentication"? If you're thinking that its more (e.g. authenticating my login to a machine or some such) then you're going to need to make a longer explanation. To put paid to this argument - intermediate resolvers are all about efficiency, and not so much about control. Given that an end system can completely bypass local resolvers by doing the queries themselves, there isn't any way to actually "disable CD=1" entirely. Yes, you can firewall against this (*sigh*) but then I would hope you'd trust your local resolver (inside the firewall) to do the right thing rather than just praying the upstream resolver (outside the firewall) had a clue. > > Not setting CD on the upstream means that validation failures due to stupidity on the part of a resolver that you don't manage (the upstream resolver) can prevent you from resolving and validating data for which you have the appropriate trust anchor. Shall we talk for a while about the .gov signature issues for example? >> >> But seriously, if I can get the fake keys installed in the local TA store, why couldn't I just twiddle with other behavior? Like whether or not to set the CD bit in the upstream for a specific set of queries? >> > >Depends on the mechanism by which trust anchors are distributed. But any distribution method has potential weaknesses. So does any server. What you're trying to do is put a 1 ft thick steel vault door on a 2x4 and drywall closet. It might look shiny and secure, but it provides no additional protection over that wooden door with a lock that was there. E.g the same amount of force will still get you in the closet. From owner-namedroppers@ops.ietf.org Sun May 23 16:37:59 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F3DC33A68AE; Sun, 23 May 2010 16:37:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.837 X-Spam-Level: X-Spam-Status: No, score=0.837 tagged_above=-999 required=5 tests=[AWL=-1.269, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9HYbhacP88F0; Sun, 23 May 2010 16:37:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id AD21F3A681B; Sun, 23 May 2010 16:37:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGKfZ-0004ps-Po for namedroppers-data0@psg.com; Sun, 23 May 2010 23:33:21 +0000 Received: from [74.125.82.180] (helo=mail-wy0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <d3e3e3@gmail.com>) id 1OGKfW-0004pd-3n for namedroppers@ops.ietf.org; Sun, 23 May 2010 23:33:18 +0000 Received: by wyi11 with SMTP id 11so2094310wyi.11 for <namedroppers@ops.ietf.org>; Sun, 23 May 2010 16:33:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=7jODiRWc0YuhYKIYoKuhHTSRMRgpFecmWWFPunveqsI=; b=bd5utkPw+kl6yrC6ul31WB/xPyIogFpR3RFYeg5Z5yMTy/7dufqPH07BQ0I65HgRBX oxKRQzfklQOVc9Q9RsnmrKPZ8e2Peo68AJ2GY87brE5oYzrqVDZQyazYotVp/oWDSYYl 9hN5ksv+bg7Vfcz5U1kN1/x/17TjhPk8WzBPQ= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=isg2m5IZles+pUdSXE1D2aCOYe1eTjLj4NDewFjN7RKa8DWR+Y5uKG5HD6W8qgDqxZ 16mvIyv9t7XqtRu0wxeLftbZA+gcehjSZmkqo71X6sZWnSx7PNGi1dr+Y4UOXSqXOcws yDlaoGiwKqHI+EIeR2m9cby++NmuW1NVTENxU= MIME-Version: 1.0 Received: by 10.216.85.1 with SMTP id t1mr2890997wee.3.1274657596028; Sun, 23 May 2010 16:33:16 -0700 (PDT) Received: by 10.216.229.210 with HTTP; Sun, 23 May 2010 16:33:15 -0700 (PDT) In-Reply-To: <E1OGK2s-0000Wu-Es@psg.com> References: <OFFD77B24F.1DBDAD9C-ON802576EF.007CD412-882576EF.0080592F@nominet.org.uk> <20100514195525.GL65855@shinkuro.com> <E1OD5Rj-0001Wc-FA@psg.com> <2CC6D6735E144D7EAF749B399E36F361@local> <alpine.BSF.2.00.1005221946290.44694@fledge.watson.org> <4bf8bc49.48c3f10a.3f38.fffff9a3SMTPIN_ADDED@mx.google.com> <F8A964E48CE74748956C958BAE200CDE@local> <4bf99eba.816bdc0a.7b15.fffff871SMTPIN_ADDED@mx.google.com> <A473849776154204BC7CB8C0AA202749@local> <E1OGK2s-0000Wu-Es@psg.com> Date: Sun, 23 May 2010 19:33:15 -0400 Message-ID: <AANLkTimQy-ujTZXb3a6ZsM5nAjCh6d5MdM7R-jHnFoff@mail.gmail.com> Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data From: Donald Eastlake <d3e3e3@gmail.com> To: Michael StJohns <mstjohns@comcast.net> Cc: George Barwood <george.barwood@blueyonder.co.uk>, Samuel Weiler <weiler@watson.org>, Andrew Sullivan <ajs@shinkuro.com>, namedroppers@ops.ietf.org Content-Type: multipart/alternative; boundary=0016e6dab02438b84604874b598a Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> --0016e6dab02438b84604874b598a Content-Type: text/plain; charset=ISO-8859-1 On Sun, May 23, 2010 at 6:53 PM, Michael StJohns <mstjohns@comcast.net>wrote: > ... > There is no way for good (validated) data to get to the client unless BOTH > have the same good TA or TA chains (for a local CD=0 to the upstream query > where the local has a TA covering the query). Why couldn't they have different TA's if the data is all signed by two algorithms/keys for example? > ... > Donald --0016e6dab02438b84604874b598a Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div class=3D"gmail_quote">On Sun, May 23, 2010 at 6:53 PM, Michael StJohns= <span dir=3D"ltr"><<a href=3D"mailto:mstjohns@comcast.net">mstjohns@com= cast.net</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style= =3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"> <div class=3D"im">...</div> There is no way for good (validated) data to get to the client unless BOTH = have the same good TA or TA chains (for a local CD=3D0 to the upstream quer= y where the local has a TA covering the query).</blockquote><div><br></div> <div>Why couldn't they have different TA's if the data is all signe= d by two algorithms/keys for example?</div><div>=A0</div><blockquote class= =3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd= ing-left:1ex;"> <div class=3D"im">...</div></blockquote><div><br></div><div>Donald=A0</div>= </div> --0016e6dab02438b84604874b598a-- From owner-namedroppers@ops.ietf.org Sun May 23 18:54:51 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 796583A6969; Sun, 23 May 2010 18:54:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.292 X-Spam-Level: ** X-Spam-Status: No, score=2.292 tagged_above=-999 required=5 tests=[AWL=-0.675, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IPKc8TW608q9; Sun, 23 May 2010 18:54:50 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7A3BC3A692D; Sun, 23 May 2010 18:54:50 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGMic-000HGW-CT for namedroppers-data0@psg.com; Mon, 24 May 2010 01:44:38 +0000 Message-Id: <E1OGMic-000HGW-CT@psg.com> Received: from [76.96.62.32] (helo=qmta03.westchester.pa.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <mstjohns@comcast.net>) id 1OGMiY-000HGC-SM for namedroppers@ops.ietf.org; Mon, 24 May 2010 01:44:35 +0000 Received: from omta16.westchester.pa.mail.comcast.net ([76.96.62.88]) by qmta03.westchester.pa.mail.comcast.net with comcast id MAa51e0021uE5Es53Dkb4M; Mon, 24 May 2010 01:44:35 +0000 Received: from Mike-PC3.comcast.net ([68.83.217.57]) by omta16.westchester.pa.mail.comcast.net with comcast id MDkY1e0081EtFYL3cDkYvW; Mon, 24 May 2010 01:44:34 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 23 May 2010 21:44:26 -0400 To: Donald Eastlake <d3e3e3@gmail.com> From: Michael StJohns <mstjohns@comcast.net> Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Cc: George Barwood <george.barwood@blueyonder.co.uk>, Samuel Weiler <weiler@watson.org>,Andrew Sullivan <ajs@shinkuro.com>, namedroppers@ops.ietf.org In-Reply-To: <AANLkTimQy-ujTZXb3a6ZsM5nAjCh6d5MdM7R-jHnFoff@mail.gmail.c om> References: <OFFD77B24F.1DBDAD9C-ON802576EF.007CD412-882576EF.0080592F@nominet.org.uk> <20100514195525.GL65855@shinkuro.com> <E1OD5Rj-0001Wc-FA@psg.com> <2CC6D6735E144D7EAF749B399E36F361@local> <alpine.BSF.2.00.1005221946290.44694@fledge.watson.org> <4bf8bc49.48c3f10a.3f38.fffff9a3SMTPIN_ADDED@mx.google.com> <F8A964E48CE74748956C958BAE200CDE@local> <4bf99eba.816bdc0a.7b15.fffff871SMTPIN_ADDED@mx.google.com> <A473849776154204BC7CB8C0AA202749@local> <E1OGK2s-0000Wu-Es@psg.com> <AANLkTimQy-ujTZXb3a6ZsM5nAjCh6d5MdM7R-jHnFoff@mail.gmail.com> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=====================_379998420==.ALT" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> --=====================_379998420==.ALT Content-Type: text/plain; charset="us-ascii" At 07:33 PM 5/23/2010, Donald Eastlake wrote: >On Sun, May 23, 2010 at 6:53 PM, Michael StJohns <<mailto:mstjohns@comcast.net>mstjohns@comcast.net> wrote: >... >There is no way for good (validated) data to get to the client unless BOTH have the same good TA or TA chains (for a local CD=0 to the upstream query where the local has a TA covering the query). > > >Why couldn't they have different TA's if the data is all signed by two algorithms/keys for example? > >... > > >Donald Sorry - trying to keep the discussion somewhat simple. There are a lot of iterations down the decision tree that really don't change things. Unless you can see one? While you're correct that each could have different (actually disjoint) TAs, in practice, they should be getting the TA sets from the same place. I guess its possible that different resolvers only cared about (implemented support for) one set of signature algorithms, but in practice - we're currently only using the one. But its fair to design for what's in the protocol. What's more probable is that the two different entities have different sets of Good, Bad or Mixed TAs within the trust point - due to differences when each picks up the TP (trust point) changes (e.g. 5011's 30day window ) or is otherwise configured. The ZSKs are probably the same, but the KSKs referenced by each TP aren't necessarily the same. I don't think it changes the analysis much if at all. You still need both the local and upstream resolvers to have non-bogus trust anchors at the trust point so they'll pass the data through. Contextually, that was the point of that specific set of paragraphs. If either or both have no non-bogus TAs you end up with a SERVFAIL. Mike --=====================_379998420==.ALT Content-Type: text/html; charset="us-ascii" <html> <body> At 07:33 PM 5/23/2010, Donald Eastlake wrote:<br> <blockquote type=cite class=cite cite="">On Sun, May 23, 2010 at 6:53 PM, Michael StJohns <<a href="mailto:mstjohns@comcast.net">mstjohns@comcast.net</a>> wrote:<br> <dl> <dd>...<br> <dd>There is no way for good (validated) data to get to the client unless BOTH have the same good TA or TA chains (for a local CD=0 to the upstream query where the local has a TA covering the query).<br><br> </dl><br> Why couldn't they have different TA's if the data is all signed by two algorithms/keys for example?<br>  <br> <dl> <dd>...<br><br> </dl><br> Donald </blockquote><br> Sorry - trying to keep the discussion somewhat simple.  There are a lot of iterations down the decision tree that really don't change things.  Unless you can see one?<br><br> While you're correct that each could have different (actually disjoint) TAs, in practice, they should be getting the TA sets from the same place.  I guess its possible that different resolvers only cared about  (implemented support for) one set of signature algorithms, but in practice - we're currently only using the one.  But its fair to design for what's in the protocol.<br><br> What's more probable is that the two different entities have different sets of Good, Bad or Mixed TAs within the trust point - due to differences when each picks up the TP (trust point) changes (e.g. 5011's 30day window ) or is otherwise configured.  The ZSKs are probably the same, but the KSKs referenced by each TP aren't necessarily the same.  <br><br> I don't think it changes the analysis much if at all.  You still need both the local and upstream resolvers to have non-bogus trust anchors at the trust point so they'll pass the data through. Contextually, that was the point of that specific set of paragraphs.   If either or both have no non-bogus TAs you end up with a SERVFAIL. <br><br> Mike<br><br> <br><br> </body> <br> </html> --=====================_379998420==.ALT-- From owner-namedroppers@ops.ietf.org Mon May 24 02:20:38 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 90A9E3A6CEB; Mon, 24 May 2010 02:20:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.8 X-Spam-Level: X-Spam-Status: No, score=-98.8 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_50=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BN0ix6V+xXDl; Mon, 24 May 2010 02:20:36 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id EBD273A6AB7; Mon, 24 May 2010 02:20:33 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGTk0-000DQV-5i for namedroppers-data0@psg.com; Mon, 24 May 2010 09:14:32 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <ondrej.sury@nic.cz>) id 1OGTjx-000DQ9-Av for namedroppers@ops.ietf.org; Mon, 24 May 2010 09:14:29 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id 79E2A734436; Mon, 24 May 2010 11:14:27 +0200 (CEST) Message-ID: <4BFA4373.40005@nic.cz> Date: Mon, 24 May 2010 11:14:27 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= <ondrej.sury@nic.cz> User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: Suzanne Woolf <woolf@isc.org> CC: Mark Andrews <marka@isc.org>, Alex Bligh <alex@alex.org.uk>, Vaggelis Segredakis <segred@ics.forth.gr>, 'Andrew Sullivan' <ajs@shinkuro.com>, namedroppers@ops.ietf.org, 'Sotiris Panaretou' <sotiris@ucy.ac.cy> Subject: [dnsext] Re: On adoption of two drafts References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <FDF10604930449659CE4C74BA469CEC2@ics.forth.gr> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <EACA79D85688A6B0BE5B0B46@host113.msm.che.vodafone> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <DFBB095877427C98807BC3E8@nimrod.local> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520151426.GA22640@farside.isc.org> In-Reply-To: <20100520151426.GA22640@farside.isc.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> On 20.5.2010 17:14, Suzanne Woolf wrote: > On Thu, May 20, 2010 at 10:43:12AM +1000, Mark Andrews wrote: >> We keep thinking "is this a solution >> to the idn tld problem" when we should be thinking is this a good >> tool to have in the tool chest. > > Mark, I think I agree with you in principle, but it would be helpful > if you (or anyone) could provide an example of a case where one or > another of the tools we've been discussing is "a good tool to have in > the tool chest" outside of the IDN context. I think it's buried somewhere deep in the list archive, but I have listed few examples: 1) For anybody with more than 1 domain name with same name (f.e. sury.name, sury.org, sury.cz) or (hp.cz, hp.com, hp.co.uk, hp.<anytld>). 2) Mass webhosting: webhoster creates base name: template1.webhosting.tld and aliases all it's customers using CNAME+DNAME or BNAME Imagine how simple would be to setup f.e. Google Apps with this, instead of creating all kind of weird records in your zone file. You would just create CNAME+DNAME at registrar level pointing to a.google.com. Ondrej -- OndÅ™ej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- LaboratoÅ™e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Mon May 24 03:25:01 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED7EB3A6B0F; Mon, 24 May 2010 03:25:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.65 X-Spam-Level: X-Spam-Status: No, score=-98.65 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_50=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xa9Q3IhNcdef; Mon, 24 May 2010 03:24:59 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2CCD33A6B27; Mon, 24 May 2010 03:24:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGUle-000Oag-Me for namedroppers-data0@psg.com; Mon, 24 May 2010 10:20:18 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <ondrej.sury@nic.cz>) id 1OGUlb-000OZz-LA for namedroppers@ops.ietf.org; Mon, 24 May 2010 10:20:16 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id 77817734438; Mon, 24 May 2010 12:20:13 +0200 (CEST) Message-ID: <4BFA52DD.4090009@nic.cz> Date: Mon, 24 May 2010 12:20:13 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= <ondrej.sury@nic.cz> User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: Florian Weimer <fw@deneb.enyo.de> CC: Suzanne Woolf <woolf@isc.org>, Mark Andrews <marka@isc.org>, Alex Bligh <alex@alex.org.uk>, Vaggelis Segredakis <segred@ics.forth.gr>, 'Andrew Sullivan' <ajs@shinkuro.com>, namedroppers@ops.ietf.org, 'Sotiris Panaretou' <sotiris@ucy.ac.cy> Subject: Re: [dnsext] Re: On adoption of two drafts References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <FDF10604930449659CE4C74BA469CEC2@ics.forth.gr> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <EACA79D85688A6B0BE5B0B46@host113.msm.che.vodafone> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <DFBB095877427C98807BC3E8@nimrod.local> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520151426.GA22640@farside.isc.org> <4BFA4373.40005@nic.cz> <87fx1h1vg5.fsf@mid.deneb.enyo.de> In-Reply-To: <87fx1h1vg5.fsf@mid.deneb.enyo.de> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> On 24.5.2010 11:48, Florian Weimer wrote: > * OndÅ™ej Surý: > >> 2) Mass webhosting: >> webhoster creates base name: template1.webhosting.tld >> and aliases all it's customers using CNAME+DNAME or BNAME > > Does this really work in practice because usually, you want mail to > work, too? RFC 1123 requires that CNAMEs are expanded by the sender, > so you can't be certain that your mail server gets the original name. I have never seen a MTA which did canonicalization (but that doesn't mean there isn't any). You can try it yourself, I have created: deneb.dname.cz. IN CNAME deneb.enyo.de. deneb.dname.cz. IN DNAME deneb.enyo.de. enyo.dname.cz. IN CNAME enyo.de. enyo.dname.cz. IN DNAME enyo.de. in my CNAME+DNAME test zone. So Postfix doesn't do anything to those names: <fw@deneb.enyo.dname.cz>: host ka.mail.enyo.de[87.106.162.201] said: 550 relaying denied (in reply to RCPT TO command) <fw@deneb.dname.cz>: host ka.mail.enyo.de[87.106.162.201] said: 550 relaying denied (in reply to RCPT TO command) Same with Gmail: Delivery to the following recipient failed permanently: fw@deneb.enyo.dname.cz Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 relaying denied (state 14). Delivery to the following recipient failed permanently: fw@deneb.dname.cz Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 relaying denied (state 14). Ondrej -- OndÅ™ej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- LaboratoÅ™e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Mon May 24 05:00:22 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 058BA3A6B53; Mon, 24 May 2010 05:00:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.096 X-Spam-Level: X-Spam-Status: No, score=-7.096 tagged_above=-999 required=5 tests=[AWL=-2.397, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, RCVD_IN_DNSWL_HI=-8, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sQU6ED3Q1oXT; Mon, 24 May 2010 05:00:20 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B149F3A6B82; Mon, 24 May 2010 05:00:20 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGWFp-000CCJ-7Z for namedroppers-data0@psg.com; Mon, 24 May 2010 11:55:33 +0000 Received: from [213.248.199.24] (helo=mx4.nominet.org.uk) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <Ray.Bellis@nominet.org.uk>) id 1OGWFm-000CBn-Od for namedroppers@ops.ietf.org; Mon, 24 May 2010 11:55:31 +0000 DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:Received:From:To:Subject: Thread-Topic:Thread-Index:Date:Message-ID:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: Content-Type:Content-ID:Content-Transfer-Encoding: MIME-Version; b=YCEIPNifXUjcuaoXLRuii68EY6eIzDrzNrXwByqBhhaVWnxiItmZMjhX Ry/3jBmbVFgmsMYXGMkFdTzrZci6FFj7vRNWfuFP6Opf31uqcjq2LOvFO n4B6jN/BPwwHf6r; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=Ray.Bellis@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1274702130; x=1306238130; h=from:sender:reply-to:subject:date:message-id:to:cc: mime-version:content-transfer-encoding:content-id: content-description:resent-date:resent-from:resent-sender: resent-to:resent-cc:resent-message-id:in-reply-to: references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:list-owner:list-archive; z=From:=20Ray=20Bellis=20<Ray.Bellis@nominet.org.uk> |Subject:=20DNS=20RFC=20Dependency=20graphs=20published |Date:=20Mon,=2024=20May=202010=2011:55:27=20+0000 |Message-ID:=20<C82027BF.55C6%ray.bellis@nominet.org.uk> |To:=20namedroppers=20<namedroppers@ops.ietf.org> |MIME-Version:=201.0|Content-Transfer-Encoding:=20quoted- printable|Content-ID:=20<97839147-bdb5-4d27-b94b-739e56cd 866b>; bh=OPja132V0sE6b12cwpFcB0p2DXBK3jRu6cA2gPu9Fa0=; b=giG1QJD3mHhoVKt/nYKOgtou6o4Zb5NjbEYvH/RFpZCKBNYNXqcRB44P +YiPiCYdfBs+NIgKz+KVNEoAbAIci5tdB7kc9QYC35UJEemdM6JN5NQuA c9t4FonxdpC4NVD; X-IronPort-AV: E=Sophos;i="4.53,291,1272841200"; d="scan'208";a="18846966" Received: from wds-exc2.okna.nominet.org.uk ([213.248.197.145]) by mx4.nominet.org.uk with ESMTP; 24 May 2010 12:55:28 +0100 Received: from WDS-EXC1.okna.nominet.org.uk ([fe80::1593:1394:a91f:8f5f]) by wds-exc2.okna.nominet.org.uk ([fe80::7577:eaca:5241:25d4%20]) with mapi; Mon, 24 May 2010 12:55:28 +0100 From: Ray Bellis <Ray.Bellis@nominet.org.uk> To: namedroppers <namedroppers@ops.ietf.org> Subject: [dnsext] DNS RFC Dependency graphs published Thread-Topic: DNS RFC Dependency graphs published Thread-Index: Acr7N//846emmjZpjUKv+Qlj8Y8slA== Date: Mon, 24 May 2010 11:55:27 +0000 Message-ID: <C82027BF.55C6%ray.bellis@nominet.org.uk> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="iso-8859-1" Content-ID: <97839147-bdb5-4d27-b94b-739e56cd866b> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> I've just published some RFC Dependency Graphs showing the current state of the DNS-related RFCs: Extract from http://blog.nominet.org.uk/tech/2010/05/24/436/ --8<--8<-- Spurred by a recent Slashdot posting, I=B9ve produced some graphs showing t= he relationships between the RFCs which define the DNS protocol. The graphs (which are in SVG format) split the DNS-related RFCs into three groups (although some RFCs end up in more than one group): * Core Protocol RFCs * Resource Record Definitions * DNS Operational Guidelines The point of these graphs is not to show which RFCs refer to other RFCs, bu= t to show which RFCs update or obsolete other RFCs. Hence the graphs give an =B3at a glance=B2 overview of which RFCs define the DNS protocol as it is n= ow. Boxes in red indicate obsoleted RFCs, and square boxes indicate Informational or Best Current Practice documents.=A0 Hovering over a box should tell you the title of the RFC, and clicking on a box will take you t= o the RFC itself. --8<--8<-- I hope you find them useful - source code and config files will follow at some point... Ray From owner-namedroppers@ops.ietf.org Mon May 24 05:44:52 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C44013A6B0C; Mon, 24 May 2010 05:44:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.6 X-Spam-Level: X-Spam-Status: No, score=-98.6 tagged_above=-999 required=5 tests=[AWL=-0.100, BAYES_50=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZRDtkhk6llfG; Mon, 24 May 2010 05:44:51 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8A5713A6B12; Mon, 24 May 2010 05:44:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGWxI-000JSl-Nf for namedroppers-data0@psg.com; Mon, 24 May 2010 12:40:28 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <ondrej.sury@nic.cz>) id 1OGWxF-000JS0-VL for namedroppers@ops.ietf.org; Mon, 24 May 2010 12:40:26 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id 8E2FD73447C; Mon, 24 May 2010 14:40:23 +0200 (CEST) Message-ID: <4BFA73B6.8080208@nic.cz> Date: Mon, 24 May 2010 14:40:22 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= <ondrej.sury@nic.cz> User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: Florian Weimer <fw@deneb.enyo.de> CC: Suzanne Woolf <woolf@isc.org>, Mark Andrews <marka@isc.org>, Alex Bligh <alex@alex.org.uk>, Vaggelis Segredakis <segred@ics.forth.gr>, 'Andrew Sullivan' <ajs@shinkuro.com>, namedroppers@ops.ietf.org, 'Sotiris Panaretou' <sotiris@ucy.ac.cy> Subject: username@xname handling in MTAs (Was: [dnsext] Re: On adoption of two drafts) References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <FDF10604930449659CE4C74BA469CEC2@ics.forth.gr> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <EACA79D85688A6B0BE5B0B46@host113.msm.che.vodafone> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <DFBB095877427C98807BC3E8@nimrod.local> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520151426.GA22640@farside.isc.org> <4BFA4373.40005@nic.cz> <87fx1h1vg5.fsf@mid.deneb.enyo.de> <4BFA52DD.4090009@nic.cz> <87632dziuu.fsf@mid.deneb.enyo.de> In-Reply-To: <87632dziuu.fsf@mid.deneb.enyo.de> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> On 24.5.2010 12:36, Florian Weimer wrote: > * OndÅ™ej Surý: > >> On 24.5.2010 11:48, Florian Weimer wrote: >>> * OndÅ™ej Surý: >>> >>>> 2) Mass webhosting: >>>> webhoster creates base name: template1.webhosting.tld >>>> and aliases all it's customers using CNAME+DNAME or BNAME >>> >>> Does this really work in practice because usually, you want mail to >>> work, too? RFC 1123 requires that CNAMEs are expanded by the sender, >>> so you can't be certain that your mail server gets the original name. >> >> I have never seen a MTA which did canonicalization (but that doesn't >> mean there isn't any). > > Sendmail does it by default. Yep, you're right. I have just tested that. Hence my example with mass hosting is not usable. That's great to have not only different protocols handling CNAME differently, but also different MTAs handling CNAME differently. BTW this applies to IDN usage of BNAME as well, since there is CNAME expansion for non-complying clients. And if you alias two trees there will be some matches for sure. Ondrej -- OndÅ™ej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- LaboratoÅ™e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Mon May 24 06:38:23 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 20CA83A6E13; Mon, 24 May 2010 06:38:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.217 X-Spam-Level: X-Spam-Status: No, score=-1.217 tagged_above=-999 required=5 tests=[AWL=-0.518, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mZJVraxPVt9S; Mon, 24 May 2010 06:38:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C6D063A6C09; Mon, 24 May 2010 06:38:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGXll-00020I-Vi for namedroppers-data0@psg.com; Mon, 24 May 2010 13:32:37 +0000 Received: from [131.111.8.132] (helo=ppsw-32.csi.cam.ac.uk) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <fanf2@hermes.cam.ac.uk>) id 1OGXlj-0001zs-Bk for namedroppers@ops.ietf.org; Mon, 24 May 2010 13:32:35 +0000 X-Cam-AntiVirus: no malware found X-Cam-SpamDetails: not scanned X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/ Received: from hermes-2.csi.cam.ac.uk ([131.111.8.54]:36077) by ppsw-32.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.158]:25) with esmtpa (EXTERNAL:fanf2) id 1OGXld-0001pU-9y (Exim 4.70) (return-path <fanf2@hermes.cam.ac.uk>); Mon, 24 May 2010 14:32:29 +0100 Received: from fanf2 (helo=localhost) by hermes-2.csi.cam.ac.uk (hermes.cam.ac.uk) with local-esmtp id 1OGXld-0006cn-2b (Exim 4.67) (return-path <fanf2@hermes.cam.ac.uk>); Mon, 24 May 2010 14:32:29 +0100 Date: Mon, 24 May 2010 14:32:29 +0100 From: Tony Finch <dot@dotat.at> X-X-Sender: fanf2@hermes-2.csi.cam.ac.uk To: "Damick, Jeffrey" <Jeffrey.Damick@neustar.biz> cc: YAO Jiankang <yaojk@cnnic.cn>, David Conrad <drc@virtualized.org>, Andrew Sullivan <ajs@shinkuro.com>, "namedroppers@ops.ietf.org" <namedroppers@ops.ietf.org> Subject: Re: [dnsext] One chair's focus (was: On adoption of two drafts) In-Reply-To: <C81C65ED.1E57%jeffrey.damick@neustar.biz> Message-ID: <alpine.LSU.2.00.1005241431580.28459@hermes-2.csi.cam.ac.uk> References: <C81C65ED.1E57%jeffrey.damick@neustar.biz> User-Agent: Alpine 2.00 (LSU 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> On Fri, 21 May 2010, Damick, Jeffrey wrote: > We (UltraDNS) have also developed a feature that is very similar to the > BNAME proposal. So I will just throw our particular use case into the > mix.. > > Customers want to create an alias for an existing (primary) domain such > that they can modify a (primary) domain and all changes will be > reflected in the results from any alias domains. The results are then > sent back as if they belong to the alias domain. Isn't that more like the zone clone proposal, not the BNAME proposal? Tony. -- f.anthony.n.finch <dot@dotat.at> http://dotat.at/ ROCKALL MALIN: MAINLY NORTHEASTERLY 4 OR 5, OCCASIONALLY 6 EXCEPT IN NORTHWEST ROCKALL. SLIGHT OR MODERATE. SHOWERS. MODERATE OR GOOD. From owner-namedroppers@ops.ietf.org Mon May 24 10:21:31 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C37D23A6848; Mon, 24 May 2010 10:21:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.652 X-Spam-Level: ** X-Spam-Status: No, score=2.652 tagged_above=-999 required=5 tests=[AWL=-0.913, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, J_CHICKENPOX_22=0.6, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q3FzbuP6ZLuK; Mon, 24 May 2010 10:21:30 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BDF253A6CB9; Mon, 24 May 2010 10:21:23 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGbEF-000Bwb-Tg for namedroppers-data0@psg.com; Mon, 24 May 2010 17:14:15 +0000 Message-Id: <E1OGbEF-000Bwb-Tg@psg.com> Received: from [76.96.62.32] (helo=qmta03.westchester.pa.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <mstjohns@comcast.net>) id 1OGbEB-000Bw7-6E for namedroppers@ops.ietf.org; Mon, 24 May 2010 17:14:11 +0000 Received: from omta13.westchester.pa.mail.comcast.net ([76.96.62.52]) by qmta03.westchester.pa.mail.comcast.net with comcast id MU7w1e00617dt5G53VEBRC; Mon, 24 May 2010 17:14:11 +0000 Received: from Mike-PC3.comcast.net ([68.83.217.57]) by omta13.westchester.pa.mail.comcast.net with comcast id MVE81e00E1EtFYL3ZVE9d3; Mon, 24 May 2010 17:14:10 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 24 May 2010 13:14:02 -0400 To: "George Barwood" <george.barwood@blueyonder.co.uk>, "Samuel Weiler" <weiler@watson.org> From: Michael StJohns <mstjohns@comcast.net> Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Cc: "Andrew Sullivan" <ajs@shinkuro.com>,<namedroppers@ops.ietf.org> In-Reply-To: <A7A3280D4DDA4530986F0F57EAD1509B@local> References: <OFFD77B24F.1DBDAD9C-ON802576EF.007CD412-882576EF.0080592F@nominet.org.uk> <A9136EBA-B023-4262-9885-EB58324F65E4@kirei.se> <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <OF4E2F5E74.7653D184-ON802576F2.00530E07-882576F2.005354EC@nominet.org.uk> <alpine.BSF.2.00.1003271901040.75904@fledge.watson.org> <20100514135457.GA65855@shinkuro.com> <auto-000018612361@execdsl.com> <20100514195525.GL65855@shinkuro.com> <E1OD5Rj-0001Wc-FA@psg.com> <2CC6D6735E144D7EAF749B399E36F361@local> <alpine.BSF.2.00.1005221946290.44694@fledge.watson.org> <4bf8bc49.48c3f10a.3f38.fffff9a3SMTPIN_ADDED@mx.google.com> <F8A964E48CE74748956C958BAE200CDE@local> <4bf99eba.816bdc0a.7b15.fffff871SMTPIN_ADDED@mx.google.com> <A473849776154204BC7CB8C0AA202749@local> <4bf9b1d6.093fdc0a.68c9.ffffbed1SMTPIN_ADDED@mx.google.com> <A7A3280D4DDA4530986F0F57EAD1509B@local> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> At 01:04 AM 5/24/2010, George Barwood wrote: I was responding to your "let's use CD=0", but if you want to talk about "CD=1" so be it. >> >> *sigh* OK - we're really out in left field here. And I don't mean to pick on you, but your logic chain is broken. >> >> 1) If EITHER of them has a bogus trust anchor - forged or otherwise, the client gets a SERVFAIL, even if one of them has a non-bogus trust anchor. So hoping that one of them has a non-bogus trust anchor is really not all that useful. BOTH need a non-bogus TA to be useful. > >Nope. If the local resolver has a bogus trust anchor (i.e. an attacker has managed to insert this anchor) >and it sends a CD=1 query to it's upstream, then the local resolver can get RC=Ok, but the data is >actually the attackers data. This attack is prevented by using CD=0 on the upstream query ( unless >of course the attacker has also managed to insert the bogus anchor in the upstream resolver ). The attack is prevented - IN THIS ONE SPECIFIC CASE - if and only if ALL of these conditions are true: a) The local resolver has a maliciously bogus TA that validates the data b) The local resolver doesn't set the CD bit in the upstream query c) An upstream resolver actually exists d) The upstream resolver was actually asked to resolve this query e) The upstream resolver didn't also have the same bogus TA f) The bogus data wasn't inserted below the upstream resolver - the local resolver didn't get the bogus answer first from someone closer The key point above is (e) - if my local resolver has a bogus trust anchor for data, the attacker simply needs to get the response to me before the upstream resolver. So doing it your way doesn't actually provide any additional protection and doesn't act as suspenders to the local DNSSEC belt. Still not sure why an attacker would do (a) and not mess with the local resolver in other ways. >> 2) If you don't trust either, then create a client set of TAs and have your client set the CD on all of its upstream queries including the initial one to the local resolver. > >You have not appreciated that trust is not an absolute. Practical security proceeds by having multiple >layers, none of which are completely secure, but each layer gives an additional obstacle for an attacker to overcome. I appreciate this. Been doing it for quite a long while. But you're treating the upstream resolver as another "firewall" with an absolute application of its rules. As I've said multiple times before, you can't make this assumption. Absent specific configuration, the local resolver has NO idea of whether or not there is an upstream validating resolver and whether further validation will be done. It can't actually discover this, because queries can be redirected at layer 3 for example. So I'm working on the specific case of "what does the local resolver know, and how can the local resolver get the 'best' results with what it knows?" >You are suggesting that checking be disabled by default on upstream queries. >The onus is on you to show that this does not have negative security implications. I'm suggesting the CD bit be set on upstream queries covered by a local TA, not on all queries. And actually, the onus is on both of us to show that our approach is "best" for some value of best. 4035 doesn't describe the setting of the CD bit in the case of a local trust anchor covering the query. This is what this discussion is about. With respect to "negative security implications", I'm also including in it "denial of service" or "availability" - as in the inability of the local resolver to bypass a broken upstream to be able to return data to its clients as a possible negative security implication. You seem to be of the opinion that this is a bad idea. Not sure why. >> >>>Another point ( that occurred to me after my previous post ) is that even if you have a trust anchor ( say for <root> ), there may be a break in the authentication chain, but the upstream may have a trust anchor that cures that. >> >> No, it doesn't. If you have a break in the local, then you get a SERVFAIL from the local, regardless of what you get from the upstream. > >No : a break does not cause SERVERFAIL, it causes Insecure (AD=0 in the response). A break can be either because >a parent does not yet allow DS records to be uploaded, or because the local resolver doesn't support >an algorithm necessary for the authentication chain to be completed. I think we're reading different RFC4035s. If I send a query upstream WITHOUT the CD bit set and with the AD bit set, if the upstream does a validation of the data and the validation fails, I get an RCODE 2 - SERVFAIL. - RFC4035, section 5.5. If I send a query upstream WITH the CD and DO bits set (and per -11 or the AD bit set), I may get data returned with the AD bit set, but if the AD bit is cleared, all that means the data is unvalidated (NOT necessarily bogus) - either because it came from the auth server, or an upstream validating resolver didn't have a covering TA. I can't infer either. >In either case this condition may be resolved by the upstream resolver, affording more security than otherwise. In either case this condition may be exacerbated by the upstream resolver, affording less availability than otherwise and causing DNSSEC to be yanked out by its roots by resolver operators who need DNS data more than validated DNS data. >George > > >[ rest snipped] From owner-namedroppers@ops.ietf.org Mon May 24 11:46:21 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 437773A6CB2; Mon, 24 May 2010 11:46:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.429 X-Spam-Level: ** X-Spam-Status: No, score=2.429 tagged_above=-999 required=5 tests=[AWL=-0.537, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x7C8My9mv80b; Mon, 24 May 2010 11:46:20 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 33E093A6C8A; Mon, 24 May 2010 11:46:20 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGcZf-0000jK-1V for namedroppers-data0@psg.com; Mon, 24 May 2010 18:40:27 +0000 Message-Id: <E1OGcZf-0000jK-1V@psg.com> Received: from [76.96.62.17] (helo=qmta10.westchester.pa.mail.comcast.net) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <mstjohns@comcast.net>) id 1OGcZa-0000ih-1M for namedroppers@ops.ietf.org; Mon, 24 May 2010 18:40:22 +0000 Received: from omta15.westchester.pa.mail.comcast.net ([76.96.62.87]) by qmta10.westchester.pa.mail.comcast.net with comcast id MP4f1e0041swQuc5AWgNxv; Mon, 24 May 2010 18:40:22 +0000 Received: from Mike-PC3.comcast.net ([68.83.217.57]) by omta15.westchester.pa.mail.comcast.net with comcast id MWgK1e00W1EtFYL3bWgLJQ; Mon, 24 May 2010 18:40:22 +0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 24 May 2010 14:40:13 -0400 To: "George Barwood" <george.barwood@blueyonder.co.uk>, "Samuel Weiler" <weiler@watson.org> From: Michael StJohns <mstjohns@comcast.net> Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data Cc: "Andrew Sullivan" <ajs@shinkuro.com>,<namedroppers@ops.ietf.org> In-Reply-To: <FBC047AD39344A33AD0A1CB0B681E182@local> References: <OFFD77B24F.1DBDAD9C-ON802576EF.007CD412-882576EF.0080592F@nominet.org.uk> <A9136EBA-B023-4262-9885-EB58324F65E4@kirei.se> <101.1269535070@nsa.vix.com> <4BAC7776.3090106@nlnetlabs.nl> <OF4E2F5E74.7653D184-ON802576F2.00530E07-882576F2.005354EC@nominet.org.uk> <alpine.BSF.2.00.1003271901040.75904@fledge.watson.org> <20100514135457.GA65855@shinkuro.com> <auto-000018612361@execdsl.com> <20100514195525.GL65855@shinkuro.com> <E1OD5Rj-0001Wc-FA@psg.com> <2CC6D6735E144D7EAF749B399E36F361@local> <alpine.BSF.2.00.1005221946290.44694@fledge.watson.org> <4bf8bc49.48c3f10a.3f38.fffff9a3SMTPIN_ADDED@mx.google.com> <F8A964E48CE74748956C958BAE200CDE@local> <4bf99eba.816bdc0a.7b15.fffff871SMTPIN_ADDED@mx.google.com> <A473849776154204BC7CB8C0AA202749@local> <4bf9b1d6.093fdc0a.68c9.ffffbed1SMTPIN_ADDED@mx.google.com> <A7A3280D4DDA4530986F0F57EAD1509B@local> <4bfab3e2.1ac1f10a.3b92.3248SMTPIN_ADDED@mx.google.com> <FBC047AD39344A33AD0A1CB0B681E182@local> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> At 02:03 PM 5/24/2010, George Barwood wrote: >Right, but seems to be missing the point. >I will give an example that is reasonably realistic, to see if that helps. > >In July, I configure a device (maybe some kind of backup device) at our company office. >It's a "black box", auto-configured to use the local (validating) forwarder(s), but it also performs >local authentication. > >Two years later, some TLD is signed with a new algorithm, to say allow a transition to BNAME, or whatever. >The local validating forwarder(s) are updated to the new algorithm, but unfortunately no update is >available for the old device (the company has gone bust). If the device is using CD=0 on it's >upstream queries, I'm still fairly happy that a decent level of security is in place ( the local network >has good physical security ). However if the device is using CD=1 on it's upstream, it's no good. >I will either have to throw it away or live with no DNSSEC for the TLD in question - and that's >assuming I even remember that the device exists, and there is a potential security issue. If you set CD=1 on the upstream (because the black box has a covering TA), the raw data comes to the black box and the box starts dropping data on the floor, because it can't validate it. You, as the local operator - responding to client complaints, now delete the non-usable Trust Anchors and the box starts using CD=0 for those previously covered queries. If there's an upstream validator, validation is done, otherwise the unvalidated data is passed to the client. Worse is if the upstream resolver is a black box and you don't set CD=1 on the upstream. All of the sudden you start getting SERVFAIL and you can't actually track down who owns that black box. If you have no way of setting the CD bit in the upstream, you can be really screwed. So - got a better example? Mike From owner-namedroppers@ops.ietf.org Mon May 24 14:24:46 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 32E0E3A67F8; Mon, 24 May 2010 14:24:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.795 X-Spam-Level: X-Spam-Status: No, score=-2.795 tagged_above=-999 required=5 tests=[AWL=-0.958, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tU5HPM1uW4Ld; Mon, 24 May 2010 14:24:38 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7D90F3A68DC; Mon, 24 May 2010 14:24:37 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGf1N-000PDH-E2 for namedroppers-data0@psg.com; Mon, 24 May 2010 21:17:13 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <dotis@mail-abuse.org>) id 1OGf1K-000PC3-Lr for namedroppers@ops.ietf.org; Mon, 24 May 2010 21:17:10 +0000 Received: from sjc-office-nat-210.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 20FD0A945CD; Mon, 24 May 2010 21:17:10 +0000 (UTC) Message-ID: <4BFAECD5.6030604@mail-abuse.org> Date: Mon, 24 May 2010 14:17:09 -0700 From: Douglas Otis <dotis@mail-abuse.org> User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Tony Finch <dot@dotat.at> CC: "Damick, Jeffrey" <Jeffrey.Damick@neustar.biz>, YAO Jiankang <yaojk@cnnic.cn>, David Conrad <drc@virtualized.org>, Andrew Sullivan <ajs@shinkuro.com>, "namedroppers@ops.ietf.org" <namedroppers@ops.ietf.org> Subject: Re: [dnsext] One chair's focus (was: On adoption of two drafts) References: <C81C65ED.1E57%jeffrey.damick@neustar.biz> <alpine.LSU.2.00.1005241431580.28459@hermes-2.csi.cam.ac.uk> In-Reply-To: <alpine.LSU.2.00.1005241431580.28459@hermes-2.csi.cam.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> On 5/24/10 6:32 AM, Tony Finch wrote: > On Fri, 21 May 2010, Damick, Jeffrey wrote: > > >> We (UltraDNS) have also developed a feature that is very similar to the >> BNAME proposal. So I will just throw our particular use case into the >> mix.. >> >> Customers want to create an alias for an existing (primary) domain such >> that they can modify a (primary) domain and all changes will be >> reflected in the results from any alias domains. The results are then >> sent back as if they belong to the alias domain. >> > Isn't that more like the zone clone proposal, not the BNAME proposal? > The Amber/Shadow zone does not represent aliased names of an Amber zone, unlike the BNAME proposal. see: http://tools.ietf.org/html/draft-vixie-dnsext-dnsshadow-00 The BNAME proposal defines an RR type that offers an alias for itself and all lower nodes. see: http://tools.ietf.org/html/draft-yao-dnsext-bname-01 The BNAME proposal may require more language to better define how synthesized CNAMEs are to be swallowed by BNAME RRs. The table at 4.2 c is amended by a subsequent sentence relating to when a CNAME is to be expunged. It also seems extended queries may find non-uniform results, which might also lead to caching conflicts. -Doug From owner-namedroppers@ops.ietf.org Mon May 24 17:39:42 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E50133A68C0; Mon, 24 May 2010 17:39:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.185 X-Spam-Level: X-Spam-Status: No, score=-0.185 tagged_above=-999 required=5 tests=[BAYES_40=-0.185] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fcmSLEghuGr8; Mon, 24 May 2010 17:39:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CC8993A67A4; Mon, 24 May 2010 17:39:41 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGi3h-000OBT-LK for namedroppers-data0@psg.com; Tue, 25 May 2010 00:31:49 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <jabley@hopcount.ca>) id 1OGi3e-000OB9-LL for namedroppers@ops.ietf.org; Tue, 25 May 2010 00:31:46 +0000 Received: from [195.13.7.35] (helo=surfer-30-0-162.surfnet.iacbox) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from <jabley@hopcount.ca>) id 1OGi3b-000K93-2D for namedroppers@ops.ietf.org; Tue, 25 May 2010 00:31:45 +0000 From: Joe Abley <jabley@hopcount.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Subject: [dnsext] draft-kerr-ixfr-only-01, or something more general? Date: Tue, 25 May 2010 02:31:32 +0200 Message-Id: <36D6143D-E9C3-4AB9-9898-CA64ABA8D82A@hopcount.ca> To: namedroppers WG <namedroppers@ops.ietf.org> Mime-Version: 1.0 (Apple Message framework v1078) X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 195.13.7.35 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> Hi all, There are other potential extensions or modifications to IXFR/AXFR. = Someone mentioned a use-case for IXFR-ONLY where a slave server might = prefer some out-of-protocol synchronisation mechanism (e.g. rsync) in = preference to an AXFR. I've heard musings before about the use of = compression with zone transfers, of which there is more than one choice = of algorithm. I've heard of people interested in confidentiality of zone = transfers, and algorithm agility for encryption seems necessary if = you're going support encryption at all. Does it make sense to re-consider the trend of AXFR, IXFR, IXFR-ONLY and = other future variants as separate QTYPEs, and instead consider a more = general XFR QTYPE which is extensible? Perhaps something that supports = some form of capability negotiation between master and slave? Something = that would allow a client to express a richer set of desires than just = "AXFR please", "IXFR please, but AXFR will do" or "IXFR only"? This is not a new idea; I'm quite sure I heard it from someone else (but = I forget who, or where, or when). Joe= From owner-namedroppers@ops.ietf.org Mon May 24 21:35:12 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1C8773A6A79; Mon, 24 May 2010 21:35:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.796 X-Spam-Level: ** X-Spam-Status: No, score=2.796 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_JP=1.244, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UEkiV6qon6Bg; Mon, 24 May 2010 21:35:11 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 064B93A68C7; Mon, 24 May 2010 21:35:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGlkg-0001K5-4I for namedroppers-data0@psg.com; Tue, 25 May 2010 04:28:26 +0000 Received: from [131.112.32.132] (helo=necom830.hpcl.titech.ac.jp) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from <mohta@necom830.hpcl.titech.ac.jp>) id 1OGlkd-0001JY-JX for namedroppers@ops.ietf.org; Tue, 25 May 2010 04:28:24 +0000 Received: (qmail 31398 invoked from network); 25 May 2010 04:45:21 -0000 Received: from bmdi2093.bmobile.ne.jp (HELO ?202.221.174.93?) (202.221.174.93) by necom830.hpcl.titech.ac.jp with SMTP; 25 May 2010 04:45:21 -0000 Message-ID: <4BFB51A3.5030409@necom830.hpcl.titech.ac.jp> Date: Tue, 25 May 2010 13:27:15 +0900 From: Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Joe Abley <jabley@hopcount.ca> CC: namedroppers WG <namedroppers@ops.ietf.org> Subject: Re: [dnsext] draft-kerr-ixfr-only-01, or something more general? References: <36D6143D-E9C3-4AB9-9898-CA64ABA8D82A@hopcount.ca> In-Reply-To: <36D6143D-E9C3-4AB9-9898-CA64ABA8D82A@hopcount.ca> Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> (2010/05/25 9:31), Joe Abley wrote: > I've heard of people interested in confidentiality of zone transfers, > and algorithm agility for encryption seems necessary if you're going > support encryption at all. You had better work on confidentiality of DNSSEC. Masataka Ohta From owner-namedroppers@ops.ietf.org Tue May 25 02:10:48 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BAF223A6EA2; Tue, 25 May 2010 02:10:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iLBa1+WX17mn; Tue, 25 May 2010 02:10:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A46CE3A6ADB; Tue, 25 May 2010 02:10:45 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGq4s-000ElM-A3 for namedroppers-data0@psg.com; Tue, 25 May 2010 09:05:34 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <jabley@hopcount.ca>) id 1OGq4p-000Eko-Ir for namedroppers@ops.ietf.org; Tue, 25 May 2010 09:05:31 +0000 Received: from [196.200.216.101] (helo=wifi-216-101.mtg.afnog.org) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from <jabley@hopcount.ca>) id 1OGq4g-000Agl-6w; Tue, 25 May 2010 09:05:28 +0000 Subject: Re: [dnsext] draft-kerr-ixfr-only-01, or something more general? Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley <jabley@hopcount.ca> In-Reply-To: <4BFB51A3.5030409@necom830.hpcl.titech.ac.jp> Date: Tue, 25 May 2010 11:05:08 +0200 Cc: namedroppers WG <namedroppers@ops.ietf.org> Content-Transfer-Encoding: 7bit Message-Id: <46393C50-ED72-4165-A2ED-77777D8FD03A@hopcount.ca> References: <36D6143D-E9C3-4AB9-9898-CA64ABA8D82A@hopcount.ca> <4BFB51A3.5030409@necom830.hpcl.titech.ac.jp> To: Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp> X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 196.200.216.101 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> On 2010-05-25, at 06:27, Masataka Ohta wrote: > (2010/05/25 9:31), Joe Abley wrote: > >> I've heard of people interested in confidentiality of zone transfers, >> and algorithm agility for encryption seems necessary if you're going >> support encryption at all. > > You had better work on confidentiality of DNSSEC. Thanks, I'll get right on that. Joe From owner-namedroppers@ops.ietf.org Tue May 25 06:34:55 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 70D693A70E8; Tue, 25 May 2010 06:34:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.992 X-Spam-Level: * X-Spam-Status: No, score=1.992 tagged_above=-999 required=5 tests=[AWL=-0.113, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I+UFBYepao6N; Tue, 25 May 2010 06:34:50 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id ABF123A70BF; Tue, 25 May 2010 06:34:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGu7h-0004Vh-3S for namedroppers-data0@psg.com; Tue, 25 May 2010 13:24:45 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <Ed.Lewis@neustar.biz>) id 1OGu7d-0004V6-9H for namedroppers@ops.ietf.org; Tue, 25 May 2010 13:24:41 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4PDOUJT082565; Tue, 25 May 2010 09:24:31 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [10.31.200.147] by Work-Laptop-2.local (PGP Universal service); Tue, 25 May 2010 09:24:37 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Tue, 25 May 2010 09:24:37 -0400 Mime-Version: 1.0 Message-Id: <a06240800c8217a8a9281@[192.168.1.104]> In-Reply-To: <36D6143D-E9C3-4AB9-9898-CA64ABA8D82A@hopcount.ca> References: <36D6143D-E9C3-4AB9-9898-CA64ABA8D82A@hopcount.ca> Date: Tue, 25 May 2010 09:16:53 -0400 To: namedroppers WG <namedroppers@ops.ietf.org> From: Edward Lewis <Ed.Lewis@neustar.biz> Subject: [dnsext] something more general? (was kerr-...) Cc: ed.lewis@neustar.biz Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> At 2:31 +0200 5/25/10, Joe Abley wrote: >Hi all, > >There are other potential extensions or modifications to IXFR/AXFR. Someone >mentioned a use-case for IXFR-ONLY where a slave server might prefer some >out-of-protocol synchronisation mechanism (e.g. rsync) in preference to an >AXFR. I've heard musings before about the use of compression with zone >transfers, of which there is more than one choice of algorithm. I've heard >of people interested in confidentiality of zone transfers, and algorithm >agility for encryption seems necessary if you're going support encryption >at all. FWIW, I mentioned on the list the desire to use IXFR or out-of-band (but I won't claim it as my idea). Before we get too excited about trying to capture all the tricks used or desired in operations, we don't have to document every possible way of transferring a zone - there's lots of other things that haven't been documented in DNS. (Such as "split" or incoherent DNS.) As far as "encrypting" zone transfers, I have one word "use VPNs." (;)) >Does it make sense to re-consider the trend of AXFR, IXFR, IXFR-ONLY and >other future variants as separate QTYPEs, and instead consider a more >general XFR QTYPE which is extensible? Perhaps something that supports >some form of capability negotiation between master and slave? Something >that would allow a client to express a richer set of desires than just >"AXFR please", "IXFR please, but AXFR will do" or "IXFR only"? When it comes to operating zone transfers, which we do a lot of, there have been no "gee I wish the protocol would do this differently" moments. XFRs are like babies - little bundles of joy that poop a lot in the diaper but still you wouldn't change a thing. OTOH there is one desire that comes up from time to time to have a means of synthesizing answers on the fly in a manner richer than what wild cards offer. The design bottleneck is the transfer of the synthesis rules. (RXFR - Rules Transfer?) >This is not a new idea; I'm quite sure I heard it from someone else (but >I forget who, or where, or when). Probably Shakespeare. Or Einstein. Or Foghorn Leghorn. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Tue May 25 06:54:44 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 893FC3A6BC3; Tue, 25 May 2010 06:54:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.725 X-Spam-Level: ** X-Spam-Status: No, score=2.725 tagged_above=-999 required=5 tests=[AWL=0.115, BAYES_40=-0.185, FH_RELAY_NODNS=1.451, HELO_EQ_JP=1.244, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wqPz9+ufGP-v; Tue, 25 May 2010 06:54:43 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 004FE3A6CEB; Tue, 25 May 2010 06:54:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGuUp-0009Nb-6L for namedroppers-data0@psg.com; Tue, 25 May 2010 13:48:39 +0000 Received: from [131.112.32.132] (helo=necom830.hpcl.titech.ac.jp) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from <mohta@necom830.hpcl.titech.ac.jp>) id 1OGuUl-0009LO-KM for namedroppers@ops.ietf.org; Tue, 25 May 2010 13:48:36 +0000 Received: (qmail 60578 invoked from network); 25 May 2010 14:05:38 -0000 Received: from softbank219001188004.bbtec.net (HELO ?192.168.1.27?) (219.1.188.4) by necom830.hpcl.titech.ac.jp with SMTP; 25 May 2010 14:05:38 -0000 Message-ID: <4BFBD4EF.4000100@necom830.hpcl.titech.ac.jp> Date: Tue, 25 May 2010 22:47:27 +0900 From: Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Joe Abley <jabley@hopcount.ca> CC: namedroppers WG <namedroppers@ops.ietf.org> Subject: Re: [dnsext] draft-kerr-ixfr-only-01, or something more general? References: <36D6143D-E9C3-4AB9-9898-CA64ABA8D82A@hopcount.ca> <4BFB51A3.5030409@necom830.hpcl.titech.ac.jp> <46393C50-ED72-4165-A2ED-77777D8FD03A@hopcount.ca> In-Reply-To: <46393C50-ED72-4165-A2ED-77777D8FD03A@hopcount.ca> Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> (2010/05/25 18:05), Joe Abley wrote: >>> I've heard of people interested in confidentiality of zone transfers, >>> and algorithm agility for encryption seems necessary if you're going >>> support encryption at all. >> >> You had better work on confidentiality of DNSSEC. > > Thanks, I'll get right on that. Good luck, you stupid. Masataka Ohta From owner-namedroppers@ops.ietf.org Tue May 25 07:26:02 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2F8AF3A71EF; Tue, 25 May 2010 07:26:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.339 X-Spam-Level: * X-Spam-Status: No, score=1.339 tagged_above=-999 required=5 tests=[AWL=-0.767, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Bxo5gPPi2Wu; Tue, 25 May 2010 07:26:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 952F23A7344; Tue, 25 May 2010 07:23:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGuxl-000FNn-Sw for namedroppers-data0@psg.com; Tue, 25 May 2010 14:18:33 +0000 Received: from [209.85.160.180] (helo=mail-gy0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <brian.peter.dickson@gmail.com>) id 1OGuxh-000FNL-48 for namedroppers@ops.ietf.org; Tue, 25 May 2010 14:18:29 +0000 Received: by gyb13 with SMTP id 13so2726367gyb.11 for <namedroppers@ops.ietf.org>; Tue, 25 May 2010 07:18:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:date:message-id :subject:from:to:cc:content-type; bh=o4Nm1lGz12OLZoPFoPc1YtdSFgKbX4791JodYUAOybY=; b=pN18Xq87ijsK5sMTMXvLEgVhXot38BDvGyPfV4XgDDRvlGISrqUfv7W+h59T5CsyRc 6fDNt0sjUn50QTeCaPP1mB9VaGJEpVvL3N/UlYyiPZRdn4szVQIv8M9hJuOs1CxffpqV XDA6T4VIL8re99N9vvLcObtiljohuIGkaaVx4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type; b=A6056a6n59kO9WRYJJ7lGPsQSwjJAWm8N2C+b0iibgTCldRrnzGBuCICLF+VujPc40 rH3ezWgjeOQcROuHtZRs7umfJ9WnGEvT9vO1lvIadDgrcaW/qF6dxcVNRRkBIgoytPh8 T1V9Kf7eW3APmIzE1hZyjfCnYw8JKzf4JLbRY= MIME-Version: 1.0 Received: by 10.101.133.30 with SMTP id k30mr8438021ann.42.1274797108019; Tue, 25 May 2010 07:18:28 -0700 (PDT) Received: by 10.100.163.17 with HTTP; Tue, 25 May 2010 07:18:27 -0700 (PDT) Date: Tue, 25 May 2010 11:18:27 -0300 Message-ID: <AANLkTin2SN-194C0RY4Ni2mi2VCWk19sp18mMqVasQmw@mail.gmail.com> Subject: [dnsext] Second-order effects (was: One chair's focus) From: Brian Dickson <brian.peter.dickson@gmail.com> To: Andrew Sullivan <ajs@shinkuro.com> Cc: namedroppers@ops.ietf.org Content-Type: multipart/alternative; boundary=0016e68ef470c8c1f804876bd46d Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> --0016e68ef470c8c1f804876bd46d Content-Type: text/plain; charset=ISO-8859-1 On Wed, May 19, 2010 at 11:58 PM, Andrew Sullivan <ajs@shinkuro.com> wrote: > Speaking only for myself. > > > The questions I see before us come down to these: > > 1. Is there a problem? > > 2. Is it one that can't be solved already? > > 3. Is it something we are in a position to solve? (How completely?) > > 4. What are the consequences of solving it? > > At the risk of invoking meta-discussion... I think one thing we should all keep in mind, is the consequences of what we do here, which are second-order effects - those things which are the logical results, but not necessarily obvious. For example, we may provide solutions to IDN requirements, and we may provide solutions for DNSSEC. However, if in our choice of solutions for these, we don't take into consideration that a non-trivial portion of those who want or need to have both at the same time, i.e. DNSSEC IDN's, we risk putting those folks in a difficult position. Those using IDNs likely see those are essential, or at least necessary. They may not have as strong a need or desire for DNSSEC. If DNSSEC is more difficult, or more expensive, for those using IDNs, this could act as a barrier to widescale deployment of DNSSEC. Or worse, it could be seen as a slight by us, against the IDN community. The main issue I can see, is the operational cost, if zone signing for IDNs requires substantially more work, i.e. if each variant needs a separate signature, when we have N x M x P type combinatorial expansion of possible equivalent labels. More work means compute cycles, and that means either less frequent zone signing, or more expensive equipment to support signing - both of which are impacted proportional to the product of the number of variants, something which is finite but not necessarily a friendly number. N x M x P, for example, is at least 8 (when N == M == P == 2), and can easily be much larger. So, I'd say it can be summarized as follows: 1. There is a problem, specifically scaling. 2. It can't be solved already. 3. It is something we are in a position of solving. 4. The consequences are an impact to either the current IDN-related proposals, *or* an impact on recently-approved DNSSEC specifications (and a correspondingly small deployed code base and user base) 5. The consequences of *not* solving it are as stated above - having zone administrators needing to choose between no-IDNs, no-DNSSEC, or additional cost. Brian --0016e68ef470c8c1f804876bd46d Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <br><br><div class=3D"gmail_quote">On Wed, May 19, 2010 at 11:58 PM, Andrew= Sullivan <span dir=3D"ltr"><<a href=3D"mailto:ajs@shinkuro.com">ajs@shi= nkuro.com</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style= =3D"border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; p= adding-left: 1ex;"> Speaking only for myself.<br> <br> <br> The questions I see before us come down to these:<br> <br> =A0 =A01. =A0Is there a problem?<br> <br> =A0 =A02. =A0Is it one that can't be solved already?<br> <br> =A0 =A03. =A0Is it something we are in a position to solve? =A0(How comple= tely?)<br> <br> =A0 =A04. =A0What are the consequences of solving it?<br> <font color=3D"#888888"><br></font></blockquote><div><br>=A0At the risk of = invoking meta-discussion...<br><br>I think one thing we should all keep in = mind, is the consequences of what we do here, which<br>are second-order eff= ects - those things which are the logical results, but not necessarily obvi= ous.<br> <br>For example, we may provide solutions to IDN requirements, and we may p= rovide solutions for DNSSEC.<br><br>However, if in our choice of solutions = for these, we don't take into consideration that a non-trivial portion = of those who want or need to have both at the same time, i.e. DNSSEC IDN= 9;s, we risk putting those folks in a difficult position.<br> <br>Those using IDNs likely see those are essential, or at least necessary.= They may not have as strong a need or desire for DNSSEC.<br><br>If DNSSEC = is more difficult, or more expensive, for those using IDNs, this could act = as a barrier to widescale deployment of DNSSEC. Or worse, it could be seen = as a slight by us, against the IDN community.<br> <br>The main issue I can see, is the operational cost, if zone signing for = IDNs requires substantially more work, i.e. if each variant needs a separat= e signature, when we have N x M x P type combinatorial expansion of possibl= e equivalent labels.<br> More work means compute cycles, and that means either less frequent zone si= gning, or more expensive equipment to support signing - both of which are i= mpacted proportional to the product of the number of variants, something wh= ich is finite but not necessarily a friendly number. N x M x P, for example= , is at least 8 (when N =3D=3D M =3D=3D P =3D=3D 2), and can easily be much= larger.<br> <br>So, I'd say it can be summarized as follows:<br><br>1. There is a p= roblem, specifically scaling.<br>2. It can't be solved already.<br>3. I= t is something we are in a position of solving.<br>4. The consequences are = an impact to either the current IDN-related proposals, *or* an impact on re= cently-approved DNSSEC specifications (and a correspondingly small deployed= code base and user base)<br> 5. The consequences of *not* solving it are as stated above - having zone a= dministrators needing to choose between no-IDNs, no-DNSSEC, or additional c= ost.<br></div></div><br>Brian<br> --0016e68ef470c8c1f804876bd46d-- From owner-namedroppers@ops.ietf.org Tue May 25 08:23:55 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 109203A68D8; Tue, 25 May 2010 08:23:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.949 X-Spam-Level: X-Spam-Status: No, score=-104.949 tagged_above=-999 required=5 tests=[AWL=-1.300, BAYES_50=0.001, HELO_EQ_FR=0.35, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M39iirUWajbR; Tue, 25 May 2010 08:23:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C71F33A694E; Tue, 25 May 2010 08:23:52 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGvtl-0000B0-Ha for namedroppers-data0@psg.com; Tue, 25 May 2010 15:18:29 +0000 Received: from [2001:660:3003:2::4:11] (helo=mx2.nic.fr) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <bortzmeyer@nic.fr>) id 1OGvti-0000Ae-9A for namedroppers@ops.ietf.org; Tue, 25 May 2010 15:18:26 +0000 Received: from mx2.nic.fr (localhost [127.0.0.1]) by mx2.nic.fr (Postfix) with SMTP id 1760B1C002A for <namedroppers@ops.ietf.org>; Tue, 25 May 2010 17:18:23 +0200 (CEST) Received: from relay2.nic.fr (relay2.nic.fr [192.134.4.163]) by mx2.nic.fr (Postfix) with ESMTP id 133191C0023 for <namedroppers@ops.ietf.org>; Tue, 25 May 2010 17:18:23 +0200 (CEST) Received: from bortzmeyer.nic.fr (batilda.nic.fr [192.134.4.69]) by relay2.nic.fr (Postfix) with ESMTP id 111106C0001 for <namedroppers@ops.ietf.org>; Tue, 25 May 2010 17:18:23 +0200 (CEST) Date: Tue, 25 May 2010 17:18:23 +0200 From: Stephane Bortzmeyer <bortzmeyer@nic.fr> To: namedroppers@ops.ietf.org Subject: [dnsext] [DNAME] What to do when it points to a non-existing name? Message-ID: <20100525151823.GA16847@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Operating-System: Debian GNU/Linux 5.0.4 X-Kernel: Linux 2.6.26-2-686 i686 Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> Testing the new service at .NZ, which uses DNAME to make IDN and LDH names "equivalent", I ran into the following question, which seems connected to the DNAME-bis draft. When the synthetized CNAME goes to a non-existing domain, what does a recursive resolver return? NXDOMAIN? NOERROR? BIND and Unbound behave differently. Unbound (and the maintainer claims he is right and that no RFC mandates a specific behaviour): % dig ANY doesnotexistatall.xn--mori-qsa.dns.net.nz ; <<>> DiG 9.5.1-P3 <<>> ANY doesnotexistatall.xn--mori-qsa.dns.net.nz ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54791 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;doesnotexistatall.xn--mori-qsa.dns.net.nz. IN ANY ;; ANSWER SECTION: xn--mori-qsa.dns.net.nz. 86400 IN DNAME maori.dns.net.nz. doesnotexistatall.xn--mori-qsa.dns.net.nz. 0 IN CNAME doesnotexistatall.maori.dns.net.nz. ;; AUTHORITY SECTION: maori.dns.net.nz. 3600 IN SOA loopback.dns.net.nz. soa.nzrs.net.nz. 2010051262 3600 1200 604800 3600 ;; Query time: 622 msec ;; SERVER: ::1#53(::1) ;; WHEN: Tue May 25 16:53:51 2010 ;; MSG SIZE rcvd: 181 BIND: % dig ANY doesnotexistatall.xn--mori-qsa.dns.net.nz ; <<>> DiG 9.7.0-P1 <<>> ANY doesnotexistatall.xn--mori-qsa.dns.net.nz ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 425 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;doesnotexistatall.xn--mori-qsa.dns.net.nz. IN ANY ;; ANSWER SECTION: xn--mori-qsa.dns.net.nz. 74662 IN DNAME maori.dns.net.nz. doesnotexistatall.xn--mori-qsa.dns.net.nz. 0 IN CNAME doesnotexistatall.maori.dns.net.nz. ;; AUTHORITY SECTION: maori.dns.net.nz. 3600 IN SOA loopback.dns.net.nz. soa.nzrs.net.nz. 2010051262 3600 1200 604800 3600 ;; Query time: 306 msec ;; SERVER: 192.134.7.248#53(192.134.7.248) ;; WHEN: Tue May 25 16:54:16 2010 ;; MSG SIZE rcvd: 186 From owner-namedroppers@ops.ietf.org Tue May 25 08:56:43 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51A533A6C16; Tue, 25 May 2010 08:56:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.538 X-Spam-Level: * X-Spam-Status: No, score=1.538 tagged_above=-999 required=5 tests=[AWL=-0.867, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mU4KrCH5OKAS; Tue, 25 May 2010 08:56:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 022D73A6B33; Tue, 25 May 2010 08:56:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGwR3-0005Ph-9c for namedroppers-data0@psg.com; Tue, 25 May 2010 15:52:53 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <namedroppers@stora.ogud.com>) id 1OGwQx-0005Oa-6R for namedroppers@ops.ietf.org; Tue, 25 May 2010 15:52:47 +0000 Received: from stora.ogud.com (localhost [127.0.0.1]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4PFqjmF083889 for <namedroppers@ops.ietf.org>; Tue, 25 May 2010 11:52:45 -0400 (EDT) (envelope-from namedroppers@stora.ogud.com) Received: (from namedroppers@localhost) by stora.ogud.com (8.14.4/8.14.4/Submit) id o4PFqjBx083888 for namedroppers@ops.ietf.org; Tue, 25 May 2010 11:52:45 -0400 (EDT) (envelope-from namedroppers) Received: from [87.106.162.201] (helo=ka.mail.enyo.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <fw@deneb.enyo.de>) id 1OGX7X-000LDw-6S for namedroppers@ops.ietf.org; Mon, 24 May 2010 12:51:03 +0000 Received: from [172.17.135.4] (helo=deneb.enyo.de) by ka.mail.enyo.de with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) id 1OGX76-0002VI-BU; Mon, 24 May 2010 14:50:36 +0200 Received: from fw by deneb.enyo.de with local (Exim 4.71) (envelope-from <fw@deneb.enyo.de>) id 1OGX76-0000r5-3Z; Mon, 24 May 2010 14:50:36 +0200 From: Florian Weimer <fw@deneb.enyo.de> To: =?utf-8?B?T25kxZllaiBTdXLDvQ==?= <ondrej.sury@nic.cz> Cc: Suzanne Woolf <woolf@isc.org>, Mark Andrews <marka@isc.org>, Alex Bligh <alex@alex.org.uk>, Vaggelis Segredakis <segred@ics.forth.gr>, "'Andrew Sullivan'" <ajs@shinkuro.com>, namedroppers@ops.ietf.org, "'Sotiris Panaretou'" <sotiris@ucy.ac.cy> Subject: [dnsext] Re: username@xname handling in MTAs References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <FDF10604930449659CE4C74BA469CEC2@ics.forth.gr> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <EACA79D85688A6B0BE5B0B46@host113.msm.che.vodafone> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <DFBB095877427C98807BC3E8@nimrod.local> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520151426.GA22640@farside.isc.org> <4BFA4373.40005@nic.cz> <87fx1h1vg5.fsf@mid.deneb.enyo.de> <4BFA52DD.4090009@nic.cz> <87632dziuu.fsf@mid.deneb.enyo.de> <4BFA73B6.8080208@nic.cz> Date: Mon, 24 May 2010 14:50:36 +0200 In-Reply-To: <4BFA73B6.8080208@nic.cz> (=?utf-8?Q?=22Ond=C5=99ej_Sur=C3=BD?= =?utf-8?Q?=22's?= message of "Mon, 24 May 2010 14:40:22 +0200") Message-ID: <87y6f9zco3.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.67 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> [ Moderators note: Post was moderated, either because it was posted by a non-subscriber, or because it was over 20K. With the massive amount of spam, it is easy to miss and therefore delete relevant posts by non-subscribers. Please fix your subscription addresses. ] * Ond=C5=99ej Sur=C3=BD: > Yep, you're right. I have just tested that. Hence my example with > mass hosting is not usable. That's great to have not only different > protocols handling CNAME differently, but also different MTAs handling > CNAME differently. > > BTW this applies to IDN usage of BNAME as well, since there is CNAME > expansion for non-complying clients. And if you alias two trees there > will be some matches for sure. The *NAMEd names are second-class citizens in a second aspect: Several protocols explicitly require canonical names in some places (on the right-hand side of NS and MX records, for instance), and you have to be careful not to use *NAMEd names there. Again, this restriction is not enforced by all clients. I guess it's an interesting task to write zone editing software which allows the user to enter cleartext (non-punycode) names. From owner-namedroppers@ops.ietf.org Tue May 25 08:56:48 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B61223A6B9D; Tue, 25 May 2010 08:56:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.982 X-Spam-Level: * X-Spam-Status: No, score=1.982 tagged_above=-999 required=5 tests=[AWL=-1.023, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KlPtK5XzxAiv; Tue, 25 May 2010 08:56:48 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D7FEC3A6AD9; Tue, 25 May 2010 08:56:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGwQm-0005NW-NP for namedroppers-data0@psg.com; Tue, 25 May 2010 15:52:36 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <namedroppers@stora.ogud.com>) id 1OGwQf-0005LL-Al for namedroppers@ops.ietf.org; Tue, 25 May 2010 15:52:29 +0000 Received: from stora.ogud.com (localhost [127.0.0.1]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4PFqS4c083879 for <namedroppers@ops.ietf.org>; Tue, 25 May 2010 11:52:28 -0400 (EDT) (envelope-from namedroppers@stora.ogud.com) Received: (from namedroppers@localhost) by stora.ogud.com (8.14.4/8.14.4/Submit) id o4PFqSPD083878 for namedroppers@ops.ietf.org; Tue, 25 May 2010 11:52:28 -0400 (EDT) (envelope-from namedroppers) Received: from [87.106.162.201] (helo=ka.mail.enyo.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <fw@deneb.enyo.de>) id 1OGV2C-0000tU-RV for namedroppers@ops.ietf.org; Mon, 24 May 2010 10:37:25 +0000 Received: from [172.17.135.4] (helo=deneb.enyo.de) by ka.mail.enyo.de with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) id 1OGV1m-0001hs-3T; Mon, 24 May 2010 12:36:58 +0200 Received: from fw by deneb.enyo.de with local (Exim 4.71) (envelope-from <fw@deneb.enyo.de>) id 1OGV1l-0007vx-RB; Mon, 24 May 2010 12:36:57 +0200 From: Florian Weimer <fw@deneb.enyo.de> To: =?utf-8?B?T25kxZllaiBTdXLDvQ==?= <ondrej.sury@nic.cz> Cc: Suzanne Woolf <woolf@isc.org>, Mark Andrews <marka@isc.org>, Alex Bligh <alex@alex.org.uk>, Vaggelis Segredakis <segred@ics.forth.gr>, "'Andrew Sullivan'" <ajs@shinkuro.com>, namedroppers@ops.ietf.org, "'Sotiris Panaretou'" <sotiris@ucy.ac.cy> Subject: Re: [dnsext] Re: On adoption of two drafts References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <FDF10604930449659CE4C74BA469CEC2@ics.forth.gr> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <EACA79D85688A6B0BE5B0B46@host113.msm.che.vodafone> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <DFBB095877427C98807BC3E8@nimrod.local> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520151426.GA22640@farside.isc.org> <4BFA4373.40005@nic.cz> <87fx1h1vg5.fsf@mid.deneb.enyo.de> <4BFA52DD.4090009@nic.cz> Date: Mon, 24 May 2010 12:36:57 +0200 In-Reply-To: <4BFA52DD.4090009@nic.cz> (=?utf-8?Q?=22Ond=C5=99ej_Sur=C3=BD?= =?utf-8?Q?=22's?= message of "Mon, 24 May 2010 12:20:13 +0200") Message-ID: <87632dziuu.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.67 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> [ Moderators note: Post was moderated, either because it was posted by a non-subscriber, or because it was over 20K. With the massive amount of spam, it is easy to miss and therefore delete relevant posts by non-subscribers. Please fix your subscription addresses. ] * Ond=C5=99ej Sur=C3=BD: > On 24.5.2010 11:48, Florian Weimer wrote: >> * Ond=C5=99ej Sur=C3=BD: >> >>> 2) Mass webhosting: >>> webhoster creates base name: template1.webhosting.tld >>> and aliases all it's customers using CNAME+DNAME or BNAME >> >> Does this really work in practice because usually, you want mail to >> work, too? RFC 1123 requires that CNAMEs are expanded by the sender, >> so you can't be certain that your mail server gets the original name. > > I have never seen a MTA which did canonicalization (but that doesn't > mean there isn't any). Sendmail does it by default. From owner-namedroppers@ops.ietf.org Tue May 25 08:56:58 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0BF413A6AD9; Tue, 25 May 2010 08:56:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.727 X-Spam-Level: ** X-Spam-Status: No, score=2.727 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u08+e6-2wbMz; Tue, 25 May 2010 08:56:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D618F3A6B9D; Tue, 25 May 2010 08:56:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGwRU-0005WK-L5 for namedroppers-data0@psg.com; Tue, 25 May 2010 15:53:20 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <namedroppers@stora.ogud.com>) id 1OGwRP-0005VC-RN for namedroppers@ops.ietf.org; Tue, 25 May 2010 15:53:16 +0000 Received: from stora.ogud.com (localhost [127.0.0.1]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4PFrEik083900 for <namedroppers@ops.ietf.org>; Tue, 25 May 2010 11:53:14 -0400 (EDT) (envelope-from namedroppers@stora.ogud.com) Received: (from namedroppers@localhost) by stora.ogud.com (8.14.4/8.14.4/Submit) id o4PFrE9T083899 for namedroppers@ops.ietf.org; Tue, 25 May 2010 11:53:14 -0400 (EDT) (envelope-from namedroppers) Received: from [74.125.82.52] (helo=mail-ww0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <dan@doxpara.com>) id 1OGqQd-000IBW-6a for namedroppers@ops.ietf.org; Tue, 25 May 2010 09:28:03 +0000 Received: by wwb22 with SMTP id 22so604284wwb.11 for <namedroppers@ops.ietf.org>; Tue, 25 May 2010 02:28:00 -0700 (PDT) MIME-Version: 1.0 Received: by 10.216.164.139 with SMTP id c11mr4470081wel.209.1274779680406; Tue, 25 May 2010 02:28:00 -0700 (PDT) Received: by 10.216.131.86 with HTTP; Tue, 25 May 2010 02:28:00 -0700 (PDT) X-Originating-IP: [174.129.49.254] Date: Tue, 25 May 2010 05:28:00 -0400 Message-ID: <AANLkTinAcajsPY_Az9cCutFpPE7cv2HuFlFCb-i2QWYq@mail.gmail.com> Subject: [dnsext] Engineering Requirements for Stub Chain Delivery From: Dan Kaminsky <dan@doxpara.com> To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.67 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> [ Moderators note: Post was moderated, either because it was posted by a non-subscriber, or because it was over 20K. With the massive amount of spam, it is easy to miss and therefore delete relevant posts by non-subscribers. Please fix your subscription addresses. ] Hello Everybody, =A0=A0 I've been listening to your discussions regarding what to do about the CD flag with great interest, as I've been working on implementing a name server (and a stub resolver) to demonstrate the power of DNSSEC.=A0 As some of you have noted, there's a definite need for certain stub resolvers to be able to acquire the full validation chain for a given domain, even if that chain goes through CNAMEs or DNAMEs. In my particular circumstance, I need the ability for end nodes to be able to validate not merely (or even specifically) A records, but CERT/SSHFP/etc. types for cryptographic keys. =A0=A0 Put simply, end to end trust isn't negotiable; we need endpoints able to get the full chain.=A0 (I'm not trusting the name server at the Coffee shop to tell me the certificate for anything.)=A0 But I don't have any more of an appetite than you guys do for forcing every random client to harass the roots unnecessarily.=A0 We have an enormous caching layer, in the recursive server population, and it would really be helpful if that caching layer could provide us precached chains. =A0=A0 (As a note, this is why DNSSEC is fundamentally superior to DNSCurve -- you can do end to end trust without losing the caching layer.=A0 Not that there isn't cool stuff in DNSCurve.) =A0=A0 I've been working on determining the engineering requirements for retrieving full chains to the root, from a DNSSEC server.=A0 The two core elements seem to be: =A0=A0 1) In the presence of a request from the client, the server MUST return a valid chain to the root, even when such chain traverses CNAME or DNAME jumps. =A0=A0 2) The request from the client SHOULD contain some sort of "hint", describing the deepest DNSKEY that the client will trust as a chain to the root.=A0 For example, if a client has a valid DNSKEY for .com, there's no need to repeat the chain from com to root.=A0 Multiple hints should be allowed. =A0=A0 There does seem to be some desire around here to continue supporting trust anchors in a non-root universe.=A0 This isn't a model I see ever scaling, but I _do_ like trust anchors as a way of allowing even greater validation for particular delegations -- for example, a company could use trust anchors for its own internal systems, rather than trusting the registry and root it lives under.=A0 It seems like hinting should cover this trust anchor scenario just fine. =A0=A0 In terms of encapsulation, some extension off EDNS0 looks like the way to go here, though there's really no reason not to just emit the hint DNSKEYs as an Additional RRset. =A0=A0 Question for you guys:=A0 Am I missing any engineering requirements for my stub and name server?=A0 I'm trying to capture the actual in-the-field-necessary functionality for CD, and I think this hits it, but I could be convinced otherwise. --Dan From owner-namedroppers@ops.ietf.org Tue May 25 08:57:01 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1433E3A6C01; Tue, 25 May 2010 08:57:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.128 X-Spam-Level: ** X-Spam-Status: No, score=2.128 tagged_above=-999 required=5 tests=[AWL=-0.876, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hWgoLDhzPImR; Tue, 25 May 2010 08:57:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 24A083A6B9D; Tue, 25 May 2010 08:57:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGwQS-0005Jd-VW for namedroppers-data0@psg.com; Tue, 25 May 2010 15:52:16 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <namedroppers@stora.ogud.com>) id 1OGwQN-0005HH-9y for namedroppers@ops.ietf.org; Tue, 25 May 2010 15:52:12 +0000 Received: from stora.ogud.com (localhost [127.0.0.1]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4PFq8Yl083869 for <namedroppers@ops.ietf.org>; Tue, 25 May 2010 11:52:08 -0400 (EDT) (envelope-from namedroppers@stora.ogud.com) Received: (from namedroppers@localhost) by stora.ogud.com (8.14.4/8.14.4/Submit) id o4PFq8u7083868 for namedroppers@ops.ietf.org; Tue, 25 May 2010 11:52:08 -0400 (EDT) (envelope-from namedroppers) Received: from [87.106.162.201] (helo=ka.mail.enyo.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <fw@deneb.enyo.de>) id 1OGUHr-000J1D-3I for namedroppers@ops.ietf.org; Mon, 24 May 2010 09:49:31 +0000 Received: from [172.17.135.4] (helo=deneb.enyo.de) by ka.mail.enyo.de with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) id 1OGUHK-0001Sk-Ve; Mon, 24 May 2010 11:48:59 +0200 Received: from fw by deneb.enyo.de with local (Exim 4.71) (envelope-from <fw@deneb.enyo.de>) id 1OGUHK-0005N0-Nd; Mon, 24 May 2010 11:48:58 +0200 From: Florian Weimer <fw@deneb.enyo.de> To: =?utf-8?B?T25kxZllaiBTdXLDvQ==?= <ondrej.sury@nic.cz> Cc: Suzanne Woolf <woolf@isc.org>, Mark Andrews <marka@isc.org>, Alex Bligh <alex@alex.org.uk>, Vaggelis Segredakis <segred@ics.forth.gr>, "'Andrew Sullivan'" <ajs@shinkuro.com>, namedroppers@ops.ietf.org, "'Sotiris Panaretou'" <sotiris@ucy.ac.cy> Subject: Re: [dnsext] Re: On adoption of two drafts References: <88521.1267488870@nsa.vix.com> <474059336.22856@cnnic.cn> <FDF10604930449659CE4C74BA469CEC2@ics.forth.gr> <13802.1274183739@nsa.vix.com> <20100518152418.GF81855@shinkuro.com> <074970A647044F50B5D429F213119233@ics.forth.gr> <EACA79D85688A6B0BE5B0B46@host113.msm.che.vodafone> <201005191354.o4JDsfOp034332@drugs.dv.isc.org> <DFBB095877427C98807BC3E8@nimrod.local> <201005200043.o4K0hCEn048787@drugs.dv.isc.org> <20100520151426.GA22640@farside.isc.org> <4BFA4373.40005@nic.cz> Date: Mon, 24 May 2010 11:48:58 +0200 In-Reply-To: <4BFA4373.40005@nic.cz> (=?utf-8?Q?=22Ond=C5=99ej_Sur=C3=BD?= =?utf-8?Q?=22's?= message of "Mon, 24 May 2010 11:14:27 +0200") Message-ID: <87fx1h1vg5.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.67 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> [ Moderators note: Post was moderated, either because it was posted by a non-subscriber, or because it was over 20K. With the massive amount of spam, it is easy to miss and therefore delete relevant posts by non-subscribers. Please fix your subscription addresses. ] * Ond=C5=99ej Sur=C3=BD: > 2) Mass webhosting: > webhoster creates base name: template1.webhosting.tld > and aliases all it's customers using CNAME+DNAME or BNAME Does this really work in practice because usually, you want mail to work, too? RFC 1123 requires that CNAMEs are expanded by the sender, so you can't be certain that your mail server gets the original name. From owner-namedroppers@ops.ietf.org Tue May 25 09:09:36 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8E7323A6FB6; Tue, 25 May 2010 09:09:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.877 X-Spam-Level: X-Spam-Status: No, score=-1.877 tagged_above=-999 required=5 tests=[AWL=0.722, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DdAurhZvzQ3B; Tue, 25 May 2010 09:09:35 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0A0E83A6D86; Tue, 25 May 2010 09:09:35 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGwdp-000849-4u for namedroppers-data0@psg.com; Tue, 25 May 2010 16:06:05 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <marka@isc.org>) id 1OGwdl-00082m-1V for namedroppers@ops.ietf.org; Tue, 25 May 2010 16:06:01 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 14571ED06F; Tue, 25 May 2010 16:05:57 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4PG5thu084065; Wed, 26 May 2010 02:05:55 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005251605.o4PG5thu084065@drugs.dv.isc.org> To: Stephane Bortzmeyer <bortzmeyer@nic.fr> Cc: namedroppers@ops.ietf.org From: Mark Andrews <marka@isc.org> References: <20100525151823.GA16847@nic.fr> Subject: Re: [dnsext] [DNAME] What to do when it points to a non-existing name? In-reply-to: Your message of "Tue, 25 May 2010 17:18:23 +0200." <20100525151823.GA16847@nic.fr> Date: Wed, 26 May 2010 02:05:55 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> In message <20100525151823.GA16847@nic.fr>, Stephane Bortzmeyer writes: > Testing the new service at .NZ, which uses DNAME to make IDN and LDH > names "equivalent", I ran into the following question, which seems > connected to the DNAME-bis draft. > > When the synthetized CNAME goes to a non-existing domain, what does a > recursive resolver return? NXDOMAIN? NOERROR? > > BIND and Unbound behave > differently. Unbound (and the maintainer claims he is right and that > no RFC mandates a specific behaviour): First pass: If a DNAME record exists at that point, copy that record into the answer section. If substitution of its <target> for its <owner> in QNAME would overflow the legal size for a <domain- name>, set RCODE to YXDOMAIN [DNSUPD] and exit; otherwise perform the substitution and continue. If the query was not extended [EDNS0] with a Version indicating understanding of the DNAME record, the server SHOULD synthesize a CNAME record as described above and include it in the answer section. Go back to step 1. Adds xn--mori-qsa.dns.net.nz. 86400 IN DNAME maori.dns.net.nz. doesnotexistatall.xn--mori-qsa.dns.net.nz. 0 IN CNAME doesnotexistatall.maori.dns.net.nz. Second pass: If the "*" label does not exist, check whether the name we are looking for is the original QNAME in the query or a name we have followed due to a CNAME. If the name is original, set an authoritative name error in the response and exit. Otherwise just exit. RFC 2308 makes NAME ERROR the correct response. Note this is a ambiguity that exists in RFC 1034 and is not specific to DNAME. A plain CNAME pointing to a non-existing name also reaches this paragraph for qtypes other than "*". For qtype "*" you exit via this path. Otherwise, copy all RRs which match QTYPE into the answer section and go to step 6. To make qtype any + DNAME consistent with qtype any + CNAME one would have to address to NOT go back to step 1, but rather just go to step 6 on qtype "*". > % dig ANY doesnotexistatall.xn--mori-qsa.dns.net.nz > > ; <<>> DiG 9.5.1-P3 <<>> ANY doesnotexistatall.xn--mori-qsa.dns.net.nz > ;; global options: printcmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54791 > ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0 > > ;; QUESTION SECTION: > ;doesnotexistatall.xn--mori-qsa.dns.net.nz. IN ANY > > ;; ANSWER SECTION: > xn--mori-qsa.dns.net.nz. 86400 IN DNAME maori.dns.net.nz. > doesnotexistatall.xn--mori-qsa.dns.net.nz. 0 IN CNAME doesnotexistatall.maori.dns.net.nz. > > ;; AUTHORITY SECTION: > maori.dns.net.nz. 3600 IN SOA loopback.dns.net.nz. soa.nzrs.net.nz. 2010051262 3600 1200 604800 3600 > > ;; Query time: 622 msec > ;; SERVER: ::1#53(::1) > ;; WHEN: Tue May 25 16:53:51 2010 > ;; MSG SIZE rcvd: 181 Which says the name exists (RFC 2308) so is wrong. You can not add the SOA to the authority section and have NOERROR or set NXDOMAIN with or without the SOA in the authority section. You don't set NOERROR and add the SOA unless the name exist and is empty which it isn't in this case. > BIND: > > % dig ANY doesnotexistatall.xn--mori-qsa.dns.net.nz > > ; <<>> DiG 9.7.0-P1 <<>> ANY doesnotexistatall.xn--mori-qsa.dns.net.nz > ;; global options: +cmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 425 > ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1 > > ;; OPT PSEUDOSECTION: > ; EDNS: version: 0, flags:; udp: 4096 > ;; QUESTION SECTION: > ;doesnotexistatall.xn--mori-qsa.dns.net.nz. IN ANY > > ;; ANSWER SECTION: > xn--mori-qsa.dns.net.nz. 74662 IN DNAME maori.dns.net.nz. > doesnotexistatall.xn--mori-qsa.dns.net.nz. 0 IN CNAME doesnotexistatall.maori.dns.net.nz. > > ;; AUTHORITY SECTION: > maori.dns.net.nz. 3600 IN SOA loopback.dns.net.nz. soa.nzrs.net.nz. 2010051262 3600 1200 604800 3600 > > ;; Query time: 306 msec > ;; SERVER: 192.134.7.248#53(192.134.7.248) > ;; WHEN: Tue May 25 16:54:16 2010 > ;; MSG SIZE rcvd: 186 > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue May 25 09:18:33 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AD7C53A6E15; Tue, 25 May 2010 09:18:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.592 X-Spam-Level: X-Spam-Status: No, score=-0.592 tagged_above=-999 required=5 tests=[AWL=-0.593, BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CHD6QIaY9vSc; Tue, 25 May 2010 09:18:27 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8AC853A7129; Tue, 25 May 2010 09:18:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGwm7-0009ak-8S for namedroppers-data0@psg.com; Tue, 25 May 2010 16:14:39 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <marka@isc.org>) id 1OGwm2-0009Zh-Qe for namedroppers@ops.ietf.org; Tue, 25 May 2010 16:14:35 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id B8DC9ED06E; Tue, 25 May 2010 16:14:33 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4PGEVOK084328; Wed, 26 May 2010 02:14:31 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005251614.o4PGEVOK084328@drugs.dv.isc.org> To: Dan Kaminsky <dan@doxpara.com> Cc: namedroppers@ops.ietf.org From: Mark Andrews <marka@isc.org> References: <AANLkTinAcajsPY_Az9cCutFpPE7cv2HuFlFCb-i2QWYq@mail.gmail.com> Subject: Re: [dnsext] Engineering Requirements for Stub Chain Delivery In-reply-to: Your message of "Tue, 25 May 2010 05:28:00 -0400." <AANLkTinAcajsPY_Az9cCutFpPE7cv2HuFlFCb-i2QWYq@mail.gmail.com> Date: Wed, 26 May 2010 02:14:31 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> In message <AANLkTinAcajsPY_Az9cCutFpPE7cv2HuFlFCb-i2QWYq@mail.gmail.com>, Dan Kaminsky writes: > [ Moderators note: Post was moderated, either because it was posted by > a non-subscriber, or because it was over 20K. > With the massive amount of spam, it is easy to miss and therefore > delete relevant posts by non-subscribers. > Please fix your subscription addresses. ] > > Hello Everybody, > > =A0=A0 I've been listening to your discussions regarding what to do about > the CD flag with great interest, as I've been working on implementing > a name server (and a stub resolver) to demonstrate the power of > DNSSEC.=A0 As some of you have noted, there's a definite need for > certain stub resolvers to be able to acquire the full validation chain > for a given domain, even if that chain goes through CNAMEs or DNAMEs. > In my particular circumstance, I need the ability for end nodes to be > able to validate not merely (or even specifically) A records, but > CERT/SSHFP/etc. types for cryptographic keys. > > =A0=A0 Put simply, end to end trust isn't negotiable; we need endpoints > able to get the full chain.=A0 (I'm not trusting the name server at the > Coffee shop to tell me the certificate for anything.)=A0 But I don't > have any more of an appetite than you guys do for forcing every random > client to harass the roots unnecessarily.=A0 We have an enormous caching > layer, in the recursive server population, and it would really be > helpful if that caching layer could provide us precached chains. > > =A0=A0 (As a note, this is why DNSSEC is fundamentally superior to > DNSCurve -- you can do end to end trust without losing the caching > layer.=A0 Not that there isn't cool stuff in DNSCurve.) > > =A0=A0 I've been working on determining the engineering requirements for > retrieving full chains to the root, from a DNSSEC server.=A0 The two > core elements seem to be: > > =A0=A0 1) In the presence of a request from the client, the server MUST > return a valid chain to the root, even when such chain traverses CNAME > or DNAME jumps. > =A0=A0 2) The request from the client SHOULD contain some sort of "hint", > describing the deepest DNSKEY that the client will trust as a chain to > the root.=A0 For example, if a client has a valid DNSKEY for .com, > there's no need to repeat the chain from com to root.=A0 Multiple hints > should be allowed. > > =A0=A0 There does seem to be some desire around here to continue > supporting trust anchors in a non-root universe.=A0 This isn't a model I > see ever scaling, but I _do_ like trust anchors as a way of allowing > even greater validation for particular delegations -- for example, a > company could use trust anchors for its own internal systems, rather > than trusting the registry and root it lives under.=A0 It seems like > hinting should cover this trust anchor scenario just fine. > > =A0=A0 In terms of encapsulation, some extension off EDNS0 looks like the > way to go here, though there's really no reason not to just emit the > hint DNSKEYs as an Additional RRset. > > =A0=A0 Question for you guys:=A0 Am I missing any engineering requirements > for my stub and name server?=A0 I'm trying to capture the actual > in-the-field-necessary functionality for CD, and I think this hits it, > but I could be convinced otherwise. > > --Dan A stub needs to be able to query for chain elements it is missing. It does not need them to be returned in a single query. Such queries will normally be satistfied by the caching server without having to make additional queries especially if the caching server also validates the reponses it gets (before or after sending them on). Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue May 25 09:22:04 2010 Return-Path: <owner-namedroppers@ops.ietf.org> X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 97D473A6CEE; Tue, 25 May 2010 09:22:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.996 X-Spam-Level: * X-Spam-Status: No, score=1.996 tagged_above=-999 required=5 tests=[AWL=-0.110, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j+FWulVEs-4Z; Tue, 25 May 2010 09:22:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7792E3A6C5C; Tue, 25 May 2010 09:22:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1OGwpb-000AAN-Fq for namedroppers-data0@psg.com; Tue, 25 May 2010 16:18:15 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from <Ed.Lewis@neustar.biz>) id 1OGwpN-000A8E-TA for namedroppers@ops.ietf.org; Tue, 25 May 2010 16:18:02 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4PGHpc9084165; Tue, 25 May 2010 12:17:52 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [10.31.200.147] by Work-Laptop-2.local (PGP Universal service); Tue, 25 May 2010 12:17:58 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Tue, 25 May 2010 12:17:58 -0400 Mime-Version: 1.0 Message-Id: <a06240800c821a61ab3dc@[10.31.200.147]> In-Reply-To: <20100525151823.GA16847@nic.fr> References: <20100525151823.GA16847@nic.fr> Date: Tue, 25 May 2010 12:17:49 -0400 To: namedroppers@ops.ietf.org From: Edward Lewis <Ed.Lewis@neustar.biz> Subject: Re: [dnsext] [DNAME] What to do when it points to a non-existing name? Cc: ed.lewis@neustar.biz Content-Type: multipart/alternative; boundary="============_-937318224==_ma============" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: <namedroppers.ops.ietf.org> List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: <http://ops.ietf.org/lists/namedroppers/> --============_-937318224==_ma============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" From RFC 2672 this is what happens when a DNAME is "activated." If a DNAME record exists at that point, copy that record into the answer section. If substitution of its <target> for its <owner> in QNAME would overflow the legal size for a <domain- name>, set RCODE to YXDOMAIN [DNSUPD] and exit; otherwise perform the substitution and continue. If the query was not extended [EDNS0] with a Version indicating understanding of the DNAME record, the server SHOULD synthesize a CNAME record as described above and include it in the answer section. Go back to step 1. Going back to step 1: 1. Set or clear the value of recursion available in the response depending on whether the name server is willing to provide recursive service. If recursive service is available and requested via the RD bit in the query, go to step 5, otherwise step 2. 2. Search the available zones for the zone which is the nearest ancestor to QNAME. If such a zone is found, go to step 3, otherwise step 4. 3. Start matching down, label by label, in the zone. The matching process can terminate several ways: and the part that now matters is: c. If at some label, a match is impossible (i.e., the corresponding label does not exist), look to see whether the last label matched has a DNAME record. ... If the "*" label does not exist, check whether the name we are looking for is the original QNAME in the query or a name we have followed due to a CNAME. If the name is original, set an authoritative name error in the response and exit. Otherwise just exit. Looks like 2672 should have said "CNAME or DNAME" in the last quoted paragraph, as well including the presence of DNAME when talking about the "*" label, that is what I would have assumed the intent was. Both CNAME and DNAME are query-rewrite rules, saying "followed due to a CNAME" is just an over-literalization (yes, not a word) of the idea. I bet that paragraph was overlooked in the update of the algorithm. I would accept NoError and no applicable data as the appropriate final answer. At 17:18 +0200 5/25/10, Stephane Bortzmeyer wrote: >Testing the new service at .NZ, which uses DNAME to make IDN and LDH >names "equivalent", I ran into the following question, which seems >connected to the DNAME-bis draft. > >When the synthetized CNAME goes to a non-existing domain, what does a >recursive resolver return? NXDOMAIN? NOERROR? BIND and Unbound behave >differently. Unbound (and the maintainer claims he is right and that >no RFC mandates a specific behaviour): > >% dig ANY doesnotexistatall.xn--mori-qsa.dns.net.nz > >; <<>> DiG 9.5.1-P3 <<>> ANY doesnotexistatall.xn--mori-qsa.dns.net.nz >;; global options: printcmd >;; Got answer: >;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54791 >;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0 > >;; QUESTION SECTION: >;doesnotexistatall.xn--mori-qsa.dns.net.nz. IN ANY > >;; ANSWER SECTION: >xn--mori-qsa.dns.net.nz. 86400 IN DNAME maori.dns.net.nz. >doesnotexistatall.xn--mori-qsa.dns.net.nz. 0 IN CNAME >doesnotexistatall.maori.dns.net.nz. > >;; AUTHORITY SECTION: >maori.dns.net.nz. 3600 IN SOA loopback.dns.net.nz. >soa.nzrs.net.nz. 2010051262 3600 1200 604800 3600 > >;; Query time: 622 msec >;; SERVER: ::1#53(::1) >;; WHEN: Tue May 25 16:53:51 2010 >;; MSG SIZE rcvd: 181 > > >BIND: > >% dig ANY doesnotexistatall.xn--mori-qsa.dns.net.nz > >; <<>> DiG 9.7.0-P1 <<>> ANY doesnotexistatall.xn--mori-qsa.dns.net.nz >;; global options: +cmd >;; Got answer: >;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 425 >;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1 > >;; OPT PSEUDOSECTION: >; EDNS: version: 0, flags:; udp: 4096 >;; QUESTION SECTION: >;doesnotexistatall.xn--mori-qsa.dns.net.nz. IN ANY > >;; ANSWER SECTION: >xn--mori-qsa.dns.net.nz. 74662 IN DNAME maori.dns.net.nz. >doesnotexistatall.xn--mori-qsa.dns.net.nz. 0 IN CNAME >doesnotexistatall.maori.dns.net.nz. > >;; AUTHORITY SECTION: >maori.dns.net.nz. 3600 IN SOA loopback.dns.net.nz. >soa.nzrs.net.nz. 2010051262 3600 1200 604800 3600 > >;; Query time: 306 msec >;; SERVER: 192.134.7.248#53(192.134.7.248) >;; WHEN: Tue May 25 16:54:16 2010 >;; MSG SIZE rcvd: 186 -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. --============_-937318224==_ma============ Content-Type: text/html; charset="us-ascii" <!doctype html public "-//W3C//DTD W3 HTML//EN"> <html><head><style type="text/css"><!-- blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 } --></style><title>Re: [dnsext] [DNAME] What to do when it points to a non-ex
From RFC 2672 this is what happens when a DNAME is "activated."

         If a DNAME record exists at that point, copy that record into
         the answer section.  If substitution of its <target> for its
         <owner> in QNAME would overflow the legal size for a <domain-
         name>, set RCODE to YXDOMAIN [DNSUPD] and exit; otherwise
         perform the substitution and continue.  If the query was not
         extended [EDNS0] with a Version indicating understanding of the
         DNAME record, the server SHOULD synthesize a CNAME record as
         described above and include it in the answer section.  Go back
         to step 1.

Going back to step 1:

   1. Set or clear the value of recursion available in the response
      depending on whether the name server is willing to provide
      recursive service.  If recursive service is available and
      requested via the RD bit in the query, go to step 5, otherwise
      step 2.

   2. Search the available zones for the zone which is the nearest
      ancestor to QNAME.  If such a zone is found, go to step 3,
      otherwise step 4.

   3. Start matching down, label by label, in the zone.  The matching
      process can terminate several ways:
and the part that now matters is:

      c. If at some label, a match is impossible (i.e., the
         corresponding label does not exist), look to see whether the
         last label matched has a DNAME record.
...
         If the "*" label does not exist, check whether the name we are
         looking for is the original QNAME in the query or a name we
         have followed due to a CNAME.  If the name is original, set an
         authoritative name error in the response and exit.  Otherwise
         just exit.
Looks like 2672 should have said "CNAME or DNAME" in the last quoted paragraph, as well including the presence of DNAME when talking about the "*" label, that is what I would have assumed the intent was.  Both CNAME and DNAME are query-rewrite rules, saying "followed due to a CNAME" is just an over-literalization (yes, not a word) of the idea.  I bet that paragraph was overlooked in the update of the algorithm.

I would accept NoError and no applicable data as the appropriate final answer.

At 17:18 +0200 5/25/10, Stephane Bortzmeyer wrote:
>Testing the new service at .NZ, which uses DNAME to make IDN and LDH
>names "equivalent", I ran into the following question, which seems
>connected to the DNAME-bis draft.
>
>When the synthetized CNAME goes to a non-existing domain, what does a
>recursive resolver return?  NXDOMAIN? NOERROR? BIND and Unbound behave
>differently. Unbound (and the maintainer claims he is right and that
>no RFC mandates a specific behaviour):
>
>% dig ANY doesnotexistatall.xn--mori-qsa.dns.net.nz
>
>; <<>> DiG 9.5.1-P3 <<>> ANY doesnotexistatall.xn--mori-qsa.dns.net.nz
>;; global options:  printcmd
>;; Got answer:
>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54791
>;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0
>
>;; QUESTION SECTION:
>;doesnotexistatall.xn--mori-qsa.dns.net.nz. IN ANY
>
>;; ANSWER SECTION:
>xn--mori-qsa.dns.net.nz. 86400        IN      DNAME   maori.dns.net.nz.
>doesnotexistatall.xn--mori-qsa.dns.net.nz. 0 IN       CNAME doesnotexistatall.maori.dns.net.nz.
>
>;; AUTHORITY SECTION:
>maori.dns.net.nz.      3600    IN      SOA     loopback.dns.net.nz. soa.nzrs.net.nz. 2010051262 3600 1200 604800 3600
>
>;; Query time: 622 msec
>;; SERVER: ::1#53(::1)
>;; WHEN: Tue May 25 16:53:51 2010
>;; MSG SIZE  rcvd: 181
>
>
>BIND:
>
>% dig ANY doesnotexistatall.xn--mori-qsa.dns.net.nz
>
>; <<>> DiG 9.7.0-P1 <<>> ANY doesnotexistatall.xn--mori-qsa.dns.net.nz
>;; global options: +cmd
>;; Got answer:
>;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 425
>;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1
>
>;; OPT PSEUDOSECTION:
>; EDNS: version: 0, flags:; udp: 4096
>;; QUESTION SECTION:
>;doesnotexistatall.xn--mori-qsa.dns.net.nz. IN ANY
>
>;; ANSWER SECTION:
>xn--mori-qsa.dns.net.nz. 74662  IN      DNAME   maori.dns.net.nz.
>doesnotexistatall.xn--mori-qsa.dns.net.nz. 0 IN CNAME doesnotexistatall.maori.dns.net.nz.
>
>;; AUTHORITY SECTION:
>maori.dns.net.nz.       3600    IN      SOA     loopback.dns.net.nz. soa.nzrs.net.nz. 2010051262 3600 1200 604800 3600
>
>;; Query time: 306 msec
>;; SERVER: 192.134.7.248#53(192.134.7.248)
>;; WHEN: Tue May 25 16:54:16 2010
>;; MSG SIZE  rcvd: 186

--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

Discussing IPv4 address policy is like deciding what to eat on the Titanic.
--============_-937318224==_ma============-- From owner-namedroppers@ops.ietf.org Tue May 25 09:32:44 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D2ABD3A684F; Tue, 25 May 2010 09:32:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.999 X-Spam-Level: * X-Spam-Status: No, score=1.999 tagged_above=-999 required=5 tests=[AWL=-0.107, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YMAVoegZKNDs; Tue, 25 May 2010 09:32:43 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A64DF3A6B9A; Tue, 25 May 2010 09:32:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OGwym-000BjS-Uu for namedroppers-data0@psg.com; Tue, 25 May 2010 16:27:44 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OGwyj-000Bij-J1 for namedroppers@ops.ietf.org; Tue, 25 May 2010 16:27:42 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4PGREnC084253; Tue, 25 May 2010 12:27:15 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [10.31.200.147] by Work-Laptop-2.local (PGP Universal service); Tue, 25 May 2010 12:27:21 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Tue, 25 May 2010 12:27:21 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: <201005251605.o4PG5thu084065@drugs.dv.isc.org> References: <20100525151823.GA16847@nic.fr> <201005251605.o4PG5thu084065@drugs.dv.isc.org> Date: Tue, 25 May 2010 12:27:13 -0400 To: Mark Andrews From: Edward Lewis Subject: Re: [dnsext] [DNAME] What to do when it points to a non-existing name? Cc: Stephane Bortzmeyer , namedroppers@ops.ietf.org Content-Type: multipart/alternative; boundary="============_-937317661==_ma============" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --============_-937317661==_ma============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" At 2:05 +1000 5/26/10, Mark Andrews wrote: > If the "*" label does not exist, check whether the name we are > looking for is the original QNAME in the query or a name we > have followed due to a CNAME. If the name is original, set an > authoritative name error in the response and exit. Otherwise > just exit. > >RFC 2308 makes NAME ERROR the correct response. > >Note this is a ambiguity that exists in RFC 1034 and is not specific >to DNAME. A plain CNAME pointing to a non-existing name also reaches >this paragraph for qtypes other than "*". For qtype "*" you exit >via this path. I don't see this. The problem is in how you read 3.c. I cut out important text to highlight the "goto" control structure. c. If at some label, a match is impossible (i.e., the corresponding label does not exist), look to see whether the last label matched has a DNAME record. If a DNAME record exists at that point, ... Go back to step 1. If there was no DNAME record, look to see if the "*" label exists. If the "*" label does not exist, ... set an authoritative name error in the response and exit. Otherwise just exit. If the "*" label does exist, match RRs at that node against QTYPE. If any match, copy them into the answer section, but set the owner of the RR to be QNAME, and not the node with the "*" label. Go to step 6. The problem is that in 1034 this passage, I am told, was meant as a guide to developers, not pseudo-code. If I look at the passage as updated in 2672, it seems like it reads as if the editor thought it was pseudo-code. The question to ask, before DNAME, if CNAME went to an non-existent name, it seems to me that because we had followed a CNAME we'd "Otherwise just exit" because there was something at the original QNAME, just not what we wanted. I would extend this to the DNAME era, and would "read" the DNAME rfc as if it was mid-edited, over-literalizing, etc. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. --============_-937317661==_ma============ Content-Type: text/html; charset="us-ascii" Re: [dnsext] [DNAME] What to do when it points to a non-ex
At 2:05 +1000 5/26/10, Mark Andrews wrote:
>         If the "*" label does not exist, check whether the name we are
>         looking for is the original QNAME in the query or a name we
>         have followed due to a CNAME.  If the name is original, set an
>         authoritative name error in the response and exit.  Otherwise
>         just exit.
>
>RFC 2308 makes NAME ERROR the correct response.
>
>Note this is a ambiguity that exists in RFC 1034 and is not specific
>to DNAME.  A plain CNAME pointing to a non-existing name also reaches
>this paragraph for qtypes other than "*".  For qtype "*" you exit
>via this path.

I don't see this.  The problem is in how you read 3.c.  I cut out important text to highlight the "goto" control structure.

      c. If at some label, a match is impossible (i.e., the
         corresponding label does not exist), look to see whether the
         last label matched has a DNAME record.
         If a DNAME record exists at that point, ... Go back
         to step 1.

         If there was no DNAME record, look to see if the "*" label
         exists.
         If the "*" label does not exist, ... set an
         authoritative name error in the response and exit.  Otherwise
         just exit.

         If the "*" label does exist, match RRs at that node against
         QTYPE.  If any match, copy them into the answer section, but
         set the owner of the RR to be QNAME, and not the node with the
         "*" label.  Go to step 6.
The problem is that in 1034 this passage, I am told, was meant as a guide to developers, not pseudo-code.  If I look at the passage as updated in 2672, it seems like it reads as if the editor thought it was pseudo-code.

The question to ask, before DNAME, if CNAME went to an non-existent name, it seems to me that because we had followed a CNAME we'd "Otherwise just exit" because there was something at the original QNAME, just not what we wanted.

I would extend this to the DNAME era, and would "read" the DNAME rfc as if it was mid-edited, over-literalizing, etc.
--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

Discussing IPv4 address policy is like deciding what to eat on the Titanic.
--============_-937317661==_ma============-- From owner-namedroppers@ops.ietf.org Tue May 25 17:42:45 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E18843A6B58; Tue, 25 May 2010 17:42:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cJqbwtmwRgx4; Tue, 25 May 2010 17:42:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0A6973A6EC5; Tue, 25 May 2010 16:32:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OH3X1-000MTp-Tm for namedroppers-data0@psg.com; Tue, 25 May 2010 23:27:31 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OH3Wz-000MTT-15 for namedroppers@ops.ietf.org; Tue, 25 May 2010 23:27:29 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 29D29ED109; Tue, 25 May 2010 23:27:12 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4PNR9G8088781; Wed, 26 May 2010 09:27:10 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005252327.o4PNR9G8088781@drugs.dv.isc.org> To: Dan Kaminsky Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <201005251614.o4PGEVOK084328@drugs.dv.isc.org> Subject: Re: [dnsext] Engineering Requirements for Stub Chain Delivery In-reply-to: Your message of "Tue, 25 May 2010 21:49:06 +0200." Date: Wed, 26 May 2010 09:27:09 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Dan Kaminsky writes: > > A stub needs to be able to query for chain elements it is missing. > > It does not need them to be returned in a single query. =A0Such queries > > will normally be satistfied by the caching server without having > > to make additional queries especially if the caching server also > > validates the reponses it gets (before or after sending them on). > > A stub doesn't necessarily know what elements it is missing. Consider > foo.com CNAMEing through bar.com. I need a chain to root, plus a > RRSIG across the CNAME from foo.com to bar.com. > > --Dan You need to be able to validate the CNAME. One path to the root. You need to be able to validate whatever the CNAME points to. A second path to the root. This is not difficult to work out. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue May 25 18:52:40 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EAA7A3A659C; Tue, 25 May 2010 18:52:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.369 X-Spam-Level: X-Spam-Status: No, score=-0.369 tagged_above=-999 required=5 tests=[AWL=0.370, BAYES_20=-0.74] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5nC3ZZzw+X9q; Tue, 25 May 2010 18:52:38 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 495E83A63C9; Tue, 25 May 2010 18:52:38 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OH5hB-000AhT-GD for namedroppers-data0@psg.com; Wed, 26 May 2010 01:46:09 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OH5h8-000AhA-Pn for namedroppers@ops.ietf.org; Wed, 26 May 2010 01:46:06 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id BE576ED135; Wed, 26 May 2010 01:46:03 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4Q1k04k096870; Wed, 26 May 2010 11:46:01 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005260146.o4Q1k04k096870@drugs.dv.isc.org> To: Dan Kaminsky Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <201005251614.o4PGEVOK084328@drugs.dv.isc.org> <201005252327.o4PNR9G8088781@drugs.dv.isc.org> Subject: Re: [dnsext] Engineering Requirements for Stub Chain Delivery In-reply-to: Your message of "Wed, 26 May 2010 03:17:07 +0200." Date: Wed, 26 May 2010 11:46:00 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Dan Kaminsky writes: > On Wed, May 26, 2010 at 1:27 AM, Mark Andrews wrote: > > > > In message = > , Dan > > Kaminsky writes: > >> > A stub needs to be able to query for chain elements it is missing. > >> > It does not need them to be returned in a single query. =3DA0Such quer= > ies > >> > will normally be satistfied by the caching server without having > >> > to make additional queries especially if the caching server also > >> > validates the reponses it gets (before or after sending them on). > >> > >> A stub doesn't necessarily know what elements it is missing. =A0Consider > >> foo.com CNAMEing through bar.com. =A0I need a chain to root, plus a > >> RRSIG across the CNAME from foo.com to bar.com. > >> > >> --Dan > > > > You need to be able to validate the CNAME. =A0One path to the root. > > You need to be able to validate whatever the CNAME points to. =A0A second= > path > > to the root. > > > > This is not difficult to work out. > > OK. What is the set of RRSIGs necessary for www.microsoft.com? www.microsoft.com. 3582 IN CNAME toggle.www.ms.akadns.net. toggle.www.ms.akadns.net. 300 IN CNAME g.www.ms.akadns.net. g.www.ms.akadns.net. 300 IN CNAME lb1.www.ms.akadns.net. lb1.www.ms.akadns.net. 300 IN A 207.46.170.123 lb1.www.ms.akadns.net. 300 IN A 207.46.170.10 For the anwer to www.microsoft.com be secure to the end application you need to prove the each of the 3 CNAMEs above validate to secure and that lb1.www.ms.akadns.net validates to secure. You also need to check the CNAME name chain itself makes sense. Iterative nameservers do this all the time. It really isn't harder in a stub resolver. You look at the www.microsoft.com CNAME's RRSIG. This will give you a DNSKEY to lookup. You then lookup the DS for that which gives you the DNSKEY of the parent. Repeat. Do the same thing for toggle.www.ms.akadns.net, g.www.ms.akadns.net and lb1.www.ms.akadns.net in turn. If you attach a ephemeral cache to the validator you won't need to do some of the lookups as there are commonalities in the trust chains. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue May 25 19:20:39 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 74EEB3A67CC; Tue, 25 May 2010 19:20:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.105 X-Spam-Level: ** X-Spam-Status: No, score=2.105 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id glsbJsJuS9ix; Tue, 25 May 2010 19:20:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DBCC03A67DB; Tue, 25 May 2010 19:19:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OH6Ac-000DcL-9S for namedroppers-data0@psg.com; Wed, 26 May 2010 02:16:34 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OH6Aa-000Dc1-1O for namedroppers@ops.ietf.org; Wed, 26 May 2010 02:16:32 +0000 Received: from Work-Laptop-2.local (gatt.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4Q2GKHA088007; Tue, 25 May 2010 22:16:21 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz) Received: from [192.168.1.104] by Work-Laptop-2.local (PGP Universal service); Tue, 25 May 2010 22:16:27 -0400 X-PGP-Universal: processed; by Work-Laptop-2.local on Tue, 25 May 2010 22:16:27 -0400 Mime-Version: 1.0 Message-Id: Date: Tue, 25 May 2010 22:16:15 -0400 To: namedroppers@ops.ietf.org From: Edward Lewis Subject: [dnsext] CNAME and NXDOMAIN Cc: ed.lewis@neustar.biz Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: I had this additional thought - if the QNAME is pop.example.tld. and I find this: pop.example.tld. CNAME mail.example.tld. but there is no mail.example.tld... The answer cannot be NXDOMAIN because there was no error in finding the QNAME (=pop.example.tld.). QNAME owns data, a CNAME. The fact that the CNAME points to nothing is immaterial because the search for the name ended and then the QTYPE was matched to CNAME. The issue is that there is only one RCODE in a return packet and it applies to the QNAME, not where the query is redirected. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Edward Lewis NeuStar You can leave a voice message at +1-571-434-5468 Discussing IPv4 address policy is like deciding what to eat on the Titanic. From owner-namedroppers@ops.ietf.org Tue May 25 19:38:55 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 06DBD3A677D; Tue, 25 May 2010 19:38:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.74 X-Spam-Level: X-Spam-Status: No, score=-0.74 tagged_above=-999 required=5 tests=[AWL=0.370, BAYES_05=-1.11] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7cbB5PQFyFgP; Tue, 25 May 2010 19:38:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 257023A63C9; Tue, 25 May 2010 19:38:52 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OH6Qq-000FBp-V8 for namedroppers-data0@psg.com; Wed, 26 May 2010 02:33:20 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OH6Qn-000FBS-Su for namedroppers@ops.ietf.org; Wed, 26 May 2010 02:33:17 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 14726ED135; Wed, 26 May 2010 02:33:16 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4Q2XEoo098323; Wed, 26 May 2010 12:33:14 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005260233.o4Q2XEoo098323@drugs.dv.isc.org> To: Edward Lewis Cc: namedroppers@ops.ietf.org From: Mark Andrews References: Subject: Re: [dnsext] CNAME and NXDOMAIN In-reply-to: Your message of "Tue, 25 May 2010 22:16:15 -0400." Date: Wed, 26 May 2010 12:33:14 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Edward Lewis writes: > I had this additional thought - if the QNAME is pop.example.tld. and > I find this: > > pop.example.tld. CNAME mail.example.tld. > > but there is no mail.example.tld... > > The answer cannot be NXDOMAIN because there was no error in finding > the QNAME (=pop.example.tld.). QNAME owns data, a CNAME. The fact > that the CNAME points to nothing is immaterial because the search for > the name ended and then the QTYPE was matched to CNAME. > > The issue is that there is only one RCODE in a return packet and it > applies to the QNAME, not where the query is redirected. No. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue May 25 23:56:32 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 30D223A68A7; Tue, 25 May 2010 23:56:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.601 X-Spam-Level: X-Spam-Status: No, score=0.601 tagged_above=-999 required=5 tests=[BAYES_50=0.001, J_CHICKENPOX_55=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LDTVxHe2G7FW; Tue, 25 May 2010 23:56:30 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0A4E43A689E; Tue, 25 May 2010 23:56:30 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHAPI-000HtN-Gc for namedroppers-data0@psg.com; Wed, 26 May 2010 06:48:00 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHAPE-000Hs5-3b for namedroppers@ops.ietf.org; Wed, 26 May 2010 06:47:56 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 11B85A16F2 for ; Wed, 26 May 2010 06:47:54 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] CNAME and NXDOMAIN In-Reply-To: Your message of "Tue, 25 May 2010 22:16:15 -0400." References: X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Wed, 26 May 2010 06:47:54 +0000 Message-ID: <55156.1274856474@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Tue, 25 May 2010 22:16:15 -0400 > From: Edward Lewis > > I had this additional thought - if the QNAME is pop.example.tld. and I find > this: > > pop.example.tld. CNAME mail.example.tld. > > but there is no mail.example.tld... before we start, note, i concur w/ marka, who answered simply: From: Mark Andrews Date: Wed, 26 May 2010 12:33:14 +1000 No. but, let's look deeper. > The answer cannot be NXDOMAIN because there was no error in finding the > QNAME (=pop.example.tld.). QNAME owns data, a CNAME. ... your analysis went off the rails right there. +--- | 3.6.2. Aliases and canonical names | ... | RFC 1034 Domain Concepts and Facilities November 1987 | ... | CNAME RRs cause special action in DNS software. When a name server | fails to find a desired RR in the resource set associated with the | domain name, it checks to see if the resource set consists of a CNAME | record with a matching class. If so, the name server includes the CNAME | record in the response and restarts the query at the domain name | specified in the data field of the CNAME record. The one exception to | this rule is that queries which match the CNAME type are not restarted. | ... | Mockapetris [Page 15] +--- having now implemented the recursive logic several times, i can tell you that "restart the query" has seemed unambiguous to me, it means add a CNAME to the answer section and then replace the current QNAME with the target of that CNAME and try again. if in the end the last CNAME target is NXDOMAIN, then RCODE=NXDOMAIN is the response i have sent back. nobody ever complained or said that they interpreted RFC 1034 differently than i had. > ... The fact that the CNAME points to nothing is immaterial because the > search for the name ended and then the QTYPE was matched to CNAME. the query processing specified in RFC 1034 says that a CNAME RR can only be considered an answer if QTYPE=CNAME. i think you meant QNAME not QTYPE above but if you didn't then you're merely mistaken differently, or confused. > The issue is that there is only one RCODE in a return packet and it applies > to the QNAME, not where the query is redirected. there's no weakness in the spec about this. the fact that there's only one RCODE means that QCOUNT>1 is undefined, but it does not affect CNAME chains ending in nonexistent targets. either QTYPE=CNAME in which case no following will be done and the RCODE is of the CNAME RR itself, or QTYPE<>CNAME in which case chain-following will be done and RCODE is of the canonical name (at the end of the CNAME chain) and of the resulting canonical rrset. here are two illustrative examples: +--- | [ss:amd64] dig +norec +dnssec @ns.lah1.vix.com nxowner.vix.com cname | ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19776 | ;; flags: qr aa; QUERY: 1, ANSWER: 2, AUTHORITY: 6, ADDITIONAL: 7 | ;; ANSWER SECTION: | nxowner.vix.com. 3600 IN CNAME nxtarget.vix.com. | nxowner.vix.com. 3600 IN RRSIG CNAME 5 3 3600 ... +--- and: +--- | [ss:amd64] dig +norec +dnssec @ns.lah1.vix.com nxowner.vix.com aaaa | ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 65414 | ;; flags: qr aa; QUERY: 1, ANSWER: 2, AUTHORITY: 6, ADDITIONAL: 1 | ;; ANSWER SECTION: | nxowner.vix.com. 3600 IN CNAME nxtarget.vix.com. | nxowner.vix.com. 3600 IN RRSIG CNAME 5 3 3600 ... | ;; AUTHORITY SECTION: | vix.com. 3600 IN NSEC ns-lah1._meta.vix.com. \ | A NS SOA MX TXT AAAA RRSIG NSEC DNSKEY | vix.com. 3600 IN RRSIG NSEC 5 2 3600 ... | nxowner.vix.com. 3600 IN NSEC oj.vix.com. \ | CNAME RRSIG NSEC | nxowner.vix.com. 3600 IN RRSIG NSEC 5 3 3600 ... +--- From owner-namedroppers@ops.ietf.org Wed May 26 00:09:59 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51C8F3A688D; Wed, 26 May 2010 00:09:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.55 X-Spam-Level: ** X-Spam-Status: No, score=2.55 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_NL=0.55, HELO_MISMATCH_NL=1.448, RCVD_IN_DNSWL_LOW=-1, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o0kKgAVlvdsb; Wed, 26 May 2010 00:09:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1A48C3A688C; Wed, 26 May 2010 00:09:58 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHAfC-000Jqj-HN for namedroppers-data0@psg.com; Wed, 26 May 2010 07:04:26 +0000 Received: from [85.17.178.138] (helo=rotring.dds.nl) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHAf7-000Jq4-PO for namedroppers@ops.ietf.org; Wed, 26 May 2010 07:04:22 +0000 Received: from localhost (localhost [127.0.0.1]) by rotring.dds.nl (Postfix) with ESMTP id 659B95800C; Wed, 26 May 2010 09:04:20 +0200 (CEST) Received: from [192.168.254.1] (195-241-9-117.adsl.dds.nl [195.241.9.117]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by rotring.dds.nl (Postfix) with ESMTP id B9DAD583C8; Wed, 26 May 2010 09:04:05 +0200 (CEST) Message-ID: <4BFCC7E1.1020806@nlnetlabs.nl> Date: Wed, 26 May 2010 09:04:01 +0200 From: "W.C.A. Wijngaards" User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100430 Fedora/3.0.4-2.fc11 Thunderbird/3.0.4 MIME-Version: 1.0 To: George Barwood CC: Stephane Bortzmeyer , namedroppers@ops.ietf.org Subject: Re: [dnsext] [DNAME] What to do when it points to a non-existing name? References: <20100525151823.GA16847@nic.fr> <12DBB31C3E2F406DA62B82C933C56ABF@local> In-Reply-To: <12DBB31C3E2F406DA62B82C933C56ABF@local> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: clamav-milter 0.95.3 at rotring X-Virus-Status: Clean Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi George, On 05/26/2010 12:20 AM, George Barwood wrote: >> When the synthetized CNAME goes to a non-existing domain, what does a >> recursive resolver return? NXDOMAIN? NOERROR? BIND and Unbound behave >> differently. Unbound (and the maintainer claims he is right and that >> no RFC mandates a specific behaviour): OK, now I see 1034 4.3.2-3-c. The query name is not the original name, therefore the name error is not set. This is for CNAMEs, but a DNAME (having a synthesized CNAME to go with it) is to be treated the same I should think. > [snip] > > I think it must return a name error (NXDOMAIN). Not that that is impossible, its just not what I thought the specs say. > From RFC 1034, Section 4.3.1 > << > If recursive service is requested and available, the recursive response > to a query will be one of the following: > > - The answer to the query, possibly preface by one or more CNAME > RRs that specify aliases encountered on the way to an answer. > > - A name error indicating that the name does not exist. This > may include CNAME RRs that indicate that the original query > name was an alias for a name which does not exist. >>> Yes that points to name error possible. > > That seems quite explicit to me. > > The section just below > > If the "*" label does not exist, check whether the name we are > looking for is the original QNAME in the query or a name we > have followed due to a CNAME. If the name is original, set an > authoritative name error in the response and exit. Otherwise > just exit. > > does not apply for recursive service. one) yes this does apply to recursive service, it even talks about using the resolver and cache. two) this is indeed the 'if the name is original' text. three) it's weird for authority and recursor to send a different rcode for the same event (cname to not-existing-name). > My take is that Unbound is erronesous here. > It seems to get it wrong even in the plain CNAME case ( I made a test ). > DNAME should surely be treated the same as CNAME, although I have not > attempted to verify what the DNAME standard says. This was by design... > > Hmm.. I feel a bit uneasy now, as if I'm missing something. Yes, I admit to taking my understanding of NSD (authority service) and thus that line in the wildcard treatment, and coding Unbound's CNAME behaviour from that. Best regards, Wouter -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkv8x+EACgkQkDLqNwOhpPh/0wCdHqIU2YRehjXX8AeV6UrWIe0B 4BEAnixBlJzEOgXbc8GPNNg1hIF7WcvO =o9NU -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Wed May 26 00:28:21 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EAAAC3A67AF; Wed, 26 May 2010 00:28:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.85 X-Spam-Level: ** X-Spam-Status: No, score=2.85 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_NL=0.55, HELO_MISMATCH_NL=1.448, J_CHICKENPOX_55=0.6, RCVD_IN_DNSWL_LOW=-1, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dBa2fZ9vrfu3; Wed, 26 May 2010 00:28:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 038BE3A66B4; Wed, 26 May 2010 00:28:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHAyw-000MEK-00 for namedroppers-data0@psg.com; Wed, 26 May 2010 07:24:50 +0000 Received: from [85.17.178.138] (helo=rotring.dds.nl) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHAys-000MDh-AR for namedroppers@ops.ietf.org; Wed, 26 May 2010 07:24:46 +0000 Received: from localhost (localhost [127.0.0.1]) by rotring.dds.nl (Postfix) with ESMTP id 18111583CA; Wed, 26 May 2010 09:24:45 +0200 (CEST) Received: from [192.168.254.1] (195-241-9-117.adsl.dds.nl [195.241.9.117]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by rotring.dds.nl (Postfix) with ESMTP id DB08858155; Wed, 26 May 2010 09:24:26 +0200 (CEST) Message-ID: <4BFCCCAA.5000102@nlnetlabs.nl> Date: Wed, 26 May 2010 09:24:26 +0200 From: "W.C.A. Wijngaards" User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100430 Fedora/3.0.4-2.fc11 Thunderbird/3.0.4 MIME-Version: 1.0 To: Paul Vixie CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] CNAME and NXDOMAIN References: <55156.1274856474@nsa.vix.com> In-Reply-To: <55156.1274856474@nsa.vix.com> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: clamav-milter 0.95.3 at rotring X-Virus-Status: Clean Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Paul, On 05/26/2010 08:47 AM, Paul Vixie wrote: >> From: Edward Lewis >> I had this additional thought - if the QNAME is pop.example.tld. and I find >> this: > before we start, note, i concur w/ marka, who answered simply: > No. However, this line of reasoning is why NOERROR is returned. Since the QNAME exists. And 'if the query is original' line from the algorithm. > the query processing specified in RFC 1034 says that a CNAME RR can only be > considered an answer if QTYPE=CNAME. i think you meant QNAME not QTYPE above > but if you didn't then you're merely mistaken differently, or confused. Actually, maybe not. Perhaps the user wants the CNAME that the CNAME is pointing to with its QTYPE=CNAME? (or could be pointing to if you modify your example). Otherwise, how could the user specify he wanted the second or third link in the chain of redirections? It makes sense to return the entire chain as far as it goes, lookup of the x-th CNAME in the packet is very easy for the client, making it follow the chain itself is hard (and the chain may change while it is working on it). [Ed says:] >> The issue is that there is only one RCODE in a return packet and it applies >> to the QNAME, not where the query is redirected. Yes I think this is. You sometimes also get referrals after a CNAME for example ... and there is but one AA flag. (more evidence that QCOUNT!=1 is not easy). Best regards, Wouter -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkv8zKoACgkQkDLqNwOhpPgfegCeNTyKPUSmaeGPkMuEjtfNxXKF VJQAoJ73g30ibeQtV1AhfhNbIHFHGeh/ =rstS -----END PGP SIGNATURE----- From dnsext-archive@lists.ietf.org Wed May 26 05:30:57 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 77D2F3A687C for ; Wed, 26 May 2010 05:30:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -23.431 X-Spam-Level: X-Spam-Status: No, score=-23.431 tagged_above=-999 required=5 tests=[BAYES_60=1, HELO_EQ_DSL=1.129, HELO_EQ_PL=1.135, HOST_EQ_PL=1.95, HTML_IMAGE_ONLY_16=1.526, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_2=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WprXFW0H5fUu for ; Wed, 26 May 2010 05:30:50 -0700 (PDT) Received: from idv250.internetdsl.tpnet.pl (idv250.internetdsl.tpnet.pl [79.189.99.250]) by core3.amsl.com (Postfix) with SMTP id 23B693A691F for ; Wed, 26 May 2010 05:30:48 -0700 (PDT) To: Subject: Delivery Status Notification From: MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20100526123049.23B693A691F@core3.amsl.com> Date: Wed, 26 May 2010 05:30:48 -0700 (PDT)
Click here to view as a web page.

To dnsext-archive@lists.ietf.org | Privacy Policy | Contact Us

Copyright 2010 All rights reserved.
From owner-namedroppers@ops.ietf.org Wed May 26 07:46:23 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D66523A6970; Wed, 26 May 2010 07:46:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.445 X-Spam-Level: * X-Spam-Status: No, score=1.445 tagged_above=-999 required=5 tests=[AWL=-0.444, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lCGyD8W2xo4H; Wed, 26 May 2010 07:46:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F25D33A6968; Wed, 26 May 2010 07:46:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHHkJ-0001Lw-PU for namedroppers-data0@psg.com; Wed, 26 May 2010 14:38:11 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHHkH-0001LR-C4 for namedroppers@ops.ietf.org; Wed, 26 May 2010 14:38:09 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 61EA51ECB408 for ; Wed, 26 May 2010 14:38:07 +0000 (UTC) Date: Wed, 26 May 2010 10:38:05 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] CNAME and NXDOMAIN Message-ID: <20100526143805.GF24415@shinkuro.com> References: <55156.1274856474@nsa.vix.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <55156.1274856474@nsa.vix.com> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, May 26, 2010 at 06:47:54AM +0000, Paul Vixie wrote: > then RCODE=NXDOMAIN is the response i have sent back. nobody ever complained > or said that they interpreted RFC 1034 differently than i had. It seems that at least two people in this thread say they do interpret 1034 differently than you have, though. With my hat on, this does look as though something clarifying what is expected (or even saying that more than one response is justified) could be helpful, assuming we could reach consensus. But it looks like a new work item, I think? Is someone volunteering? A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Wed May 26 09:26:30 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9BC503A68CE; Wed, 26 May 2010 09:26:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.601 X-Spam-Level: X-Spam-Status: No, score=0.601 tagged_above=-999 required=5 tests=[BAYES_50=0.001, J_CHICKENPOX_55=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rDOAo5s4kHOn; Wed, 26 May 2010 09:26:29 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 98B8F3A6862; Wed, 26 May 2010 09:26:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHJMU-000HDv-0i for namedroppers-data0@psg.com; Wed, 26 May 2010 16:21:42 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHJMO-000HD6-TN for namedroppers@ops.ietf.org; Wed, 26 May 2010 16:21:36 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 9A0ADA1930 for ; Wed, 26 May 2010 16:21:35 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] CNAME and NXDOMAIN In-Reply-To: Your message of "Wed, 26 May 2010 09:24:26 +0200." <4BFCCCAA.5000102@nlnetlabs.nl> References: <55156.1274856474@nsa.vix.com> <4BFCCCAA.5000102@nlnetlabs.nl> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Wed, 26 May 2010 16:21:35 +0000 Message-ID: <87713.1274890895@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Wed, 26 May 2010 09:24:26 +0200 > From: "W.C.A. Wijngaards" > > > the query processing specified in RFC 1034 says that a CNAME RR can > > only be considered an answer if QTYPE=CNAME. i think you meant QNAME > > not QTYPE above but if you didn't then you're merely mistaken > > differently, or confused. > > Actually, maybe not. Perhaps the user wants the CNAME that the CNAME is > pointing to with its QTYPE=CNAME? (or could be pointing to if you > modify your example). Otherwise, how could the user specify he wanted > the second or third link in the chain of redirections? they'd have to chase it one transaction at a time with QTYPE=CNAME on each. > It makes sense to return the entire chain as far as it goes, lookup of > the x-th CNAME in the packet is very easy for the client, making it > follow the chain itself is hard (and the chain may change while it is > working on it). QTYPE<>CNAME has exactly that behaviour. From owner-namedroppers@ops.ietf.org Wed May 26 10:36:26 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A89153A682D; Wed, 26 May 2010 10:36:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.439 X-Spam-Level: ** X-Spam-Status: No, score=2.439 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, IP_NOT_FRIENDLY=0.334, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uB0bUYHMEB7H; Wed, 26 May 2010 10:36:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 728693A6866; Wed, 26 May 2010 10:36:16 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHKQm-00018z-7l for namedroppers-data0@psg.com; Wed, 26 May 2010 17:30:12 +0000 Received: from [67.215.68.163] (helo=mail.opendns.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHKQi-00018T-7P for namedroppers@ops.ietf.org; Wed, 26 May 2010 17:30:08 +0000 Received: from [67.215.69.50] ([67.215.69.50]) (authenticated bits=0) by mail.opendns.com (8.14.3/8.14.3/Debian-5) with ESMTP id o4QHU6jm008657 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 26 May 2010 17:30:07 GMT Message-ID: <4BFD5A96.2020409@opendns.com> Date: Wed, 26 May 2010 10:29:58 -0700 From: Noah Treuhaft User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: namedroppers@ops.ietf.org Subject: Re: [dnsext] CNAME and NXDOMAIN References: <55156.1274856474@nsa.vix.com> <20100526143805.GF24415@shinkuro.com> In-Reply-To: <20100526143805.GF24415@shinkuro.com> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 5/26/2010 7:38 AM Pacific, Andrew Sullivan wrote: > On Wed, May 26, 2010 at 06:47:54AM +0000, Paul Vixie wrote: > >> then RCODE=NXDOMAIN is the response i have sent back. nobody ever complained >> or said that they interpreted RFC 1034 differently than i had. > > It seems that at least two people in this thread say they do interpret > 1034 differently than you have, though. My reading of RFC 2308 is that it supports Paul's interpretation without ambiguity (though I've been meaning to get myself to the optometrist for a while now). ---- RFC 2308 DNS NCACHE March 1998 ... 1 - Terminology ... "QNAME" - the name in the query section of an answer, or where this resolves to a CNAME, or CNAME chain, the data field of the last CNAME. The last CNAME in this sense is that which contains a value which does not resolve to another CNAME. ... ... 2.1 - Name Error Name errors (NXDOMAIN) are indicated by the presence of "Name Error" in the RCODE field. In this case the domain referred to by the QNAME does not exist. Note: the answer section may have SIG and CNAME RRs and the authority section may have SOA, NXT [RFC2065] and SIG RRsets. ---- From dnsext-archive@ietf.org Wed May 26 15:22:12 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 190D33A6A3C for ; Wed, 26 May 2010 15:22:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -24.493 X-Spam-Level: X-Spam-Status: No, score=-24.493 tagged_above=-999 required=5 tests=[BAYES_80=2, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_3=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kR54hel+0qmT for ; Wed, 26 May 2010 15:22:10 -0700 (PDT) Received: from allencanning.com (unknown [91.99.245.28]) by core3.amsl.com (Postfix) with SMTP id 2BF3F3A6A2C for ; Wed, 26 May 2010 15:22:05 -0700 (PDT) To: Subject: Your order From: MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20100526222206.2BF3F3A6A2C@core3.amsl.com> Date: Wed, 26 May 2010 15:22:05 -0700 (PDT)
Click here to view as a web page.

To dnsext-archive@ietf.org | Privacy Policy | Contact Us

Copyright 2010 All rights reserved.
From dnsext-archive@lists.ietf.org Wed May 26 19:13:11 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1AB9E3A6A91 for ; Wed, 26 May 2010 19:13:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -23.493 X-Spam-Level: X-Spam-Status: No, score=-23.493 tagged_above=-999 required=5 tests=[BAYES_95=3, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_3=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s6xW1ai3xZz4 for ; Wed, 26 May 2010 19:13:10 -0700 (PDT) Received: from aaeon.com (unknown [190.21.131.95]) by core3.amsl.com (Postfix) with SMTP id C1E393A6A8F for ; Wed, 26 May 2010 19:13:08 -0700 (PDT) To: Subject: Your order From: MIME-Version: 1.0 Importance: High Content-Type: text/html X-Antivirus: avast! (VPS 091030-0, 30/10/2009), Outbound message X-Antivirus-Status: Clean Message-Id: <20100527021308.C1E393A6A8F@core3.amsl.com> Date: Wed, 26 May 2010 19:13:08 -0700 (PDT)
Click here to view as a web page.

To dnsext-archive@lists.ietf.org | Privacy Policy | Contact Us

Copyright 2010 All rights reserved.
From owner-namedroppers@ops.ietf.org Thu May 27 01:39:32 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 54F7F3A6A79; Thu, 27 May 2010 01:39:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.1 X-Spam-Level: X-Spam-Status: No, score=-99.1 tagged_above=-999 required=5 tests=[BAYES_50=0.001, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0JYz9OP0FoHu; Thu, 27 May 2010 01:39:31 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 44DF53A6A6C; Thu, 27 May 2010 01:39:31 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHYVB-0009iE-8j for namedroppers-data0@psg.com; Thu, 27 May 2010 08:31:41 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHYV5-0009hG-Gr for namedroppers@ops.ietf.org; Thu, 27 May 2010 08:31:35 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id 8A0AB7344EA; Thu, 27 May 2010 10:31:33 +0200 (CEST) Message-ID: <4BFE2DE5.2020701@nic.cz> Date: Thu, 27 May 2010 10:31:33 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: Paul Vixie CC: =?UTF-8?B?QWxmcmVkIO+/vQ==?= , namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005202235.AAA16483@TR-Sys.de> <80834.1274396391@nsa.vix.com> In-Reply-To: <80834.1274396391@nsa.vix.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 21.5.2010 00:59, Paul Vixie wrote: >> From: Alfred Hönes >> Date: Fri, 21 May 2010 00:35:19 +0200 (MESZ) >> ... >> I.e.: Why not making IXFR-only the normal behavior for IXFR? > > because there's a degenerate case of single packet axfr (for very small > zones) that was thought interesting by the WG at the time of RFC 1995. > >> Please note that I already had mentioned twice on this list that after >> axfr-clarify (now in RFC-EDITOR state) is out, significant parts of RFC >> 1995 regarding AXFR will be moot anyway; this WG has decided in Spring >> 2008 (IIRC) that AXFR MUST NOT happen over UDP; RFC 1995 seems to request >> supporting that. :-( > > good catch. > >> As already indicated, IMO a thorough revision of RFC 1995 should be >> the pathway to hell to go; if it turns out that backward compatibility >> requirements do not allow changing IXFR to IXFR-only behavior (at the >> IXFR server), IXFR-ONLY could be defined in a single document with >> IXFR, otherwise a standalone document would not be needed anyway. > > i agree. I agree as well and would help to make that happen -> that means ixfr-clarify or IXFRbis RFC, am I right? Brian's comment about client not knowing if the server is IXFRwithFallback or IXFRwithoutFallback is valid, but it's not big burden, because you have only limited set of masters and you have some contractual partnership with them, so you can ask them to upgrade their servers. Ondrej -- OndÅ™ej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- LaboratoÅ™e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Thu May 27 01:41:08 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AC8D43A6A79; Thu, 27 May 2010 01:41:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.1 X-Spam-Level: X-Spam-Status: No, score=-99.1 tagged_above=-999 required=5 tests=[BAYES_50=0.001, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c9JwrDhMz37K; Thu, 27 May 2010 01:41:07 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B7D9B3A6A75; Thu, 27 May 2010 01:41:07 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHYbT-000AZA-IH for namedroppers-data0@psg.com; Thu, 27 May 2010 08:38:11 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHYbQ-000AYj-FC for namedroppers@ops.ietf.org; Thu, 27 May 2010 08:38:08 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id 847EE734384; Thu, 27 May 2010 10:38:07 +0200 (CEST) Message-ID: <4BFE2F6F.20600@nic.cz> Date: Thu, 27 May 2010 10:38:07 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: Dave Knight CC: Joe Abley , namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <20100514145956.GF65855@shinkuro.com> <4BF52F40.6070401@nlnetlabs.nl> <05A58828-A355-4716-8BBC-A10227B4D982@hopcount.ca> <4BF58CDD.60209@nlnetlabs.nl> <7542AD90-8315-41BC-98B2-D63B0C7B15C2@hopcount.ca> <9EC61B80-841C-4DFB-968C-1F880CED5A4C@knig.ht> In-Reply-To: <9EC61B80-841C-4DFB-968C-1F880CED5A4C@knig.ht> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 20.5.2010 23:18, Dave Knight wrote: > > On 2010-05-20, at 4:04 PM, Joe Abley wrote: >> >> On 2010-05-20, at 15:26, Matthijs Mekking wrote: >> >>> Joe Abley wrote: >>>> On 2010-05-20, at 08:46, Matthijs Mekking wrote: >>>> >>>> What if you want to disable AXFR responses to IXFR queries only >>>> for certain servers, or at certain times of day, or at times of >>>> low network congestion, or due to some other heuristic that the >>>> authority-only server author did not think of? >>> >>> Point taken, but imho this is irrelevant: the IXFR-ONLY draft >>> does not implement these heuristics either. >> >> The point is not whether those heuristics are anticipated by the >> IXFR-ONLY proposal, but that some mechanism exists for a client to >> request an IXFR without receiving an AXFR response. >> >> he important bit to understand is that it's the client that ought >> to make the decision, and that the decision is in the general case >> not predictable by the server. >> >>> The problem definition in my eyes is that you want to prevent a >>> full zone transfer. I can see perfectly valid reasons why you >>> want to. I think a turn on|off configuration option suits more >>> than a technical solution to solve this. >> >> Sure, an on/off configuration option on the client seems like an >> entirely reasonable way (amongst others) to implement this. But the >> client still needs a way to signal to the server that it does not >> want to receive an AXFR response. This proposal seems to >> encapsulate a clean way of carrying out that signalling. > > It's not that the client doesn't ever want an AXFR response, rather > it wants the opportunity to get an IXFR by walking through each > master to see if one of them can provide the required delta. In the > case where no master can provide the required delta the client may > then want to fall back to AXFR. Well, the client could also fallback to some other "more efficient" method of getting full zone (f.e. pulling diff via ssh :)). Ondrej -- OndÅ™ej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- LaboratoÅ™e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Thu May 27 01:43:54 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A31ED3A6893; Thu, 27 May 2010 01:43:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.1 X-Spam-Level: X-Spam-Status: No, score=-99.1 tagged_above=-999 required=5 tests=[BAYES_50=0.001, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xAGpaHlQdE7C; Thu, 27 May 2010 01:43:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9336C3A6849; Thu, 27 May 2010 01:43:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHYe2-000Awa-Du for namedroppers-data0@psg.com; Thu, 27 May 2010 08:40:50 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHYdy-000Aug-15 for namedroppers@ops.ietf.org; Thu, 27 May 2010 08:40:46 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id 1D37673446B; Thu, 27 May 2010 10:40:40 +0200 (CEST) Message-ID: <4BFE3007.4010208@nic.cz> Date: Thu, 27 May 2010 10:40:39 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: Jaap Akkerhuis CC: "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> In-Reply-To: <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 20.5.2010 14:02, Jaap Akkerhuis wrote: > > > I quickly scanned this document and was surprised to see in Section > > 2. IXRF Server Side: > > > > > > A IXFR server receiving a DNS message requesting IXFR-ONLY will reply > > as described in RFC 1995 [RFC1995] if it is able to produce an IXFR > > for the serial number requested. > > > > Maybe I'm wrong but I always thought that an IXRF request had as > > data the current serial from the requester and that the server only > > when it is "higher" (according to the serial arithmetic). > > A IXFR server can return up-to-date, a delta style response or > a axfr style responses. > > IXFR-ONLY removes the latter. > > Yes, but that is not the point. > > The draft says "the serial number requested" but as far as I know > you doesn't send the serial number you want, you sent the serial > you have. > > To give a full citation of RFC 1995: > > > 3. Query Format > > The IXFR query packet format is the same as that of a normal DNS > query, but with the query type being IXFR and the authority section > containing the SOA record of client's version of the zone. > > This is quite different then what the draft states. The draft doesn't say whether "the serial number requested" is the serial number you want or serial number you have. It merely states that the server is able to produce IXFR response for the serial number requested, not saying anything about serial number sent in response. But maybe it needs rewording, so it is more clear. O -- OndÅ™ej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- LaboratoÅ™e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Thu May 27 01:48:12 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EDEB63A6A3B; Thu, 27 May 2010 01:48:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.5 X-Spam-Level: X-Spam-Status: No, score=-98.5 tagged_above=-999 required=5 tests=[AWL=-0.600, BAYES_50=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_54=0.6, J_CHICKENPOX_55=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xYwMzVJOtd1q; Thu, 27 May 2010 01:48:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D14D23A69B8; Thu, 27 May 2010 01:48:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHYhy-000BW6-W3 for namedroppers-data0@psg.com; Thu, 27 May 2010 08:44:54 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHYhu-000BVS-Jy for namedroppers@ops.ietf.org; Thu, 27 May 2010 08:44:50 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id C2D2D7344EA; Thu, 27 May 2010 10:44:44 +0200 (CEST) Message-ID: <4BFE30FC.3060308@nic.cz> Date: Thu, 27 May 2010 10:44:44 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: "W.C.A. Wijngaards" CC: Edward Lewis , namedroppers@ops.ietf.org Subject: Re: [dnsext] Lookup ambiguity of CNAME and DNAME References: <4BF69674.9070006@nlnetlabs.nl> In-Reply-To: <4BF69674.9070006@nlnetlabs.nl> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 21.5.2010 16:19, W.C.A. Wijngaards wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Ed, > > Agreed that a query for qtype=DNAME would in this situation not give the > expected answer with older versions of software. > > But I previously posted some CNAME text for dnssec-bis-updates that > proposes to solve an almost identical case but with a NSEC or RRSIG next > to the CNAME and with qtype=NSEC. So, current caches follow the CNAME > but this is not good for answers that can be proven. > > I believe this similarity is what Ondrej was trying to convey to you. Yes, that's true. I am only pointing that we have been able to solve this sort of problems. The reason why I am proposing CNAME+DNAME is that it seems to me that we can get this functionality right now and cost would only be to upgrade authoritative servers. (But several people has stated that it's not true due different implementation details.) > Reliable elicitation of the types can be gotten due to their special > processing. For DNAME prepend a label, for NSEC ask for qtype=Null, for > RRSIG set DO flag. True. > Not that this is pretty and I'm dodging the wildcards :-) Wildcards are non-issue. As Mark has already stated, all it takes is to forbid DNAME at wildcard. You can't have it all :). Ondrej -- OndÅ™ej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- LaboratoÅ™e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Thu May 27 20:44:22 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 48F333A67B5; Thu, 27 May 2010 20:44:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.632 X-Spam-Level: X-Spam-Status: No, score=-0.632 tagged_above=-999 required=5 tests=[AWL=-0.137, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1jVTTsSPfEg1; Thu, 27 May 2010 20:44:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5C05E3A6452; Thu, 27 May 2010 20:44:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHqMD-0009DH-Ul for namedroppers-data0@psg.com; Fri, 28 May 2010 03:35:37 +0000 Received: from [74.125.82.52] (helo=mail-ww0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHqMA-0009Cl-JD for namedroppers@ops.ietf.org; Fri, 28 May 2010 03:35:34 +0000 Received: by wwg30 with SMTP id 30so659192wwg.11 for ; Thu, 27 May 2010 20:35:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:content-type; bh=MEk18cHnWNdlN6cxMWnrXTcVSI53UUdC12sNJJACvV4=; b=xzqM5CEzuM1vI6ab/8CXetZMTR1ytoiT71ZoSP0xuZEmPA0dgKMAUYtKBelx5DzKh7 cqdeJrNebWHxfNoYBmG1Bsr0JKq2r2gN/7CTx6nnMGYiYE9dVYrW7XMb3k75Imu5gACY D0aEQ3rfxf0S6sifTkWQorZq6W+Sqk1CKfXHs= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=ZX8ExISw7rah/NfDIP/cODZmUVRcmWPHrLgI2p7FKfgvwrCuR1kAaS76FgobT7JwMe K1zDVygUzC9r0hn/gm8sIHspWB+IHzgydSlXkCya+G68EdEHVJPVT6p1pEEq6ln8U+OZ RuYCPv0hfrdIyJmyoKkVE3yyROKoTiaEbJbqc= MIME-Version: 1.0 Received: by 10.216.85.11 with SMTP id t11mr1220471wee.55.1275017732802; Thu, 27 May 2010 20:35:32 -0700 (PDT) Received: by 10.216.229.210 with HTTP; Thu, 27 May 2010 20:35:32 -0700 (PDT) In-Reply-To: <4BFCCCAA.5000102@nlnetlabs.nl> References: <55156.1274856474@nsa.vix.com> <4BFCCCAA.5000102@nlnetlabs.nl> Date: Thu, 27 May 2010 23:35:32 -0400 Message-ID: Subject: Re: [dnsext] CNAME and NXDOMAIN From: Donald Eastlake To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: To try to clarify this issue, I have posted draft-eastlake-dnsext-xnamercode-00 Thanks, Donald ============================= Donald E. Eastlake 3rd +1-508-333-2270 (cell) 155 Beaver Street Milford, MA 01757 USA d3e3e3@gmail.com From owner-namedroppers@ops.ietf.org Fri May 28 01:00:14 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7B0A13A680A; Fri, 28 May 2010 01:00:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.349 X-Spam-Level: X-Spam-Status: No, score=-103.349 tagged_above=-999 required=5 tests=[BAYES_50=0.001, HELO_EQ_FR=0.35, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4VTHrTGGprHo; Fri, 28 May 2010 01:00:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 821383A6811; Fri, 28 May 2010 01:00:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHuOy-000Ewh-JZ for namedroppers-data0@psg.com; Fri, 28 May 2010 07:54:44 +0000 Received: from [2001:660:3003:2::4:11] (helo=mx2.nic.fr) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHuOt-000Ets-Ff for namedroppers@ops.ietf.org; Fri, 28 May 2010 07:54:39 +0000 Received: from mx2.nic.fr (localhost [127.0.0.1]) by mx2.nic.fr (Postfix) with SMTP id 6F4941C00F5; Fri, 28 May 2010 09:54:38 +0200 (CEST) Received: from relay1.nic.fr (relay1.nic.fr [192.134.4.162]) by mx2.nic.fr (Postfix) with ESMTP id 6AC901C0017; Fri, 28 May 2010 09:54:38 +0200 (CEST) Received: from bortzmeyer.nic.fr (batilda.nic.fr [192.134.4.69]) by relay1.nic.fr (Postfix) with ESMTP id 67F04A1DC30; Fri, 28 May 2010 09:54:38 +0200 (CEST) Date: Fri, 28 May 2010 09:54:38 +0200 From: Stephane Bortzmeyer To: Alfred =?iso-8859-1?Q?H=F6nes?= Cc: segred@ics.forth.gr, namedroppers@ops.ietf.org Subject: [dnsext] Re: On adoption of two drafts ... Message-ID: <20100528075438.GA17390@nic.fr> References: <201005191433.QAA13726@TR-Sys.de> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <201005191433.QAA13726@TR-Sys.de> X-Operating-System: Debian GNU/Linux 5.0.4 X-Kernel: Linux 2.6.26-2-686 i686 Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, May 19, 2010 at 04:33:26PM +0200, Alfred Hönes wrote a message of 92 lines which said: > Wasn't it one of the fundamental characteristics of the DNS that DNS > labels are _not_ "words" (in any language), but simply abstract > _identifiers_ That's what people like John Klensin keep repeating but repetition does not make it true. Either DNS labels are semantic-free identifiers (like the phone numbers), whose sole advantage (but it is a big one) over IP addresses is the stability. That way, everyone would be equal, whether they speak english or german or greek or arabic. And everyone would be unhappy. Or DNS labels are mnemonics and it is more convenient but it has bad consequences (TLD registration rules, UDRP, etc) and it means we have a responsability to be sure that these mnemonics can be written in any script (hence IDNA). [I used "mnemonics" instead of "words" to emphasize that, even in english, you cannot have every name for a DNS label, for instance "O'Reilly" or "Bang & Olufsen".] > I vaguely recall from IDNA discussion on the use of IDNA with the > Arabic languages (and scripts) that it had been reported to the IETF > community that "The hardest part in this work was to escape from the > (mis)concept of a couple of stakeholders that DNS labels were > 'words' in one of the Arabic languages and therefore linguistic > rules would have to be superimposed on DNS labels." It is not a misconcept. From owner-namedroppers@ops.ietf.org Fri May 28 04:07:55 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BE1FB3A6A27; Fri, 28 May 2010 04:07:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.999 X-Spam-Level: X-Spam-Status: No, score=-99.999 tagged_above=-999 required=5 tests=[BAYES_50=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id shKbeVaGX5q4; Fri, 28 May 2010 04:07:44 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 489763A6A1D; Fri, 28 May 2010 04:07:41 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHxHS-000GDv-5J for namedroppers-data0@psg.com; Fri, 28 May 2010 10:59:10 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHxHJ-000G1F-EA for namedroppers@ops.ietf.org; Fri, 28 May 2010 10:59:07 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4SAsV8U027948; Fri, 28 May 2010 10:54:47 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4SArhug027945; Fri, 28 May 2010 10:53:43 GMT Date: Fri, 28 May 2010 10:53:38 +0000 From: bmanning@vacation.karoshi.com To: Stephane Bortzmeyer Cc: Alfred =?iso-8859-1?Q?H=F6nes?= , segred@ics.forth.gr, namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: On adoption of two drafts ... Message-ID: <20100528105338.GA27888@vacation.karoshi.com.> References: <201005191433.QAA13726@TR-Sys.de> <20100528075438.GA17390@nic.fr> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20100528075438.GA17390@nic.fr> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 28, 2010 at 09:54:38AM +0200, Stephane Bortzmeyer wrote: > On Wed, May 19, 2010 at 04:33:26PM +0200, > Alfred Hvnes wrote > a message of 92 lines which said: > > > Wasn't it one of the fundamental characteristics of the DNS that DNS > > labels are _not_ "words" (in any language), but simply abstract > > _identifiers_ > > That's what people like John Klensin keep repeating but repetition > does not make it true. > > Either DNS labels are semantic-free identifiers (like the phone > numbers), whose sole advantage (but it is a big one) over IP addresses > is the stability. That way, everyone would be equal, whether they > speak english or german or greek or arabic. And everyone would be > unhappy. > > Or DNS labels are mnemonics and it is more convenient but it has bad > consequences (TLD registration rules, UDRP, etc) and it means we have > a responsability to be sure that these mnemonics can be written in any > script (hence IDNA). > > [I used "mnemonics" instead of "words" to emphasize that, even in > english, you cannot have every name for a DNS label, for instance > "O'Reilly" or "Bang & Olufsen".] > > > I vaguely recall from IDNA discussion on the use of IDNA with the > > Arabic languages (and scripts) that it had been reported to the IETF > > community that "The hardest part in this work was to escape from the > > (mis)concept of a couple of stakeholders that DNS labels were > > 'words' in one of the Arabic languages and therefore linguistic > > rules would have to be superimposed on DNS labels." > > It is not a misconcept. Sorry, but I side w/ John and Alfred. A DNS label is a string with (well) defined construction. Any semantic value is in the eye of the beholder and is not intrinsically part of the string. Ergo, any memnonic value is tied to how a string is sold/marketed and is not intrinsically part of the string. --bill From owner-namedroppers@ops.ietf.org Fri May 28 04:44:46 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7BB853A6822; Fri, 28 May 2010 04:44:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.459 X-Spam-Level: X-Spam-Status: No, score=-101.459 tagged_above=-999 required=5 tests=[BAYES_40=-0.185, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bqDvQvfJlL7N; Fri, 28 May 2010 04:44:45 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8F2443A6781; Fri, 28 May 2010 04:44:45 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHxvr-000MVD-5s for namedroppers-data0@psg.com; Fri, 28 May 2010 11:40:55 +0000 Received: from [216.239.44.51] (helo=smtp-out.google.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHxvo-000MUj-Hu for namedroppers@ops.ietf.org; Fri, 28 May 2010 11:40:52 +0000 Received: from kpbe17.cbf.corp.google.com (kpbe17.cbf.corp.google.com [172.25.105.81]) by smtp-out.google.com with ESMTP id o4SBelwM009424 for ; Fri, 28 May 2010 04:40:50 -0700 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1275046850; bh=H3HhDISDUJFZ2z5nSQss2Tdt7Kw=; h=MIME-Version:In-Reply-To:References:Date:Message-ID:Subject:From: To:Cc:Content-Type; b=VbHFiPV7p95WlxI119u7n2eQKROI31WiPCkdnK1XiaaMaVmU2ojvVmXbMlbc2lCpj WyaSNU9U32R/DTpUzsEvQ== DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=mime-version:in-reply-to:references:date:message-id:subject:from:to: cc:content-type:x-system-of-record; b=ytAh779D899STAzgyPYnEE9+Rx6XORAhtSlLI2Kk8jzCs96O7kqMM95VAHJczAC1J JAcNoUdY85a6i6A8oz7Ng== Received: from ey-out-1920.google.com (eye13.prod.google.com [10.208.5.13]) by kpbe17.cbf.corp.google.com with ESMTP id o4SBekOB027992 for ; Fri, 28 May 2010 04:40:46 -0700 Received: by ey-out-1920.google.com with SMTP id 13so423182eye.2 for ; Fri, 28 May 2010 04:40:45 -0700 (PDT) MIME-Version: 1.0 Received: by 10.213.3.4 with SMTP id 4mr2944399ebl.24.1275046845625; Fri, 28 May 2010 04:40:45 -0700 (PDT) Received: by 10.213.14.12 with HTTP; Fri, 28 May 2010 04:40:45 -0700 (PDT) In-Reply-To: References: Date: Fri, 28 May 2010 12:40:45 +0100 Message-ID: Subject: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: Wilmer van der Gaast To: IETF DNSEXT WG , Carlo Contavalli Cc: Sean Leach , "Rodden, Darryl" Content-Type: text/plain; charset=ISO-8859-1 X-System-Of-Record: true Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 21 May 2010 19:29, Carlo Contavalli wrote: > we just uploaded a second version of edns-client-ip: > http://www.ietf.org/id/draft-vandergaast-edns-client-ip-01.txt > Hello everyone, Does nobody have any comments on this draft? We've tried to address as many of the concerns brought up in the discussion on -00 and would like to know if the WG is more in favour of this new version. If it's decided that there will be a dnsext session at IETF78 in Maastricht, we'd love to discuss this proposal in person in more detail there. Regards, -- Wilmer van der Gaast, Traffic SRE/Google Public DNS team. Google Ireland. From owner-namedroppers@ops.ietf.org Fri May 28 05:25:31 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B1FE83A6822; Fri, 28 May 2010 05:25:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.849 X-Spam-Level: X-Spam-Status: No, score=-99.849 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_50=0.001, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5mH2yUj7sG-B; Fri, 28 May 2010 05:25:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3B0383A6902; Fri, 28 May 2010 05:21:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHyTE-0001tw-WF for namedroppers-data0@psg.com; Fri, 28 May 2010 12:15:25 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHyTB-0001l8-JR for namedroppers@ops.ietf.org; Fri, 28 May 2010 12:15:22 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4SC8s8U028295; Fri, 28 May 2010 12:09:09 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4SC8bEm028293; Fri, 28 May 2010 12:08:37 GMT Date: Fri, 28 May 2010 12:08:32 +0000 From: bmanning@vacation.karoshi.com To: =?utf-8?B?T25kxZllaiBTdXLDvQ==?= Cc: Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100528120832.GA28132@vacation.karoshi.com.> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <4BFE3007.4010208@nic.cz> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Thu, May 27, 2010 at 10:40:39AM +0200, OndEej SurC= wrote: > On 20.5.2010 14:02, Jaap Akkerhuis wrote: > > > > > I quickly scanned this document and was surprised to see in Section > > > 2. IXRF Server Side: > > > > > > > > > A IXFR server receiving a DNS message requesting IXFR-ONLY > > will reply > > > as described in RFC 1995 [RFC1995] if it is able to produce an > > IXFR > > > for the serial number requested. > > > > > > Maybe I'm wrong but I always thought that an IXRF request had as > > > data the current serial from the requester and that the server only > > > when it is "higher" (according to the serial arithmetic). > > > > A IXFR server can return up-to-date, a delta style response or > > a axfr style responses. > > > > IXFR-ONLY removes the latter. > > > >Yes, but that is not the point. > > > >The draft says "the serial number requested" but as far as I know > >you doesn't send the serial number you want, you sent the serial > >you have. > > > >To give a full citation of RFC 1995: > > > > > >3. Query Format > > > > The IXFR query packet format is the same as that of a normal DNS > > query, but with the query type being IXFR and the authority section > > containing the SOA record of client's version of the zone. > > > >This is quite different then what the draft states. > > The draft doesn't say whether "the serial number requested" is the > serial number you want or serial number you have. It merely states that > the server is able to produce IXFR response for the serial number > requested, not saying anything about serial number sent in response. > > But maybe it needs rewording, so it is more clear. > > O > -- the serial number you want presuposes that you have a clue as to what the canonical master is currently using for serial number values. to borrow a line from the finacial folks, "Past Performance is No Guarantee of Future Results" masters can and do change the format of the SOA and slaves are supposed to keep up. --bill From owner-namedroppers@ops.ietf.org Fri May 28 05:42:22 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 05EE13A68F9; Fri, 28 May 2010 05:42:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.95 X-Spam-Level: X-Spam-Status: No, score=-98.95 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_50=0.001, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aFvNyBooHiSW; Fri, 28 May 2010 05:42:18 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D3AE53A6781; Fri, 28 May 2010 05:42:17 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHypG-00054A-6T for namedroppers-data0@psg.com; Fri, 28 May 2010 12:38:10 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHypC-000535-Ui for namedroppers@ops.ietf.org; Fri, 28 May 2010 12:38:07 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id C09F673444D; Fri, 28 May 2010 14:38:03 +0200 (CEST) Message-ID: <4BFFB92A.1080105@nic.cz> Date: Fri, 28 May 2010 14:38:02 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: bmanning@vacation.karoshi.com CC: Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> In-Reply-To: <20100528120832.GA28132@vacation.karoshi.com.> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Bill, On 28.5.2010 14:08, bmanning@vacation.karoshi.com wrote: > On Thu, May 27, 2010 at 10:40:39AM +0200, OndEej SurC= wrote: >> On 20.5.2010 14:02, Jaap Akkerhuis wrote: >>> >>> > I quickly scanned this document and was surprised to see in Section >>> > 2. IXRF Server Side: >>> > >>> > >>> > A IXFR server receiving a DNS message requesting IXFR-ONLY >>> will reply >>> > as described in RFC 1995 [RFC1995] if it is able to produce an >>> IXFR >>> > for the serial number requested. >>> > >>> > Maybe I'm wrong but I always thought that an IXRF request had as >>> > data the current serial from the requester and that the server only >>> > when it is "higher" (according to the serial arithmetic). >>> >>> A IXFR server can return up-to-date, a delta style response or >>> a axfr style responses. >>> >>> IXFR-ONLY removes the latter. >>> >>> Yes, but that is not the point. >>> >>> The draft says "the serial number requested" but as far as I know >>> you doesn't send the serial number you want, you sent the serial >>> you have. >>> >>> To give a full citation of RFC 1995: >>> >>> >>> 3. Query Format >>> >>> The IXFR query packet format is the same as that of a normal DNS >>> query, but with the query type being IXFR and the authority section >>> containing the SOA record of client's version of the zone. >>> >>> This is quite different then what the draft states. >> >> The draft doesn't say whether "the serial number requested" is the >> serial number you want or serial number you have. It merely states that >> the server is able to produce IXFR response for the serial number >> requested, not saying anything about serial number sent in response. >> >> But maybe it needs rewording, so it is more clear. >> >> O >> -- > > the serial number you want presuposes that you have > a clue as to what the canonical master is currently using > for serial number values. to borrow a line from the > finacial folks, "Past Performance is No Guarantee of Future Results" > > masters can and do change the format of the SOA and slaves > are supposed to keep up. I am not sure if I understand. How is this related to IXFR-only? My understanding is that we are just merely describing IXFR behaviour. Maybe in a little bit obscured wording which may seems that client is sending NEW serial number, but in fact we don't say anything about serial number, just that IXFR request has to include serial number (which is again pure RFC 1995). Ondrej -- OndÅ™ej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- LaboratoÅ™e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Fri May 28 05:45:58 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 09FB73A6820; Fri, 28 May 2010 05:45:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.106 X-Spam-Level: ** X-Spam-Status: No, score=2.106 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JonLFw9pTK3w; Fri, 28 May 2010 05:45:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0333E3A6802; Fri, 28 May 2010 05:45:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHytk-0005ry-6a for namedroppers-data0@psg.com; Fri, 28 May 2010 12:42:48 +0000 Received: from [209.85.160.180] (helo=mail-gy0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHyth-0005rY-By for namedroppers@ops.ietf.org; Fri, 28 May 2010 12:42:45 +0000 Received: by gyb13 with SMTP id 13so1200008gyb.11 for ; Fri, 28 May 2010 05:42:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=abcekUdtDYJ3+Ep282PZ6pw03gMCsN+sWlwiWVa7ffA=; b=NowKmJWeMJfWQK5emvHz0e7/RMOl6b1w10P/TY1cNLREJMCDwFuV/ZZGhWSYr9QRgI 0I8khe/PLEPN9I//jv5q31mlD8W351Q7M6gyTWdGFBeckZgSq0BXvFZ3eCQxOLHgAf6I eyen+y4CRH8pRlGhCN3dTxRrnzJUCx3W6NCyE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=aABFADkFFAHP3DBz/c0merG8wSGypAkS97wjfB0iJFhrkQM3YcIl8vWayFGfurHKtO 4H96WXtlLjSF8mQYkv7H9naUiicddVwGGSDMr9nodbLZ0OEFmGSeO/M9lSq7bpbEB+9T g65kR6wGgPpHxNqWLwQw/a0fCJkmcjSqCtc90= MIME-Version: 1.0 Received: by 10.101.5.18 with SMTP id h18mr273651ani.120.1275050564252; Fri, 28 May 2010 05:42:44 -0700 (PDT) Received: by 10.100.8.14 with HTTP; Fri, 28 May 2010 05:42:44 -0700 (PDT) In-Reply-To: <20100528120832.GA28132@vacation.karoshi.com.> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> Date: Fri, 28 May 2010 09:42:44 -0300 Message-ID: Subject: Re: [dnsext] draft-kerr-ixfr-only-01 From: Brian Dickson To: bmanning@vacation.karoshi.com Cc: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Content-Type: multipart/alternative; boundary=001636c92d42f3f7b40487a6d7a5 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --001636c92d42f3f7b40487a6d7a5 Content-Type: text/plain; charset=ISO-8859-1 On Fri, May 28, 2010 at 9:08 AM, wrote: > On Thu, May 27, 2010 at 10:40:39AM +0200, OndE ej SurC= wrote: > > On 20.5.2010 14:02, Jaap Akkerhuis wrote: > > > > > > > > >The draft says "the serial number requested" but as far as I know > > >you doesn't send the serial number you want, you sent the serial > > >you have. > > > > [snip] > > > > > >This is quite different then what the draft states. > > > > The draft doesn't say whether "the serial number requested" is the > > serial number you want or serial number you have. It merely states that > > the server is able to produce IXFR response for the serial number > > requested, not saying anything about serial number sent in response. > > > > But maybe it needs rewording, so it is more clear. > > +1 > > the serial number you want presuposes that you have > a clue as to what the canonical master is currently using > for serial number values. to borrow a line from the > finacial folks, "Past Performance is No Guarantee of Future Results" > > masters can and do change the format of the SOA and slaves > are supposed to keep up. > > This is being a bit pedantic, but... The SOA *format* never changes. What may change, is the convention on how to increment/set the serial number of the SOA, in base-N representation. E.g. base-10, integer values YYYYMMDDnn, or YYYYJJJnnn (JJJ = julian day of year). However, this is just a convention. The SOA serial number is a 32-bit integer value. It is monotonically increasing, and is permitted to wrap around. The allowable (and quite reasonably so) maximum increment for wrapping arithmetic, is 2^31-1. So, changing from one convention to another, which would result in a negative increment, usually requires at least one intermediate serial number, which must successfully be seen by all slaves, before the change to the new convention is completed. Choices of 2^32-2, possibly preceded by 2^31-1, are pretty decent values to use. Brian --001636c92d42f3f7b40487a6d7a5 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

On Fri, May 28, 2010 at 9:08 AM, <bmanning@v= acation.karoshi.com> wrote:
On Thu, May 27, 2010 at 10:40:39AM +0200,= OndE ej SurC=3D wrote:
> On 20.5.2010 14:02, Jaap Akkerhuis wrote:
> >
> >
> >The draft says "the serial number requested" but as far = as I know
> >you doesn't send the serial number you want, you sent the seri= al
> >you have.
> >
[snip]
> >
> >This is quite different then what the draft states.
>
> The draft doesn't say whether "the serial number requested&qu= ot; is the
> serial number you want or serial number you have. =A0It merely states = that
> the server is able to produce IXFR response for the serial number
> requested, not saying anything about serial number sent in response. >
> But maybe it needs rewording, so it is more clear.
=A0

+1
=A0

=A0 =A0 =A0 =A0the serial number you want presuposes that you = have
=A0 =A0 =A0 =A0a clue as to what the canonical master is currently using =A0 =A0 =A0 =A0for serial number values. =A0to borrow a line from the
=A0 =A0 =A0 =A0finacial folks, "Past Performance is No Guarantee of F= uture Results"

=A0 =A0 =A0 =A0masters can and do change the format of the SOA and slaves<= br> =A0 =A0 =A0 =A0are supposed to keep up.


This = is being a bit pedantic, but...

The SOA *format* never changes. What= may change, is the convention on how
to increment/set the serial number= of the SOA, in base-N representation.

E.g. base-10, integer values YYYYMMDDnn, or YYYYJJJnnn (JJJ =3D julian = day of year).

However, this is just a convention. The SOA serial num= ber is a 32-bit integer value.
It is monotonically increasing, and is pe= rmitted to wrap around.
The allowable (and quite reasonably so) maximum increment for wrapping arit= hmetic, is 2^31-1.

So, changing from one convention to another, whic= h would result in a negative increment, usually requires at least one inter= mediate serial number, which must successfully be seen by all slaves, befor= e the change to the new convention is completed.=A0 Choices of 2^32-2, poss= ibly preceded by 2^31-1, are pretty decent values to use.

Brian
--001636c92d42f3f7b40487a6d7a5-- From owner-namedroppers@ops.ietf.org Fri May 28 06:29:14 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8C3263A696A; Fri, 28 May 2010 06:29:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.474 X-Spam-Level: X-Spam-Status: No, score=-99.474 tagged_above=-999 required=5 tests=[AWL=-0.375, BAYES_50=0.001, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ySHWvCtoi6cf; Fri, 28 May 2010 06:29:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 99FBA3A6A27; Fri, 28 May 2010 06:28:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHzXM-000CUe-0q for namedroppers-data0@psg.com; Fri, 28 May 2010 13:23:44 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHzXH-000CK3-B2 for namedroppers@ops.ietf.org; Fri, 28 May 2010 13:23:41 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4SDJ38U028569; Fri, 28 May 2010 13:19:18 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4SDIWtt028567; Fri, 28 May 2010 13:18:32 GMT Date: Fri, 28 May 2010 13:18:27 +0000 From: bmanning@vacation.karoshi.com To: =?utf-8?B?T25kxZllaiBTdXLDvQ==?= Cc: bmanning@vacation.karoshi.com, Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100528131827.GA28500@vacation.karoshi.com.> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <4BFFB92A.1080105@nic.cz> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <4BFFB92A.1080105@nic.cz> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 28, 2010 at 02:38:02PM +0200, OndEej SurC= wrote: > Bill, > > >>> > 2. IXRF Server Side: > >>> > > >>> > > >>> > A IXFR server receiving a DNS message requesting IXFR-ONLY > >>> will reply > >>> > as described in RFC 1995 [RFC1995] if it is able to produce > >>> an > >>> IXFR > >>> > for the serial number requested. > >>> > > >>> > Maybe I'm wrong but I always thought that an IXRF request had as > >>> > data the current serial from the requester and that the server > >>> only > >>> > when it is "higher" (according to the serial arithmetic). > >>> > >>> A IXFR server can return up-to-date, a delta style response or > >>> a axfr style responses. > >>> > >>> IXFR-ONLY removes the latter. > >>> > >>>Yes, but that is not the point. > >>> > >>>The draft says "the serial number requested" but as far as I know > >>>you doesn't send the serial number you want, you sent the serial > >>>you have. > >>> > >>>To give a full citation of RFC 1995: > >>> > >>> > >>>3. Query Format > >>> > >>> The IXFR query packet format is the same as that of a normal DNS > >>> query, but with the query type being IXFR and the authority section > >>> containing the SOA record of client's version of the zone. > >>> > >>>This is quite different then what the draft states. > >> > >>The draft doesn't say whether "the serial number requested" is the > >>serial number you want or serial number you have. It merely states that > >>the server is able to produce IXFR response for the serial number > >>requested, not saying anything about serial number sent in response. > >> > >>But maybe it needs rewording, so it is more clear. > >> > >>O > >>-- > > > > the serial number you want presuposes that you have > > a clue as to what the canonical master is currently using > > for serial number values. to borrow a line from the > > finacial folks, "Past Performance is No Guarantee of Future Results" > > > > masters can and do change the format of the SOA and slaves > > are supposed to keep up. > > I am not sure if I understand. How is this related to IXFR-only? My > understanding is that we are just merely describing IXFR behaviour. > Maybe in a little bit obscured wording which may seems that client is > sending NEW serial number, but in fact we don't say anything about > serial number, just that IXFR request has to include serial number > (which is again pure RFC 1995). please clarify the phrase; "Serial Number Requested". imho, the slave has a serial number in hand and asks the master to send the current serial number. which is a perfectly fine way to interpret the phrase. it could be helpful to have the slave, when asking the master for the current serial number, to pass the slaves serial number up to the master, but I can't quite see how the master will use the information. this thread suggested that one possible interpretation would be to request a specific serial number; e.g. I would like serial# 64223 .. which i believe is an incorrect interpretation. now if the premise of IXFR-only is to just send the diffs between (serial at slave) and (serial at master), then there is the presumption that the master has: a) kept track of the state of the zone contents between serial number increments and b) the master has not changed the format of the SOA for example, if the slave as IXFR-only signals to the master: "here is my current serial number, 2010052800, please send me all updates since then" and the master responds with: "the current serial number is 9" -- what should happen? the master changed the format of the serial number it was using in "mid-stride". --bill > > Ondrej > -- > OndEej SurC= > vedoucC- vC=zkumu/R&D manager > ------------------------------------------- > CZ.NIC, z.s.p.o. -- LaboratoEe CZ.NIC > Americka 23, 120 00 Praha 2, Czech Republic > mailto:ondrej.sury@nic.cz http://nic.cz/ > tel:+420.222745110 fax:+420.222745112 > ------------------------------------------- From owner-namedroppers@ops.ietf.org Fri May 28 06:37:33 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F29203A6836; Fri, 28 May 2010 06:37:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.799 X-Spam-Level: X-Spam-Status: No, score=-99.799 tagged_above=-999 required=5 tests=[AWL=0.200, BAYES_50=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EmbsApFF35ky; Fri, 28 May 2010 06:37:31 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8E0153A68A7; Fri, 28 May 2010 06:37:31 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHzhW-000DzX-72 for namedroppers-data0@psg.com; Fri, 28 May 2010 13:34:14 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHzhJ-000DmC-LI for namedroppers@ops.ietf.org; Fri, 28 May 2010 13:34:10 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4SDSA8U028603; Fri, 28 May 2010 13:28:26 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4SDRTpD028598; Fri, 28 May 2010 13:27:29 GMT Date: Fri, 28 May 2010 13:27:23 +0000 From: bmanning@vacation.karoshi.com To: Brian Dickson Cc: bmanning@vacation.karoshi.com, =?utf-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100528132723.GB28500@vacation.karoshi.com.> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 28, 2010 at 09:42:44AM -0300, Brian Dickson wrote: > On Fri, May 28, 2010 at 9:08 AM, wrote: > > > On Thu, May 27, 2010 at 10:40:39AM +0200, OndE ej SurC= wrote: > > > On 20.5.2010 14:02, Jaap Akkerhuis wrote: > > > > > > > > > > > >The draft says "the serial number requested" but as far as I know > > > >you doesn't send the serial number you want, you sent the serial > > > >you have. > > > > > > [snip] > > > > > > > >This is quite different then what the draft states. > > > > > > The draft doesn't say whether "the serial number requested" is the > > > serial number you want or serial number you have. It merely states that > > > the server is able to produce IXFR response for the serial number > > > requested, not saying anything about serial number sent in response. > > > > > > But maybe it needs rewording, so it is more clear. > > > > > > +1 > > > > > > the serial number you want presuposes that you have > > a clue as to what the canonical master is currently using > > for serial number values. to borrow a line from the > > finacial folks, "Past Performance is No Guarantee of Future Results" > > > > masters can and do change the format of the SOA and slaves > > are supposed to keep up. > > > > > This is being a bit pedantic, but... > > The SOA *format* never changes. What may change, is the convention on how > to increment/set the serial number of the SOA, in base-N representation. > > E.g. base-10, integer values YYYYMMDDnn, or YYYYJJJnnn (JJJ = julian day of > year). > > However, this is just a convention. The SOA serial number is a 32-bit > integer value. > It is monotonically increasing, and is permitted to wrap around. > The allowable (and quite reasonably so) maximum increment for wrapping > arithmetic, is 2^31-1. > > So, changing from one convention to another, which would result in a > negative increment, usually requires at least one intermediate serial > number, which must successfully be seen by all slaves, before the change to > the new convention is completed. Choices of 2^32-2, possibly preceded by > 2^31-1, are pretty decent values to use. > > Brian right. that was sort of the point. the master can reset the value at any point in time and the slaves have to react to that change. at which point an IXFR-only slave has to pull the whole zone. AXFR covers most use cases (or should) IXFR is a local optimization IXFR-only is even more specialized... I am not persauded of the relative value of IXFR-only. but then again, I'm not one for putting (near) real-time constraints on the DNS --bill From owner-namedroppers@ops.ietf.org Fri May 28 06:53:25 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5CA283A6A13; Fri, 28 May 2010 06:53:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.98 X-Spam-Level: X-Spam-Status: No, score=-98.98 tagged_above=-999 required=5 tests=[AWL=0.120, BAYES_50=0.001, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kJ5ez10IuIso; Fri, 28 May 2010 06:53:24 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0864E3A6A12; Fri, 28 May 2010 06:53:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHzwT-000GqP-Iu for namedroppers-data0@psg.com; Fri, 28 May 2010 13:49:41 +0000 Received: from [2001:1488:800:400::400] (helo=mail.nic.cz) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OHzwP-000Gmu-JJ for namedroppers@ops.ietf.org; Fri, 28 May 2010 13:49:37 +0000 Received: from [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617] (unknown [IPv6:2001:1488:ac14:1400:224:e8ff:fea9:f617]) by mail.nic.cz (Postfix) with ESMTPSA id 299617342FC; Fri, 28 May 2010 15:49:36 +0200 (CEST) Message-ID: <4BFFC9F0.2030002@nic.cz> Date: Fri, 28 May 2010 15:49:36 +0200 From: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100317 Lightning/1.0b1 Thunderbird/3.0.4 MIME-Version: 1.0 To: bmanning@vacation.karoshi.com CC: Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <4BFFB92A.1080105@nic.cz> <20100528131827.GA28500@vacation.karoshi.com.> In-Reply-To: <20100528131827.GA28500@vacation.karoshi.com.> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 28.5.2010 15:18, bmanning@vacation.karoshi.com wrote: > On Fri, May 28, 2010 at 02:38:02PM +0200, OndEej SurC= wrote: >> Bill, >> >>>>> > 2. IXRF Server Side: >>>>> > >>>>> > >>>>> > A IXFR server receiving a DNS message requesting IXFR-ONLY >>>>> will reply >>>>> > as described in RFC 1995 [RFC1995] if it is able to produce >>>>> an >>>>> IXFR >>>>> > for the serial number requested. >>>>> > >>>>> > Maybe I'm wrong but I always thought that an IXRF request had as >>>>> > data the current serial from the requester and that the server >>>>> only >>>>> > when it is "higher" (according to the serial arithmetic). >>>>> >>>>> A IXFR server can return up-to-date, a delta style response or >>>>> a axfr style responses. >>>>> >>>>> IXFR-ONLY removes the latter. >>>>> >>>>> Yes, but that is not the point. >>>>> >>>>> The draft says "the serial number requested" but as far as I know >>>>> you doesn't send the serial number you want, you sent the serial >>>>> you have. >>>>> >>>>> To give a full citation of RFC 1995: >>>>> >>>>> >>>>> 3. Query Format >>>>> >>>>> The IXFR query packet format is the same as that of a normal DNS >>>>> query, but with the query type being IXFR and the authority section >>>>> containing the SOA record of client's version of the zone. >>>>> >>>>> This is quite different then what the draft states. >>>> >>>> The draft doesn't say whether "the serial number requested" is the >>>> serial number you want or serial number you have. It merely states that >>>> the server is able to produce IXFR response for the serial number >>>> requested, not saying anything about serial number sent in response. >>>> >>>> But maybe it needs rewording, so it is more clear. >>>> >>>> O >>>> -- >>> >>> the serial number you want presuposes that you have >>> a clue as to what the canonical master is currently using >>> for serial number values. to borrow a line from the >>> finacial folks, "Past Performance is No Guarantee of Future Results" >>> >>> masters can and do change the format of the SOA and slaves >>> are supposed to keep up. >> >> I am not sure if I understand. How is this related to IXFR-only? My >> understanding is that we are just merely describing IXFR behaviour. >> Maybe in a little bit obscured wording which may seems that client is >> sending NEW serial number, but in fact we don't say anything about >> serial number, just that IXFR request has to include serial number >> (which is again pure RFC 1995). > > > please clarify the phrase; "Serial Number Requested". > > imho, the slave has a serial number in hand and asks the > master to send the current serial number. which is > a perfectly fine way to interpret the phrase. > > it could be helpful to have the slave, when asking the master > for the current serial number, to pass the slaves serial number > up to the master, but I can't quite see how the master will use > the information. > > this thread suggested that one possible interpretation would be to > request a specific serial number; e.g. I would like serial# 64223 > .. which i believe is an incorrect interpretation. > > > now if the premise of IXFR-only is to just send the diffs between > (serial at slave) and (serial at master), then there is the presumption > that the master has: > > a) kept track of the state of the zone contents between serial number > increments > and > b) the master has not changed the format of the SOA > > for example, if the slave as IXFR-only signals to the master: "here > is my current serial number, 2010052800, please send me all updates > since then" and the master responds with: "the current serial number > is 9" -- what should happen? the master changed the format of the > serial number it was using in "mid-stride". IXFR-only doesn't change (or want to change) any behaviour of IXFR except fallback to AXFR. Interpretation where slave request specific version number is wrong. Slave in IXFR-only behaves exactly same as in IXFR (except of different QTYPE). Ondrej -- Ondřej Surý vedoucí výzkumu/R&D manager ------------------------------------------- CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From owner-namedroppers@ops.ietf.org Fri May 28 07:12:11 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C98E93A6A1B; Fri, 28 May 2010 07:12:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.727 X-Spam-Level: ** X-Spam-Status: No, score=2.727 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jmvRpHZ6BUuY; Fri, 28 May 2010 07:12:10 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C03EE3A68A7; Fri, 28 May 2010 07:12:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0FK-000KPU-QF for namedroppers-data0@psg.com; Fri, 28 May 2010 14:09:10 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0FH-000KP3-SH for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:09:08 +0000 Received: from stora.ogud.com (localhost [127.0.0.1]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4SE967g059920 for ; Fri, 28 May 2010 10:09:06 -0400 (EDT) (envelope-from namedroppers@stora.ogud.com) Received: (from namedroppers@localhost) by stora.ogud.com (8.14.4/8.14.4/Submit) id o4SE968n059919 for namedroppers@ops.ietf.org; Fri, 28 May 2010 10:09:06 -0400 (EDT) (envelope-from namedroppers) Received: from [74.125.82.180] (helo=mail-wy0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OH5F7-00082L-Cx for namedroppers@ops.ietf.org; Wed, 26 May 2010 01:17:09 +0000 Received: by wyg36 with SMTP id 36so408094wyg.11 for ; Tue, 25 May 2010 18:17:07 -0700 (PDT) MIME-Version: 1.0 Received: by 10.216.170.209 with SMTP id p59mr5060588wel.222.1274836627378; Tue, 25 May 2010 18:17:07 -0700 (PDT) Received: by 10.216.131.86 with HTTP; Tue, 25 May 2010 18:17:07 -0700 (PDT) X-Originating-IP: [174.129.49.254] In-Reply-To: <201005252327.o4PNR9G8088781@drugs.dv.isc.org> References: <201005251614.o4PGEVOK084328@drugs.dv.isc.org> <201005252327.o4PNR9G8088781@drugs.dv.isc.org> Date: Wed, 26 May 2010 03:17:07 +0200 Message-ID: Subject: Re: [dnsext] Engineering Requirements for Stub Chain Delivery From: Dan Kaminsky To: Mark Andrews Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.67 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: [ Moderators note: Post was moderated, either because it was posted by a non-subscriber, or because it was over 20K. With the massive amount of spam, it is easy to miss and therefore delete relevant posts by non-subscribers. Please fix your subscription addresses. ] On Wed, May 26, 2010 at 1:27 AM, Mark Andrews wrote: > > In message = , Dan > Kaminsky writes: >> > A stub needs to be able to query for chain elements it is missing. >> > It does not need them to be returned in a single query. =3DA0Such quer= ies >> > will normally be satistfied by the caching server without having >> > to make additional queries especially if the caching server also >> > validates the reponses it gets (before or after sending them on). >> >> A stub doesn't necessarily know what elements it is missing. =A0Consider >> foo.com CNAMEing through bar.com. =A0I need a chain to root, plus a >> RRSIG across the CNAME from foo.com to bar.com. >> >> --Dan > > You need to be able to validate the CNAME. =A0One path to the root. > You need to be able to validate whatever the CNAME points to. =A0A second= path > to the root. > > This is not difficult to work out. OK. What is the set of RRSIGs necessary for www.microsoft.com? From owner-namedroppers@ops.ietf.org Fri May 28 07:12:17 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 36B793A68F0; Fri, 28 May 2010 07:12:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.727 X-Spam-Level: ** X-Spam-Status: No, score=2.727 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I8YlqRkc9wwP; Fri, 28 May 2010 07:12:16 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 80A3C3A67EF; Fri, 28 May 2010 07:12:15 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0EO-000KHf-K8 for namedroppers-data0@psg.com; Fri, 28 May 2010 14:08:12 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0EI-000KGS-NK for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:08:07 +0000 Received: from stora.ogud.com (localhost [127.0.0.1]) by stora.ogud.com (8.14.4/8.14.4) with ESMTP id o4SE83xQ059909 for ; Fri, 28 May 2010 10:08:03 -0400 (EDT) (envelope-from namedroppers@stora.ogud.com) Received: (from namedroppers@localhost) by stora.ogud.com (8.14.4/8.14.4/Submit) id o4SE83Zl059908 for namedroppers@ops.ietf.org; Fri, 28 May 2010 10:08:03 -0400 (EDT) (envelope-from namedroppers) Received: from [74.125.82.180] (helo=mail-wy0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OH07f-000J6n-Jb for namedroppers@ops.ietf.org; Tue, 25 May 2010 19:49:07 +0000 Received: by wyg36 with SMTP id 36so192221wyg.11 for ; Tue, 25 May 2010 12:49:06 -0700 (PDT) MIME-Version: 1.0 Received: by 10.227.134.142 with SMTP id j14mr7505638wbt.18.1274816946032; Tue, 25 May 2010 12:49:06 -0700 (PDT) Received: by 10.216.131.86 with HTTP; Tue, 25 May 2010 12:49:06 -0700 (PDT) X-Originating-IP: [174.129.49.254] In-Reply-To: <201005251614.o4PGEVOK084328@drugs.dv.isc.org> References: <201005251614.o4PGEVOK084328@drugs.dv.isc.org> Date: Tue, 25 May 2010 21:49:06 +0200 Message-ID: Subject: Re: [dnsext] Engineering Requirements for Stub Chain Delivery From: Dan Kaminsky To: Mark Andrews Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.67 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: [ Moderators note: Post was moderated, either because it was posted by a non-subscriber, or because it was over 20K. With the massive amount of spam, it is easy to miss and therefore delete relevant posts by non-subscribers. Please fix your subscription addresses. ] > A stub needs to be able to query for chain elements it is missing. > It does not need them to be returned in a single query. =A0Such queries > will normally be satistfied by the caching server without having > to make additional queries especially if the caching server also > validates the reponses it gets (before or after sending them on). A stub doesn't necessarily know what elements it is missing. Consider foo.com CNAMEing through bar.com. I need a chain to root, plus a RRSIG across the CNAME from foo.com to bar.com. --Dan From owner-namedroppers@ops.ietf.org Fri May 28 07:12:43 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1C9673A67EF; Fri, 28 May 2010 07:12:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.999 X-Spam-Level: X-Spam-Status: No, score=-100.999 tagged_above=-999 required=5 tests=[AWL=1.300, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LnCJvAA4MMsT; Fri, 28 May 2010 07:12:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 00D783A68A7; Fri, 28 May 2010 07:12:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0EG-000KGU-PN for namedroppers-data0@psg.com; Fri, 28 May 2010 14:08:04 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0ED-000K5Y-F0 for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:08:02 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4SE3A8U028738; Fri, 28 May 2010 14:03:25 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4SE2nPD028736; Fri, 28 May 2010 14:02:49 GMT Date: Fri, 28 May 2010 14:02:43 +0000 From: bmanning@vacation.karoshi.com To: =?utf-8?B?T25kxZllaiBTdXLDvQ==?= Cc: bmanning@vacation.karoshi.com, Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100528140243.GC28500@vacation.karoshi.com.> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <4BFFB92A.1080105@nic.cz> <20100528131827.GA28500@vacation.karoshi.com.> <4BFFC9F0.2030002@nic.cz> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <4BFFC9F0.2030002@nic.cz> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 28, 2010 at 03:49:36PM +0200, OndEej SurC= wrote: > > IXFR-only doesn't change (or want to change) any behaviour of IXFR > except fallback to AXFR. Interpretation where slave request specific > version number is wrong. Slave in IXFR-only behaves exactly same as in > IXFR (except of different QTYPE). > > Ondrej > -- the reason for fallback to AXFR are/were elaborated in previous rfc and wg discussion. what I think you are suggesting is that ixfr-only nodes need to recreate without fallback, the same functionality as axfr in those circumstances when a full zone transfer is needed. havingtwo distinct functions that perform the same act sort of requires a clearly stated value proposition and I don't see that in IXFR-only. --bill From owner-namedroppers@ops.ietf.org Fri May 28 07:32:39 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 43E243A6A21; Fri, 28 May 2010 07:32:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VEJ7GmwuHGrl; Fri, 28 May 2010 07:32:38 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C75D83A6912; Fri, 28 May 2010 07:31:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0Wy-000NYN-6e for namedroppers-data0@psg.com; Fri, 28 May 2010 14:27:24 +0000 Received: from [2001:1890:1112:1::20] (helo=mail.ietf.org) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0Wt-000NXW-R9 for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:27:20 +0000 Received: by core3.amsl.com (Postfix, from userid 30) id 311183A6A3E; Fri, 28 May 2010 07:23:44 -0700 (PDT) X-idtracker: yes To: IETF-Announce From: The IESG Reply-to: ietf@ietf.org CC: Subject: [dnsext] Last Call: draft-ietf-dnsext-dns-tcp-requirements (DNS Transport over TCP - Implementation Requirements) to Proposed Standard Message-Id: <20100528142345.311183A6A3E@core3.amsl.com> Date: Fri, 28 May 2010 07:23:33 -0700 (PDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: The IESG has received a request from the DNS Extensions WG (dnsext) to consider the following document: - 'DNS Transport over TCP - Implementation Requirements ' as a Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2010-06-11. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. The file can be obtained via http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dns-tcp-requirements-03.txt IESG discussion can be tracked via https://datatracker.ietf.org/public/pidtracker.cgi?command=view_id&dTag=19093&rfc_flag=0 From owner-namedroppers@ops.ietf.org Fri May 28 07:32:40 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AA9C23A6A1F; Fri, 28 May 2010 07:32:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.106 X-Spam-Level: ** X-Spam-Status: No, score=2.106 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jDnMuckxtxPi; Fri, 28 May 2010 07:32:39 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5C7273A6A1E; Fri, 28 May 2010 07:31:54 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0XX-000Nf2-9U for namedroppers-data0@psg.com; Fri, 28 May 2010 14:27:59 +0000 Received: from [209.85.160.180] (helo=mail-gy0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0XT-000Ndm-7i for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:27:55 +0000 Received: by gyb13 with SMTP id 13so1346858gyb.11 for ; Fri, 28 May 2010 07:27:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=v4KlMA+scNOL7DGjc6KlZb0Lh+N6gmxxQAQ/zr8gHGY=; b=iTwWOC2wrHG/mJLW8nTdn90qfPoQoWBV9OySr8ADRJgxjTk/xbOBHbfbtMreshdn98 Zfyz1PmaltEsG31D5Du2N6nd78iswAQFOd/p/ikUDRZXlLkL/SGRzlNwACf3CEx/09UT 7Jv8cW7N+4UjPbt1m2v8R5SMjTJ+uFaF5hB3M= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=AkygixS3OsYjHxsqLrDR8Ssl+noIDUeYgh4hsZHMJxiYiS9cLfJd3MYg27BpI+iSvm Y4wllRKCDYS6J7pkzlBD3Hixo+H5dZ6lfGKHQt3REr3ai0dNqUV+20IUs59g1WAG7VVP YlwU5lOHRzIOWx7WQQiQt/HBdDEzOLJnuuqXw= MIME-Version: 1.0 Received: by 10.100.29.19 with SMTP id c19mr459252anc.191.1275056874063; Fri, 28 May 2010 07:27:54 -0700 (PDT) Received: by 10.100.8.14 with HTTP; Fri, 28 May 2010 07:27:53 -0700 (PDT) In-Reply-To: <20100528131827.GA28500@vacation.karoshi.com.> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <4BFFB92A.1080105@nic.cz> <20100528131827.GA28500@vacation.karoshi.com.> Date: Fri, 28 May 2010 11:27:53 -0300 Message-ID: Subject: Re: [dnsext] draft-kerr-ixfr-only-01 From: Brian Dickson To: bmanning@vacation.karoshi.com Cc: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Content-Type: multipart/alternative; boundary=0016e6470bd80c096a0487a850a5 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --0016e6470bd80c096a0487a850a5 Content-Type: text/plain; charset=ISO-8859-1 On Fri, May 28, 2010 at 10:18 AM, wrote: > > now if the premise of IXFR-only is to just send the diffs between > (serial at slave) and (serial at master), then there is the > presumption > that the master has: > > a) kept track of the state of the zone contents between serial > number > increments > and > b) the master has not changed the format of the SOA > > Actually, no. (B) does not factor in at all, only (A). > for example, if the slave as IXFR-only signals to the master: "here > is my current serial number, 2010052800, please send me all updates > since then" and the master responds with: "the current serial number > is 9" -- what should happen? the master changed the format of > the > serial number it was using in "mid-stride". > > Either nothing (because the SN is lower and the delta modulo 2**32 exceeds 2**31), or whatever the normal IXFR response would be, for suitable values of "2010052800" and "9". :-) The absence of an intermediate "BigNumber" SOA SN between the SN occurrences of 2010052800 and 9, is an operator error. The slave *should* have had a chance to request an IXFR 2010052800 -> 3000000000 (or so), which could have been an "empty" IXFR consisting of only the new SOA records (2 in a row with no other data). And then its next IXFR request would have been a wrap-around event of 3000000000 -> 9, which would be no different than if it had been an IXFR from 2010052800 -> 2010052801. It's best not to conflate/confuse the issue. SN format has nothing at all to do with IXFR vs AXFR. Brian --0016e6470bd80c096a0487a850a5 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

On Fri, May 28, 2010 at 10:18 AM, <bmanning@= vacation.karoshi.com> wrote:

=A0 =A0 =A0 =A0now if the premise of IXFR-only is to just send the diffs b= etween
=A0 =A0 =A0 =A0(serial at slave) and (serial at master), then there is the= presumption
=A0 =A0 =A0 =A0that the master has:

=A0 =A0 =A0 =A0a) kept track of the state of the zone contents between ser= ial number
=A0 =A0 =A0 =A0 =A0 increments
=A0 =A0 =A0 =A0and
=A0 =A0 =A0 =A0b) the master has not changed the format of the SOA


Actually, no. (B) does not factor in at all, only= (A).
=A0
=A0 =A0 =A0 =A0for example, if the slave as IXFR-only signals to the maste= r: "here
=A0 =A0 =A0 =A0is my current serial number, =A02010052800, please send me = all updates
=A0 =A0 =A0 =A0since then" and the master responds with: "the cu= rrent serial number
=A0 =A0 =A0 =A0is 9" =A0-- =A0what should happen? =A0 the master chan= ged the format of the
=A0 =A0 =A0 =A0serial number it was using in "mid-stride".

Either nothing (because the SN is lower and the del= ta modulo 2**32 exceeds 2**31), or whatever the normal IXFR response would = be, for suitable values of "2010052800" and "9". :-)
The absence of an intermediate "BigNumber" SOA SN between the= SN occurrences of 2010052800 and 9, is an operator error.

The slave= *should* have had a chance to request an IXFR 2010052800 -> 3000000000 = (or so), which could have been an "empty" IXFR consisting of only= the new SOA records (2 in a row with no other data). And then its next IXF= R request would have been a wrap-around event of 3000000000 -> 9, which = would be no different than if it had been an IXFR from 2010052800 -> 201= 0052801.

It's best not to conflate/confuse the issue. SN format has nothing = at all to do with IXFR vs AXFR.

Brian
--0016e6470bd80c096a0487a850a5-- From owner-namedroppers@ops.ietf.org Fri May 28 07:42:29 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D1A433A6828; Fri, 28 May 2010 07:42:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.11 X-Spam-Level: X-Spam-Status: No, score=-1.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iiv6KRiEB0Jb; Fri, 28 May 2010 07:42:29 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A8CA83A684E; Fri, 28 May 2010 07:42:28 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0i9-000PlI-SB for namedroppers-data0@psg.com; Fri, 28 May 2010 14:38:57 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0i6-000PkO-FI for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:38:54 +0000 Received: from [195.13.7.35] (helo=surfer-30-0-162.surfnet.iacbox) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0hZ-000O84-FJ; Fri, 28 May 2010 14:38:23 +0000 Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley In-Reply-To: <20100528132723.GB28500@vacation.karoshi.com.> Date: Fri, 28 May 2010 16:38:08 +0200 Cc: Brian Dickson , =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <20100528132723.GB28500@vacation.karoshi.com.> To: bmanning@vacation.karoshi.com X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 195.13.7.35 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-28, at 15:27, bmanning@vacation.karoshi.com wrote: > right. that was sort of the point. the master can reset the = value > at any point in time and the slaves have to react to that = change. > at which point an IXFR-only slave has to pull the whole zone. An IXFR-only slave has options -- it can implement something different = from AXFR to transfer the whole zone, it can shut itself down and remove = itself from an anycast cloud, it can try other servers with IXFR-only = and then (once convinced that no masters can provide an IXFR) it can = request an AXFR. An IXFR slave does not have those options. > AXFR covers most use cases (or should) It doesn't cover the case when you definitively don't want to transfer = the whole zone. > IXFR is a local optimization IXFR is not local, in the sense that it needs to be implemented in both = client and server. (I can't think of another contextual meaning for = "local" in your comment.) > IXFR-only is even more specialized...=20 I don't understand the basis for the comparison. IXFR-only is identical = to IXFR except that it doesn't fall back to AXFR. > I am not persauded of the relative value of IXFR-only. But presumably given the traffic on this list you are able to confirm = that it has non-zero value for others. Joe From owner-namedroppers@ops.ietf.org Fri May 28 07:42:44 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 329003A684E; Fri, 28 May 2010 07:42:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.855 X-Spam-Level: X-Spam-Status: No, score=-1.855 tagged_above=-999 required=5 tests=[AWL=0.745, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TcQElS3yP4PE; Fri, 28 May 2010 07:42:43 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D164E3A6828; Fri, 28 May 2010 07:42:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0iP-000PoH-D9 for namedroppers-data0@psg.com; Fri, 28 May 2010 14:39:13 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0iM-000Pmp-Qs for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:39:10 +0000 Received: from [195.13.7.35] (helo=surfer-30-0-162.surfnet.iacbox) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0iC-000O84-8Y; Fri, 28 May 2010 14:39:01 +0000 Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley In-Reply-To: <20100528140243.GC28500@vacation.karoshi.com.> Date: Fri, 28 May 2010 16:38:54 +0200 Cc: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <4BFFB92A.1080105@nic.cz> <20100528131827.GA28500@vacation.karoshi.com.> <4BFFC9F0.2030002@nic.cz> <20100528140243.GC28500@vacation.karoshi.com.> To: bmanning@vacation.karoshi.com X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 195.13.7.35 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-28, at 16:02, bmanning@vacation.karoshi.com wrote: > havingtwo distinct functions that perform the same act sort > of requires a clearly stated value proposition and I don't=20 > see that in IXFR-only. Do you mean you don't see any value to the concept, or that you find the = text in the draft lacking? Joe= From owner-namedroppers@ops.ietf.org Fri May 28 07:46:13 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5482D3A691D; Fri, 28 May 2010 07:46:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.202 X-Spam-Level: X-Spam-Status: No, score=-100.202 tagged_above=-999 required=5 tests=[AWL=-0.017, BAYES_40=-0.185, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t-L97u8pMBfq; Fri, 28 May 2010 07:46:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E4D503A696A; Fri, 28 May 2010 07:46:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0mM-0000ah-Ee for namedroppers-data0@psg.com; Fri, 28 May 2010 14:43:18 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0mI-0000Ko-Lu for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:43:15 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4SEbJ8U028912; Fri, 28 May 2010 14:37:35 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4SEam30028908; Fri, 28 May 2010 14:36:48 GMT Date: Fri, 28 May 2010 14:36:43 +0000 From: bmanning@vacation.karoshi.com To: Brian Dickson Cc: bmanning@vacation.karoshi.com, =?utf-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100528143643.GE28500@vacation.karoshi.com.> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <4BFFB92A.1080105@nic.cz> <20100528131827.GA28500@vacation.karoshi.com.> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 28, 2010 at 11:27:53AM -0300, Brian Dickson wrote: > On Fri, May 28, 2010 at 10:18 AM, wrote: > > > > > now if the premise of IXFR-only is to just send the diffs between > > (serial at slave) and (serial at master), then there is the > > presumption > > that the master has: > > > > a) kept track of the state of the zone contents between serial > > number > > increments > > and > > b) the master has not changed the format of the SOA > > > > > Actually, no. (B) does not factor in at all, only (A). > > > > for example, if the slave as IXFR-only signals to the master: "here > > is my current serial number, 2010052800, please send me all updates > > since then" and the master responds with: "the current serial number > > is 9" -- what should happen? the master changed the format of > > the > > serial number it was using in "mid-stride". > > > > > Either nothing (because the SN is lower and the delta modulo 2**32 exceeds > 2**31), or whatever the normal IXFR response would be, for suitable values > of "2010052800" and "9". :-) > > The absence of an intermediate "BigNumber" SOA SN between the SN occurrences > of 2010052800 and 9, is an operator error. which operator error? the master operator or the slave operator? > > The slave *should* have had a chance to request an IXFR 2010052800 -> > 3000000000 (or so), which could have been an "empty" IXFR consisting of only > the new SOA records (2 in a row with no other data). And then its next IXFR > request would have been a wrap-around event of 3000000000 -> 9, which would > be no different than if it had been an IXFR from 2010052800 -> 2010052801. note the operative "should" ... this is a statement made from the perspective of the slave. > It's best not to conflate/confuse the issue. SN format has nothing at all to > do with IXFR vs AXFR. except in the case of determining fall-back - when there is no difference between an AXFR and an IXFR wrt the number of records sent. I don't think that IXFR-only should recreate a new fallback method independent of AXFR. ergo, I don't see the value in IXFR-only. --bill > > Brian From owner-namedroppers@ops.ietf.org Fri May 28 07:53:07 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 066AD3A684E; Fri, 28 May 2010 07:53:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.027 X-Spam-Level: *** X-Spam-Status: No, score=3.027 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YZpXIEAVIn62; Fri, 28 May 2010 07:53:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6E84E3A6914; Fri, 28 May 2010 07:53:05 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0sE-0001mU-Ca for namedroppers-data0@psg.com; Fri, 28 May 2010 14:49:22 +0000 Received: from [209.85.161.52] (helo=mail-fx0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0sA-0001lZ-Bv for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:49:18 +0000 Received: by fxm19 with SMTP id 19so634323fxm.11 for ; Fri, 28 May 2010 07:49:15 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.184.75 with SMTP id x11mr33867hbg.131.1275058155234; Fri, 28 May 2010 07:49:15 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Fri, 28 May 2010 07:49:14 -0700 (PDT) In-Reply-To: References: Date: Fri, 28 May 2010 07:49:14 -0700 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: Wilmer van der Gaast Cc: IETF DNSEXT WG , Carlo Contavalli , Sean Leach , "Rodden, Darryl" Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 28, 2010 at 4:40 AM, Wilmer van der Gaast wrote: > On 21 May 2010 19:29, Carlo Contavalli wrote: >> we just uploaded a second version of edns-client-ip: >> http://www.ietf.org/id/draft-vandergaast-edns-client-ip-01.txt > > Does nobody have any comments on this draft? We've tried to address as > many of the concerns brought up in the discussion on -00 and would > like to know if the WG is more in favour of this new version. I think that this draft is better, and incorporates lots of great feedback. Some observations; * Rather than specifying the netmask and scope fields as 1 octet, maybe that size should depend on the FAMILY. Otherwise we exclude > 256 bit address families. * I think "SOURCE NETMASK" might be ambigous - source means a lot of things. "CLIENT NETMASK" and "CLIENT SCOPE" and "CLIENT ADDRESS" might be more in keeping with the draft name. * The new scope netmask behaviour implies some negotiation might occur e.g. Actual client IP: 192.0.2.130 Resolver sends: 192.0.2 source netmask; 24 Auth sends: 192.0.2 scope netmask; 26 Resolver sends: 192.0.2.128 source netmask; 26 Is that the idea? It might be worth adding an example of this, and noting the boundary cases that may occur (e.g. what if there are varying degrees of granularity). -- Colm From owner-namedroppers@ops.ietf.org Fri May 28 07:59:54 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 371F33A6A2D; Fri, 28 May 2010 07:59:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.227 X-Spam-Level: X-Spam-Status: No, score=-2.227 tagged_above=-999 required=5 tests=[AWL=0.372, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WK1tT97lkJix; Fri, 28 May 2010 07:59:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E12D23A696A; Fri, 28 May 2010 07:59:52 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0zU-0003G8-Mi for namedroppers-data0@psg.com; Fri, 28 May 2010 14:56:52 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0zQ-0003FR-N1 for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:56:48 +0000 Received: from [195.13.7.35] (helo=surfer-30-0-162.surfnet.iacbox) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0zA-000Ohj-N7; Fri, 28 May 2010 14:56:36 +0000 Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley In-Reply-To: <20100528144946.GF28500@vacation.karoshi.com.> Date: Fri, 28 May 2010 16:56:21 +0200 Cc: Brian Dickson , =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <20100528132723.GB28500@vacation.karoshi.com.> <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> <20100528144946.GF28500@vacation.karoshi.com.> To: bmanning@vacation.karoshi.com X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 195.13.7.35 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-28, at 16:49, bmanning@vacation.karoshi.com wrote: > On Fri, May 28, 2010 at 04:38:08PM +0200, Joe Abley wrote: >>=20 >> On 2010-05-28, at 15:27, bmanning@vacation.karoshi.com wrote: >>=20 >>> right. that was sort of the point. the master can reset the = value >>> at any point in time and the slaves have to react to that = change. >>> at which point an IXFR-only slave has to pull the whole zone. >>=20 >> An IXFR-only slave has options -- it can implement something = different from AXFR to transfer the whole zone, it can shut itself down = and remove itself from an anycast cloud, it can try other servers with = IXFR-only and then (once convinced that no masters can provide an IXFR) = it can request an AXFR. >=20 > anycast cloud? is a recent implementation artifact driving = protocol? Is it so unusual for recent implementation artifacts to cause demand for = new features? > if there is axfr fallback, then how does it qualify for = IXFR-only designation? So you're complaining about the name? :-) >> But presumably given the traffic on this list you are able to confirm = that it has non-zero value for others. >=20 > =09 > sure - and there is enough traffic on other lists to confirm = that djbdns has a non-zero > value to others. djbdns and ixfr-only fit small, niche markets. = does that mean one > should put effort into pushing a standard through for either of = them? The reason to standardise a protocol is to facilitate interop. What reason do you imagine there might be to standardise an = implementation of a protocol? What does that even mean? Joe= From owner-namedroppers@ops.ietf.org Fri May 28 08:00:33 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7A4973A6A3A; Fri, 28 May 2010 08:00:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.406 X-Spam-Level: X-Spam-Status: No, score=-101.406 tagged_above=-999 required=5 tests=[AWL=1.193, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 05nImprju+6A; Fri, 28 May 2010 08:00:32 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C3B713A6A17; Fri, 28 May 2010 08:00:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI10F-0003Qb-1E for namedroppers-data0@psg.com; Fri, 28 May 2010 14:57:39 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI0zy-00036t-A4 for namedroppers@ops.ietf.org; Fri, 28 May 2010 14:57:32 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4SEoc8U028986; Fri, 28 May 2010 14:50:54 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4SEnpL7028976; Fri, 28 May 2010 14:49:51 GMT Date: Fri, 28 May 2010 14:49:46 +0000 From: bmanning@vacation.karoshi.com To: Joe Abley Cc: bmanning@vacation.karoshi.com, Brian Dickson , =?utf-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100528144946.GF28500@vacation.karoshi.com.> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <20100528132723.GB28500@vacation.karoshi.com.> <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 28, 2010 at 04:38:08PM +0200, Joe Abley wrote: > > On 2010-05-28, at 15:27, bmanning@vacation.karoshi.com wrote: > > > right. that was sort of the point. the master can reset the value > > at any point in time and the slaves have to react to that change. > > at which point an IXFR-only slave has to pull the whole zone. > > An IXFR-only slave has options -- it can implement something different from AXFR to transfer the whole zone, it can shut itself down and remove itself from an anycast cloud, it can try other servers with IXFR-only and then (once convinced that no masters can provide an IXFR) it can request an AXFR. anycast cloud? is a recent implementation artifact driving protocol? if there is axfr fallback, then how does it qualify for IXFR-only designation? > > An IXFR slave does not have those options. > > > AXFR covers most use cases (or should) > > It doesn't cover the case when you definitively don't want to transfer the whole zone. right - hence -most- use cases. > > > IXFR is a local optimization > > IXFR is not local, in the sense that it needs to be implemented in both client and server. (I can't think of another contextual meaning for "local" in your comment.) local to a specific delegation, not a generic protocol syncronization method > > > IXFR-only is even more specialized... > > I don't understand the basis for the comparison. IXFR-only is identical to IXFR except that it doesn't fall back to AXFR. er... except it can, per your statement above. > > > I am not persauded of the relative value of IXFR-only. > > But presumably given the traffic on this list you are able to confirm that it has non-zero value for others. sure - and there is enough traffic on other lists to confirm that djbdns has a non-zero value to others. djbdns and ixfr-only fit small, niche markets. does that mean one should put effort into pushing a standard through for either of them? --bill > > > Joe > From owner-namedroppers@ops.ietf.org Fri May 28 08:09:35 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D27C13A6905; Fri, 28 May 2010 08:09:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.577 X-Spam-Level: X-Spam-Status: No, score=-101.577 tagged_above=-999 required=5 tests=[AWL=1.022, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DucJ-uT8kAB9; Fri, 28 May 2010 08:09:35 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7E3C63A6A3E; Fri, 28 May 2010 08:09:34 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI18Z-0005Dn-9w for namedroppers-data0@psg.com; Fri, 28 May 2010 15:06:15 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI18W-0004zv-4Y for namedroppers@ops.ietf.org; Fri, 28 May 2010 15:06:12 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4SEsp8U029018; Fri, 28 May 2010 14:55:07 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4SEsEku029012; Fri, 28 May 2010 14:54:14 GMT Date: Fri, 28 May 2010 14:54:09 +0000 From: bmanning@vacation.karoshi.com To: Joe Abley Cc: bmanning@vacation.karoshi.com, =?utf-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100528145409.GG28500@vacation.karoshi.com.> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <4BFFB92A.1080105@nic.cz> <20100528131827.GA28500@vacation.karoshi.com.> <4BFFC9F0.2030002@nic.cz> <20100528140243.GC28500@vacation.karoshi.com.> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 28, 2010 at 04:38:54PM +0200, Joe Abley wrote: > > On 2010-05-28, at 16:02, bmanning@vacation.karoshi.com wrote: > > > havingtwo distinct functions that perform the same act sort > > of requires a clearly stated value proposition and I don't > > see that in IXFR-only. > > Do you mean you don't see any value to the concept, or that you find the text in the draft lacking? the value in the concept is suspect and the text supporting it tries to replicate existing functionality w/o clear benefit. --bill > > > Joe From owner-namedroppers@ops.ietf.org Fri May 28 08:12:15 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 84ABC3A6A59; Fri, 28 May 2010 08:12:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.704 X-Spam-Level: X-Spam-Status: No, score=-101.704 tagged_above=-999 required=5 tests=[AWL=0.895, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6L75fLhCjXfD; Fri, 28 May 2010 08:12:05 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 26CAD3A6A41; Fri, 28 May 2010 08:12:04 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI1BO-0005e7-9A for namedroppers-data0@psg.com; Fri, 28 May 2010 15:09:10 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI1BK-0005Tc-D0 for namedroppers@ops.ietf.org; Fri, 28 May 2010 15:09:07 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4SF2g8U029066; Fri, 28 May 2010 15:02:58 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4SF1t3M029062; Fri, 28 May 2010 15:01:55 GMT Date: Fri, 28 May 2010 15:01:50 +0000 From: bmanning@vacation.karoshi.com To: Joe Abley Cc: bmanning@vacation.karoshi.com, Brian Dickson , =?utf-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100528150150.GI28500@vacation.karoshi.com.> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <20100528132723.GB28500@vacation.karoshi.com.> <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> <20100528144946.GF28500@vacation.karoshi.com.> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, May 28, 2010 at 04:56:21PM +0200, Joe Abley wrote: > > On 2010-05-28, at 16:49, bmanning@vacation.karoshi.com wrote: > > > On Fri, May 28, 2010 at 04:38:08PM +0200, Joe Abley wrote: > >> > >> On 2010-05-28, at 15:27, bmanning@vacation.karoshi.com wrote: > >> > >>> right. that was sort of the point. the master can reset the value > >>> at any point in time and the slaves have to react to that change. > >>> at which point an IXFR-only slave has to pull the whole zone. > >> > >> An IXFR-only slave has options -- it can implement something different from AXFR to transfer the whole zone, it can shut itself down and remove itself from an anycast cloud, it can try other servers with IXFR-only and then (once convinced that no masters can provide an IXFR) it can request an AXFR. > > > > anycast cloud? is a recent implementation artifact driving protocol? > > Is it so unusual for recent implementation artifacts to cause demand for new features? yeah - it is. > > if there is axfr fallback, then how does it qualify for IXFR-only designation? > > So you're complaining about the name? :-) and the implied functionality behind the name > > >> But presumably given the traffic on this list you are able to confirm that it has non-zero value for others. > > > > > > sure - and there is enough traffic on other lists to confirm that djbdns has a non-zero > > value to others. djbdns and ixfr-only fit small, niche markets. does that mean one > > should put effort into pushing a standard through for either of them? > > The reason to standardise a protocol is to facilitate interop. and yet NAT was never standardized. > > What reason do you imagine there might be to standardise an implementation of a protocol? What does that even mean? this is not the list for metaphysical discussion. But thanks for asking. perhaps over a beer. > > > Joe From owner-namedroppers@ops.ietf.org Fri May 28 08:12:39 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 35E453A6A37; Fri, 28 May 2010 08:12:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.351 X-Spam-Level: X-Spam-Status: No, score=-2.351 tagged_above=-999 required=5 tests=[AWL=0.248, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oESiw5fmwxJG; Fri, 28 May 2010 08:12:36 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3A76F3A6905; Fri, 28 May 2010 08:12:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI1BW-0005fK-Ik for namedroppers-data0@psg.com; Fri, 28 May 2010 15:09:18 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI1BR-0005eT-DH for namedroppers@ops.ietf.org; Fri, 28 May 2010 15:09:13 +0000 Received: from [195.13.7.35] (helo=surfer-30-0-162.surfnet.iacbox) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI1BC-000P4G-L8; Fri, 28 May 2010 15:09:00 +0000 Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley In-Reply-To: <20100528150150.GI28500@vacation.karoshi.com.> Date: Fri, 28 May 2010 17:08:46 +0200 Cc: Brian Dickson , =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <20F0B473-ABE2-4EE4-BFDC-1077069AFA3A@hopcount.ca> References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <20100528132723.GB28500@vacation.karoshi.com.> <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> <20100528144946.GF28500@vacation.karoshi.com.> <20100528150150.GI28500@vacation.karoshi.com.> To: bmanning@vacation.karoshi.com X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 195.13.7.35 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-28, at 17:01, bmanning@vacation.karoshi.com wrote: > On Fri, May 28, 2010 at 04:56:21PM +0200, Joe Abley wrote: >>=20 >=20 >> Is it so unusual for recent implementation artifacts to cause demand = for new features? >=20 > yeah - it is. Weird, because I find it hard to think of a new protocol that isn't = driven by an implementation artifact. >>> if there is axfr fallback, then how does it qualify for = IXFR-only designation? >>=20 >> So you're complaining about the name? :-) >=20 > and the implied functionality behind the name I think at this point your lack of enthusiasm for using this feature, if = standardised and implemented, is clear. >> The reason to standardise a protocol is to facilitate interop. >=20 > and yet NAT was never standardized.=20 And interop consequently suffered. Joe From owner-namedroppers@ops.ietf.org Fri May 28 08:32:00 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 28D983A6A01; Fri, 28 May 2010 08:32:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.145 X-Spam-Level: * X-Spam-Status: No, score=1.145 tagged_above=-999 required=5 tests=[AWL=-1.114, BAYES_20=-0.74, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LgIsrpKbnPxU; Fri, 28 May 2010 08:31:59 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E197B3A6A46; Fri, 28 May 2010 08:31:55 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI1RQ-0008mz-QV for namedroppers-data0@psg.com; Fri, 28 May 2010 15:25:44 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI1RI-0008iu-0u for namedroppers@ops.ietf.org; Fri, 28 May 2010 15:25:36 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 435831ECB408; Fri, 28 May 2010 15:25:30 +0000 (UTC) Date: Fri, 28 May 2010 11:25:28 -0400 From: Andrew Sullivan To: bmanning@vacation.karoshi.com Cc: Joe Abley , Brian Dickson , =?utf-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100528152528.GX28430@shinkuro.com> References: <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <20100528132723.GB28500@vacation.karoshi.com.> <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> <20100528144946.GF28500@vacation.karoshi.com.> <20100528150150.GI28500@vacation.karoshi.com.> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20100528150150.GI28500@vacation.karoshi.com.> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Moderator hat. Bill, On Fri, May 28, 2010 at 03:01:50PM +0000, bmanning@vacation.karoshi.com wrote: > this is not the list for metaphysical discussion. But thanks for asking. > perhaps over a beer. I think we're well down the rathole in the above. If you have an objection to the protocol or it being a WG work item (which, given the number of reviewers who've already volunteered, it will otherwise clearly become), you need to make it. So far, the only real objection I've seen from you seems to be that you don't think the functionality is needed. Since others have outlined their use-case, however, I don't think that objection has much merit. Is there something harmful that you see in this protocol proposal? If so, what is it? A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Fri May 28 09:06:07 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1B1E23A6A0B; Fri, 28 May 2010 09:06:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.301 X-Spam-Level: X-Spam-Status: No, score=-0.301 tagged_above=-999 required=5 tests=[AWL=-0.161, BAYES_20=-0.74, J_CHICKENPOX_23=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1f7ssNtjmkYg; Fri, 28 May 2010 09:06:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1058E3A6982; Fri, 28 May 2010 09:06:05 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI1zI-000Ers-GQ for namedroppers-data0@psg.com; Fri, 28 May 2010 16:00:44 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI1zD-000EoJ-Mp for namedroppers@ops.ietf.org; Fri, 28 May 2010 16:00:39 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 2218CED602; Fri, 28 May 2010 16:00:37 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4SG0ZpR043757; Sat, 29 May 2010 02:00:35 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005281600.o4SG0ZpR043757@drugs.dv.isc.org> To: bmanning@vacation.karoshi.com Cc: =?utf-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" From: Mark Andrews References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <4BFFB92A.1080105@nic.cz> <20100528131827.GA28500@vacation.karoshi.com.> Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-reply-to: Your message of "Fri, 28 May 2010 13:18:27 GMT." <20100528131827.GA28500@vacation.karoshi.com.> Date: Sat, 29 May 2010 02:00:34 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <20100528131827.GA28500@vacation.karoshi.com.>, bmanning@vacation.ka roshi.com writes: > On Fri, May 28, 2010 at 02:38:02PM +0200, OndEej SurC= wrote: > > Bill, > > > > >>> > 2. IXRF Server Side: > > >>> > > > >>> > > > >>> > A IXFR server receiving a DNS message requesting IXFR-ONLY > > >>> will reply > > >>> > as described in RFC 1995 [RFC1995] if it is able to produce > > > >>> an > > >>> IXFR > > >>> > for the serial number requested. > > >>> > > > >>> > Maybe I'm wrong but I always thought that an IXRF request had a > s > > >>> > data the current serial from the requester and that the server > > >>> only > > >>> > when it is "higher" (according to the serial arithmetic). > > >>> > > >>> A IXFR server can return up-to-date, a delta style response or > > >>> a axfr style responses. > > >>> > > >>> IXFR-ONLY removes the latter. > > >>> > > >>>Yes, but that is not the point. > > >>> > > >>>The draft says "the serial number requested" but as far as I know > > >>>you doesn't send the serial number you want, you sent the serial > > >>>you have. > > >>> > > >>>To give a full citation of RFC 1995: > > >>> > > >>> > > >>>3. Query Format > > >>> > > >>> The IXFR query packet format is the same as that of a normal DNS > > >>> query, but with the query type being IXFR and the authority section > > >>> containing the SOA record of client's version of the zone. > > >>> > > >>>This is quite different then what the draft states. > > >> > > >>The draft doesn't say whether "the serial number requested" is the > > >>serial number you want or serial number you have. It merely states that > > >>the server is able to produce IXFR response for the serial number > > >>requested, not saying anything about serial number sent in response. > > >> > > >>But maybe it needs rewording, so it is more clear. > > >> > > >>O > > >>-- > > > > > > the serial number you want presuposes that you have > > > a clue as to what the canonical master is currently using > > > for serial number values. to borrow a line from the > > > finacial folks, "Past Performance is No Guarantee of Future Results" > > > > > > masters can and do change the format of the SOA and slaves > > > are supposed to keep up. > > > > I am not sure if I understand. How is this related to IXFR-only? My > > understanding is that we are just merely describing IXFR behaviour. > > Maybe in a little bit obscured wording which may seems that client is > > sending NEW serial number, but in fact we don't say anything about > > serial number, just that IXFR request has to include serial number > > (which is again pure RFC 1995). > > > please clarify the phrase; "Serial Number Requested". > > imho, the slave has a serial number in hand and asks the > master to send the current serial number. which is > a perfectly fine way to interpret the phrase. > > it could be helpful to have the slave, when asking the master > for the current serial number, to pass the slaves serial number > up to the master, but I can't quite see how the master will use > the information. Which is exactly what it does. The master looks in its change history and generates a response which will bring the client up to date. > this thread suggested that one possible interpretation would be to > request a specific serial number; e.g. I would like serial# 64223 > .. which i believe is an incorrect interpretation. > > > now if the premise of IXFR-only is to just send the diffs between > (serial at slave) and (serial at master), then there is the presumption > that the master has: > > a) kept track of the state of the zone contents between serial number > increments > and > b) the master has not changed the format of the SOA A SOA serial is a 32 bit number. > for example, if the slave as IXFR-only signals to the master: "here > is my current serial number, 2010052800, please send me all updates > since then" and the master responds with: "the current serial number > is 9" -- what should happen? the master changed the format of the > serial number it was using in "mid-stride". It indicates that the slave is ahead of that master and it should try another one. > --bill > > > > Ondrej > > -- > > OndEej SurC= > > vedoucC- vC=zkumu/R&D manager > > ------------------------------------------- > > CZ.NIC, z.s.p.o. -- LaboratoEe CZ.NIC > > Americka 23, 120 00 Praha 2, Czech Republic > > mailto:ondrej.sury@nic.cz http://nic.cz/ > > tel:+420.222745110 fax:+420.222745112 > > ------------------------------------------- > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Fri May 28 09:24:53 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1541A3A682A; Fri, 28 May 2010 09:24:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.348 X-Spam-Level: X-Spam-Status: No, score=-0.348 tagged_above=-999 required=5 tests=[AWL=-0.049, BAYES_00=-2.599, MANGLED_TEXT=2.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D3kYOy6LgGGW; Fri, 28 May 2010 09:24:52 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C38573A6A5E; Fri, 28 May 2010 09:24:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI2IS-000I0N-5V for namedroppers-data0@psg.com; Fri, 28 May 2010 16:20:32 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI2IO-000Hzm-2T for namedroppers@ops.ietf.org; Fri, 28 May 2010 16:20:28 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 1CC59ED602; Fri, 28 May 2010 16:20:26 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4SGKNIu044026; Sat, 29 May 2010 02:20:23 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005281620.o4SGKNIu044026@drugs.dv.isc.org> To: bmanning@vacation.karoshi.com Cc: Joe Abley , =?utf-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" From: Mark Andrews References: <201005200902.o4K92H3S031119@bartok.nlnetlabs.nl> <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <4BFFB92A.1080105@nic.cz> <20100528131827.GA28500@vacation.karoshi.com.> <4BFFC9F0.2030002@nic.cz> <20100528140243.GC28500@vacation.karoshi.com.> <20100528145409.GG28500@vacation.karoshi.com.> Subject: Re: [dnsext] draft-kerr-ixfr-only-01 In-reply-to: Your message of "Fri, 28 May 2010 14:54:09 GMT." <20100528145409.GG28500@vacation.karoshi.com.> Date: Sat, 29 May 2010 02:20:23 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <20100528145409.GG28500@vacation.karoshi.com.>, bmanning@vacation.ka roshi.com writes: > On Fri, May 28, 2010 at 04:38:54PM +0200, Joe Abley wrote: > > > > On 2010-05-28, at 16:02, bmanning@vacation.karoshi.com wrote: > > > > > havingtwo distinct functions that perform the same act sort > > > of requires a clearly stated value proposition and I don't > > > see that in IXFR-only. > > > > Do you mean you don't see any value to the concept, or that you find the te > xt in the draft lacking? > > the value in the concept is suspect and the text supporting it tries to > > replicate existing functionality w/o clear benefit. > > --bill The problem arises from the use of collapsed deltas rather than sending all the individual deltas to the intermediate master. The intermediate masters then don't always have the desired starting point the slave desires when it switches between intermediate masters. The are two possible fixes. 1. Stop sending collapsed deltas to the intermediate masters. One of the reasons named doesn't generate compressed deltas is to avoid this problem. 2. Don't let the slave switch masters. 2. Implement IXFR-only. > > > > > > Joe > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Fri May 28 09:47:19 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BEB053A6832; Fri, 28 May 2010 09:47:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.674 X-Spam-Level: * X-Spam-Status: No, score=1.674 tagged_above=-999 required=5 tests=[AWL=-1.326, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PFXm5fjhGXIm; Fri, 28 May 2010 09:47:18 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 315E23A688D; Fri, 28 May 2010 09:47:17 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI2e7-000LT1-Tq for namedroppers-data0@psg.com; Fri, 28 May 2010 16:42:55 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI2e2-000LSD-K9 for namedroppers@ops.ietf.org; Fri, 28 May 2010 16:42:50 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 2E8321ECB408 for ; Fri, 28 May 2010 16:42:49 +0000 (UTC) Date: Fri, 28 May 2010 12:42:47 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: [dnsext] New work and a proposed new charter Message-ID: <20100528164246.GB28430@shinkuro.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="jousvV0MzM2p6OtC" Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --jousvV0MzM2p6OtC Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Dear colleagues, We have been following the discussion about aliasing with great interest. We have come to the conclusion that work on this topic is needed, that there is work on this topic that we might be able to do, and that there is interest among WG participants to do it. We believe, however, that in order to undertake the work, the WG requires rechartering. We have been nominally "asleep" for some time. We have to wake up. Accordingly, we enclose for consideration a proposed new charter for the DNS Extensions Working Group. We solicit your input to see whether you can subscribe to this charter. You can obviously compare this to the existing charter yourself, but here are some highlighted changes: - The work area list is expanded. It now includes an item that would allow us to adopt DNS Curve (since we've been asked to do), among other things. It also includes scope for the aliasing discussions we've been having. - The language about not intending to have meetings &c. is removed. - There is a fairly sketchy problem statement about aliasing in the text. - The milestones have been updated. Some lingering work has some new, fairly aggressive timetables. - IXFR-only has been added to the milestones. There are adequate reviewers for that work, and it is clearly on charter even under the old rules. - A milestone for agreement on any new or revised RRs related to aliasing work is added. The reason for this is that we have required interop testing in the past even before sending things out of the WG. This case we think will be the same. The goal is to do that testing roughly contemporary with the July 2011 IETF meeting. - New milestones have been added for three classes of aliasing work. They are all listed with the same date, because we're treating them as a package. There is nothing saying that, if something is ready before the others, it needs to wait around. The schedule we have worked out is for roughly a year and a half. We believe this is a completely realistic schedule. We also think that, if the WG cannot complete the work in that time (or thinks it cannot), it will be hard for us to justify even taking on the work or, for that matter, our continued existence as a WG. We have requested two sessions at IETF-78. One of these is intended to run for one hour, but its primary target is not regular DNSEXT attendees. Instead, it is intended as a pure input-gathering session from the rest of the IETF community. The goal here is for some number of us DNS weenies to make sure we have the full list of everything people are dissatisfied with about current aliasing approaches. This input will contribute directly to the "uses and limitations" document contemplated in the draft charter. During the other session, we will have our usual DNSEXT meeting. Current items planned for the agenda include adoption of this charter, some hammering out of the aliasing work, and nailing down some other loose ends in adopted DNSEXT work. Watch the list for a draft agenda. We will take responses to this proposed charter as input, and revise it if need be according to that input. Thanks for your continued participation. Best regards, Olafur & Andrew -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. --jousvV0MzM2p6OtC Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="draft-2010-05-28.txt" DRAFT charter for DNSEXT, 2010-05-28. SUBJECT TO CHANGE Description of Working Group: The DNS has a large installed base and repertoire of protocol specifications. The DNSEXT working group will actively advance DNS protocol-related RFCs on the standards track while thoroughly reviewing further proposed extensions. The scope of the DNSEXT WG is confined to the DNS protocol, particularly changes that affect DNS protocols "on the wire" or the internal processing of DNS data. DNS operations are out of scope for the WG. The WG will consider work in the following areas: * DNSSEC and TSIG/TKEY algorithm maintenance * Mechanisms that complement, or are alternatives to, TSIG and SIG(0) * Hardening DNS protocol and providing guidance to implementers * Advancing existing DNS-related Proposed Standard RFCs to Draft/Full Standard * Obsoleting DNS-related RFCs * Maintaining a Wiki containing a guide to DNS protocol RFCs * Improving DNS zone synchronization mechanisms * Examining transport protocols, possibly adding new ones. * Mechanisms to alias DNS trees or parts thereof While the DNS offers two mechanisms for aliasing DNS labels -- CNAME and DNAME -- neither of these provides the support necessary to alias completely one part of the DNS tree as another part. There are claims that the restriction has proven to be too great in practice, particularly with burgeoning deployment of IDNA and the need to provide domain name variants. The issue is made more complex by DNSSEC The DNSEXT WG will evaluate ways to provide such aliasing, to add metadata to zones to allow easier operation of zones when such aliasing is needed, or both. The WG will also provide an informational document outlining the various strategies available, what they might be used for, and what their limitations are. It is possible that the WG will conclude no aliasing or metadata support is possible, or that none of the proposals so far made are adequate. Before formal adoption of any work item at least 5 working group participants must publicly state that the item is within charter and is a worthwhile item for further study. The DNSEXT WG will conduct the specified RFC5395 review of RR templates as they are posted, and EDNS0 Option templates if EDNS0-bis updates registration requirements. The WG will review DNS protocol related work which may originate elsewhere in the IETF, including AD-sponsored submissions or drafts in other working group. Goals and Milestones: Done AXFR Clarify to IESG Done DNS existing transport protocol recommendations/clarifications to IESG June 2010 RFC3597-bis Unknown RR advanced to IESG for PS July 2010 DNSKEY Registry fixes and allocation procedure advanced to IESG July 2010 DNSSEC Errata document to IESG Sept 2010 EDNS0-bis update advanced to IESG Dec 2010 TSIG/MD5 Obsoleting to IESG Dec 2010 IXFR-only to IESG July 2011 WG consensus on new or revised RRTYPEs for DNS tree aliasing work July 2011 Interoperation testing on new or revised RRTYPEs for DNS tree aliasing (particularly with existing deployed code) Nov 2011 Document on new RRTYPE or revised RRTYPE handling for DNS tree aliasing to IESG Nov 2011 Document on in-zone metadata for DNS tree aliasing to IESG Nov 2011 Document on uses and limitations of different DNS tree aliasing techniques to IESG --jousvV0MzM2p6OtC-- From owner-namedroppers@ops.ietf.org Fri May 28 09:54:12 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 34E2D3A6A67; Fri, 28 May 2010 09:54:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[AWL=1.600, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EAy4itiT8pOh; Fri, 28 May 2010 09:54:11 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 343F33A6955; Fri, 28 May 2010 09:54:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI2la-000MjH-BT for namedroppers-data0@psg.com; Fri, 28 May 2010 16:50:38 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OI2lW-000MiW-0y for namedroppers@ops.ietf.org; Fri, 28 May 2010 16:50:34 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id A202FA248F for ; Fri, 28 May 2010 16:50:33 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: IETF DNSEXT WG Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 In-Reply-To: Your message of "Fri, 28 May 2010 12:40:45 +0100." References: X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Fri, 28 May 2010 16:50:33 +0000 Message-ID: <65889.1275065433@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Fri, 28 May 2010 12:40:45 +0100 > From: Wilmer van der Gaast > > > http://www.ietf.org/id/draft-vandergaast-edns-client-ip-01.txt > > Does nobody have any comments on this draft? no new comments. > We've tried to address as many of the concerns brought up in the > discussion on -00 and would like to know if the WG is more in favour of > this new version. i said "this is a bad idea and should never be done in any form". i don't think you've addressed that concern with this new draft. From owner-namedroppers@ops.ietf.org Sat May 29 05:23:05 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 010553A677D; Sat, 29 May 2010 05:23:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.105 X-Spam-Level: ** X-Spam-Status: No, score=2.105 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S1gY-PMt0ox8; Sat, 29 May 2010 05:23:03 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BB1513A6A9B; Sat, 29 May 2010 05:23:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIKue-000CE7-9p for namedroppers-data0@psg.com; Sat, 29 May 2010 12:13:12 +0000 Received: from [195.54.233.65] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIKua-000CDD-Ds for namedroppers@ops.ietf.org; Sat, 29 May 2010 12:13:08 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jim) by hutch.rfc1035.com (Postfix) with ESMTPSA id 408E515427EB for ; Sat, 29 May 2010 13:13:04 +0100 (BST) Message-Id: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> From: Jim Reid To: IETF DNSEXT WG In-Reply-To: <65889.1275065433@nsa.vix.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Date: Sat, 29 May 2010 13:13:03 +0100 References: <65889.1275065433@nsa.vix.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 28 May 2010, at 17:50, Paul Vixie wrote: > i said "this is a bad idea and should never be done in any form". i > don't > think you've addressed that concern with this new draft. +1 The new version of this draft is still a bad idea IMO. Even if the concerns about Stupid DNS Tricks and how this scheme would be implemented and operated are ignored, the draft is deeply flawed. The end of 4.1 says a recursive resolver MAY throw away this EDNS option on an inbound query whenever a delegation response is expected. Well, how will a recursive resolver know before making a query that it will result in a delegation response? Since the resolving server is free to ignore this EDNS option whenever it chooses -- which is essentially what the last para of 4.1 means -- what's the point of a stub resolver ever using the option? Oh and it doesn't make sense for a recursive resolver to add this option to "vanilla" inbound queries from stubs because that means it's making assumptions about end client behaviour/requirements which are at best misguided or unwanted and at worst downright evil. I'm fairly sure this was mentioned last time round. A resolving server shouldn't be tampering with a stub's queries or the resulting responses. This violates the end-to-end principle. From dnsext-archive@ietf.org Sat May 29 10:41:41 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3143A3A6832 for ; Sat, 29 May 2010 10:41:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -21.2 X-Spam-Level: X-Spam-Status: No, score=-21.2 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DRUGS_PAIN=0.01, FH_HELO_ALMOST_IP=5.417, FH_HOST_ALMOST_IP=1.889, HELO_DYNAMIC_SPLIT_IP=3.493, HOST_EQ_STATIC=1.172, HOST_EQ_STATICIP=1.511, HTML_MESSAGE=0.001, J_CHICKENPOX_64=0.6, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_XBL=3.033, SARE_OBFU_HYDROCODONE=1.666, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NHcDLO2IQHc8 for ; Sat, 29 May 2010 10:41:40 -0700 (PDT) Received: from 140.Red-80-35-227.staticIP.rima-tde.net (140.Red-80-35-227.staticIP.rima-tde.net [80.35.227.140]) by core3.amsl.com (Postfix) with SMTP id 1C5553A6847 for ; Sat, 29 May 2010 10:41:37 -0700 (PDT) To: Subject: Re: Your Hydroc0done 0rder #515608 From: Nicholas Garcia MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20100529174138.1C5553A6847@core3.amsl.com> Date: Sat, 29 May 2010 10:41:37 -0700 (PDT)
Tell a friend · Download latest version See this email as a webpage

Hello!

Shipped Privately And Discreetly To Your Door!
See this email as a webpage
  We want to put a great big grin on your face in 2010. You'll be to rejoice all year.  

Unsubscribe · Lost Password · Account Settings · Help · Terms of Service · Privacy

Ottho Heldringstraat 6, 34757 AZ Amsterdam, The Netherlands
From owner-namedroppers@ops.ietf.org Sat May 29 13:58:51 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F1C1B3A693A; Sat, 29 May 2010 13:58:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.699 X-Spam-Level: X-Spam-Status: No, score=0.699 tagged_above=-999 required=5 tests=[AWL=-1.706, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 84XJU4EBCRTO; Sat, 29 May 2010 13:58:51 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1356E3A690D; Sat, 29 May 2010 13:58:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OISza-0005po-UB for namedroppers-data0@psg.com; Sat, 29 May 2010 20:50:50 +0000 Received: from [74.125.82.180] (helo=mail-wy0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OISzY-0005pR-0c for namedroppers@ops.ietf.org; Sat, 29 May 2010 20:50:48 +0000 Received: by wyb42 with SMTP id 42so747033wyb.11 for ; Sat, 29 May 2010 13:50:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=Lqe21fxiKbVqln50UgBBMUs4qOXhuC2puZKrqYqBbqI=; b=oP/DRIuweQmBzPXfg/XlZoKbmitAO0N9k5lya2noTAAp8eV5elzbd7ZXQ3VN9ty14K 0sKTZRvFCcDDFPqosasfhPx620FpxkRGI57762oecagRUf4zIVUxHk9y/t8V9EgAw5SZ u1Lm5TrqAfxr7qrVExqg/RAGh7HccF1kOPvQ0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=wzaxlWDpeHkxIraTviUXSNKvxYccfCzAg+053Lm5nIl22tAyvkkuDTf7bir3WI486y uSYupdKszYwXg04BujfVaH2qnC8TnDv3hWxybrnav1J9IZzfdJpkT5ycfFM3x/3t0MQ2 FDptEG4NRpBKrpTXVWAdL+zH3M5hr9BG30558= MIME-Version: 1.0 Received: by 10.216.166.144 with SMTP id g16mr2855475wel.35.1275166245975; Sat, 29 May 2010 13:50:45 -0700 (PDT) Received: by 10.216.229.210 with HTTP; Sat, 29 May 2010 13:50:45 -0700 (PDT) In-Reply-To: References: Date: Sat, 29 May 2010 16:50:45 -0400 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: Donald Eastlake To: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= Cc: Wilmer van der Gaast , IETF DNSEXT WG , Carlo Contavalli , Sean Leach , "Rodden, Darryl" Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: 2010/5/28 Colm MacC=E1rthaigh : > On Fri, May 28, 2010 at 4:40 AM, Wilmer van der Gaast = wrote: > >... > > =A0* Rather than specifying the netmask and scope fields as 1 octet, > maybe that size should depend on the FAMILY. Otherwise we exclude > > 256 bit address families. A case where you would want to send more than 256 high order address bits, i.e., more than /256, sounds implausible. And if it did, which I can't see happening for decades, you could always allocate another ENDS option code that had two bytes of netmask... > =A0* I think "SOURCE NETMASK" might be ambigous - source means a lot of t= hings. > =A0 =A0 "CLIENT NETMASK" and "CLIENT SCOPE" and "CLIENT ADDRESS" might be > =A0 =A0more in keeping with the draft name. Why not use DNS terminology like RESOLVER NETMASK and SERVER SCOPE? > =A0* The new scope netmask behaviour implies some negotiation might occur= e.g. > > Actual client IP: =A0192.0.2.130 > Resolver sends: =A0192.0.2 =A0source netmask; 24 > Auth sends: =A0 =A0 =A0 =A0 192.0.2 =A0scope netmask; =A026 > Resolver sends: =A0192.0.2.128 source netmask; 26 > > Is that the idea? It might be worth adding an example of this, and > noting the boundary cases that may occur (e.g. what if there are > varying degrees of granularity). I think the draft makes it pretty clear that after step 3 above the recursive server has to return the non-optimal answer it just got. There is no iteration or "negotiation". But if it caches that answer, it can only use it to answer clients that match at the /26 level. If it gets a subsequent query that is the same at the /24 level but doesn't match at the /26 level, it has to query the auth again. > -- > Colm Donald From owner-namedroppers@ops.ietf.org Sat May 29 14:24:25 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0DA833A6968; Sat, 29 May 2010 14:24:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ViM8J32MzreI; Sat, 29 May 2010 14:24:24 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CA7D63A6967; Sat, 29 May 2010 14:24:23 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OITQZ-0009IX-Ez for namedroppers-data0@psg.com; Sat, 29 May 2010 21:18:43 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OITQW-0009I7-Cb for namedroppers@ops.ietf.org; Sat, 29 May 2010 21:18:40 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id o4TLIcEA012272; Sat, 29 May 2010 14:18:39 -0700 (PDT) Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Nicholas Weaver In-Reply-To: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> Date: Sun, 30 May 2010 09:18:38 +1200 Cc: Nicholas Weaver , IETF DNSEXT WG Content-Transfer-Encoding: quoted-printable Message-Id: References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> To: Jim Reid X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 30, 2010, at 12:13 AM, Jim Reid wrote: > On 28 May 2010, at 17:50, Paul Vixie wrote: >=20 >> i said "this is a bad idea and should never be done in any form". i = don't >> think you've addressed that concern with this new draft. >=20 > +1 >=20 > The new version of this draft is still a bad idea IMO. So question for those who think this is a bad idea: Pick your poison: a: Enable these tricks to work with 3rd party resolvers or b: Accept a world where third party resolvers WILL produce inferior = results: http://www.sajalkayan.com/in-a-cdnd-world-opendns-is-the-enemy.html Can any of those who oppose this solution make a compelling explanation = why B is preferable, because from as far as I can tell, ANY solution for = A is opposed by a vocal portion of this group? Because these "Stupid DNS tricks" do work, are used, and are important, = shaving tens or even hundreds of MS off of user perceived latency when = the user is using the ISP-provided DNS resolver. From owner-namedroppers@ops.ietf.org Sat May 29 15:25:27 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F7473A6A1E; Sat, 29 May 2010 15:25:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.653 X-Spam-Level: ** X-Spam-Status: No, score=2.653 tagged_above=-999 required=5 tests=[AWL=-0.143, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_JP=1.244, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EbJaTlM9yd32; Sat, 29 May 2010 15:25:26 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C5DE13A6A1A; Sat, 29 May 2010 15:25:25 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIUOH-000GLG-Sc for namedroppers-data0@psg.com; Sat, 29 May 2010 22:20:25 +0000 Received: from [131.112.32.132] (helo=necom830.hpcl.titech.ac.jp) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIUOC-000GKK-3K for namedroppers@ops.ietf.org; Sat, 29 May 2010 22:20:20 +0000 Received: (qmail 60859 invoked from network); 29 May 2010 22:38:38 -0000 Received: from softbank219001188004.bbtec.net (HELO ?192.168.1.27?) (219.1.188.4) by necom830.hpcl.titech.ac.jp with SMTP; 29 May 2010 22:38:38 -0000 Message-ID: <4C0192DE.8080802@necom830.hpcl.titech.ac.jp> Date: Sun, 30 May 2010 07:19:10 +0900 From: Masataka Ohta User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Andrew Sullivan CC: bmanning@vacation.karoshi.com, Joe Abley , Brian Dickson , =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= , Jaap Akkerhuis , "namedroppers@ops.ietf.org" Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <20100528132723.GB28500@vacation.karoshi.com.> <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> <20100528144946.GF28500@vacation.karoshi.com.> <20100528150150.GI28500@vacation.karoshi.com.> <20100528152528.GX28430@shinkuro.com> In-Reply-To: <20100528152528.GX28430@shinkuro.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Andrew Sullivan wrote: > Moderator hat. > So far, the only > real objection I've seen from you seems to be that you don't think the > functionality is needed. Since others have outlined their use-case, > however, I don't think that objection has much merit. That's creeping featurism with no engineering legitimacy. Masataka Ohta From owner-namedroppers@ops.ietf.org Sat May 29 17:55:55 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 67F293A69BE; Sat, 29 May 2010 17:55:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.559 X-Spam-Level: *** X-Spam-Status: No, score=3.559 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, MIME_QP_LONG_LINE=1.396, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C652oJgRhpju; Sat, 29 May 2010 17:55:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B80B33A6958; Sat, 29 May 2010 17:55:52 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIWj4-0005m1-EE for namedroppers-data0@psg.com; Sun, 30 May 2010 00:50:02 +0000 Received: from [140.186.190.103] (helo=haybaler.sackheads.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIWj0-0005l7-F7 for namedroppers@ops.ietf.org; Sun, 30 May 2010 00:49:58 +0000 Received: from localhost (localhost.sackheads.org [127.0.0.1]) by haybaler.sackheads.org (Postfix) with ESMTP id 6AC8D285A7; Sat, 29 May 2010 20:49:55 -0400 (EDT) Authentication-Results: haybaler.sackheads.org; domainkeys=pass (testing) header.from=john@sackheads.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275180595; bh=XPtjYW5js8Q+ij2yVWCz2CkOUz4WZoNebyT/PqV9Kqw=; h=References:In-Reply-To:Mime-Version:Content-Transfer-Encoding: Content-Type:Message-Id:Cc:From:Subject:Date:To; b=ym1SQFNVUDK3UB9yp7CJoutm0x+rT5MzosJ8GN460vhvC5lSwGnxuseraZMn4hhuc I5pxBQ+wRymjMjsgz0fg8svr3JQ3tkedfXAIBOw0pHMPZjn6CrjA7Xt9cDJ5zzAsJT vZVjuahdF2Bn4tAMx9Jz6BaZcG4Ki8Ql2/F0966w= Received: from haybaler.sackheads.org ([127.0.0.1]) by localhost (haybaler.sackheads.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cYUiSXRSSsDo; Sat, 29 May 2010 20:49:55 -0400 (EDT) Received: by haybaler.sackheads.org (Postfix, from userid 65534) id 44EDE285A4; Sat, 29 May 2010 20:49:55 -0400 (EDT) Received: from [192.168.1.20] (c-76-19-188-107.hsd1.ma.comcast.net [76.19.188.107]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: john@sackheads.org) by haybaler.sackheads.org (Postfix) with ESMTP id BF7952858F; Sat, 29 May 2010 20:49:54 -0400 (EDT) DomainKey-Signature: a=rsa-sha1; s=haybaler; d=sackheads.org; c=nofws; q=dns; h=dkim-signature:references:in-reply-to:mime-version: content-transfer-encoding:content-type:message-id:cc:x-mailer:from:subject:date:to; b=ssUM/MhTxfoxKiyLDmatvBcJkhMafzwy/hkNRndFtI6aHSKA6k85HxzV2i/YFK7hE OkyYRQFUuKdv1uwiCz736e+n885vMupjqENBO4+7aoCEvVWG7oFC37GjidFYJ2kZmOi GObMiaxwuVCWR1GA6yBvfFINDC8nye65NuYSykM= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275180595; bh=XPtjYW5js8Q+ij2yVWCz2CkOUz4WZoNebyT/PqV9Kqw=; h=References:In-Reply-To:Mime-Version:Content-Transfer-Encoding: Content-Type:Message-Id:Cc:From:Subject:Date:To; b=ym1SQFNVUDK3UB9yp7CJoutm0x+rT5MzosJ8GN460vhvC5lSwGnxuseraZMn4hhuc I5pxBQ+wRymjMjsgz0fg8svr3JQ3tkedfXAIBOw0pHMPZjn6CrjA7Xt9cDJ5zzAsJT vZVjuahdF2Bn4tAMx9Jz6BaZcG4Ki8Ql2/F0966w= References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> In-Reply-To: Mime-Version: 1.0 (iPhone Mail 8A274b) Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Message-Id: <0471ACE4-FDAF-4393-BA62-2E430DCE46CB@sackheads.org> Cc: Jim Reid , Nicholas Weaver , IETF DNSEXT WG X-Mailer: iPhone Mail (8A274b) From: John Payne Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Date: Sat, 29 May 2010 20:49:50 -0400 To: Nicholas Weaver Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 29, 2010, at 5:18 PM, Nicholas Weaver wro= te: >=20 > On May 30, 2010, at 12:13 AM, Jim Reid wrote: >=20 >> On 28 May 2010, at 17:50, Paul Vixie wrote: >>=20 >>> i said "this is a bad idea and should never be done in any form". i don'= t >>> think you've addressed that concern with this new draft. >>=20 >> +1 >>=20 >> The new version of this draft is still a bad idea IMO. >=20 > So question for those who think this is a bad idea: >=20 > Pick your poison: >=20 > a: Enable these tricks to work with 3rd party resolvers >=20 > or >=20 > b: Accept a world where third party resolvers WILL produce inferior result= s: > http://www.sajalkayan.com/in-a-cdnd-world-opendns-is-the-enemy.html >=20 >=20 > Can any of those who oppose this solution make a compelling explanation wh= y B is preferable, because from as far as I can tell, ANY solution for A is o= pposed by a vocal portion of this group? I'd also be curious how many of those opposing this use on their primary mac= hine(s): a) a third party resolver (which is irrelevant) b) their ISP/enterprise DNS c) a local resolver whether on their local network or localhost.=20 d) other >=20 >=20 > Because these "Stupid DNS tricks" do work, are used, and are important, sh= aving tens or even hundreds of MS off of user perceived latency when the use= r is using the ISP-provided DNS resolver. >=20 >=20 From owner-namedroppers@ops.ietf.org Sat May 29 18:32:43 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 65F083A69A6; Sat, 29 May 2010 18:32:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.027 X-Spam-Level: *** X-Spam-Status: No, score=3.027 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7pmL1lv4GHYT; Sat, 29 May 2010 18:32:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 90CAB3A6958; Sat, 29 May 2010 18:32:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIXK0-0009P0-Ea for namedroppers-data0@psg.com; Sun, 30 May 2010 01:28:12 +0000 Received: from [209.85.161.52] (helo=mail-fx0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIXJx-0009OW-0C for namedroppers@ops.ietf.org; Sun, 30 May 2010 01:28:09 +0000 Received: by fxm19 with SMTP id 19so1897442fxm.11 for ; Sat, 29 May 2010 18:28:07 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.185.72 with SMTP id b8mr197054hbh.99.1275182886887; Sat, 29 May 2010 18:28:06 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Sat, 29 May 2010 18:28:06 -0700 (PDT) In-Reply-To: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> Date: Sat, 29 May 2010 18:28:06 -0700 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: Jim Reid Cc: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sat, May 29, 2010 at 5:13 AM, Jim Reid wrote: > Oh and it doesn't make sense for a recursive resolver to add this option to > "vanilla" inbound queries from stubs because that means it's making > assumptions about end client behaviour/requirements which are at best > misguided or unwanted and at worst downright evil. I'm fairly sure this was > mentioned last time round. A resolving server shouldn't be tampering with a > stub's queries or the resulting responses. This violates the end-to-end > principle. Section 4.1 of RFC2671 makes plain that there is no end-to-end principle for EDNS options. Resolvers are not proxies - they do not simply forward queries - when things are working correctly, they do not even forward *most* queries. There really isn't any relationship between the query in and the query out. They are separate things. You could make the same end-to-end argument for EDNS's MTU negotiation. E.g. stub <--- MTU 9000 ---> resolver <--- MTU 1500 ---> auth If the auth truncates a 3K response, and we resort to TCP for a response there - should we force the stub to use TCP too? of course not. -- Colm From dnsext-archive@ietf.org Sat May 29 19:48:27 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8A0353A69A6 for ; Sat, 29 May 2010 19:48:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -31.839 X-Spam-Level: X-Spam-Status: No, score=-31.839 tagged_above=-999 required=5 tests=[BAYES_99=3.5, HELO_EQ_DSL=1.129, HELO_EQ_PL=1.135, HOST_EQ_PL=1.95, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vf5ufYESj0-a for ; Sat, 29 May 2010 19:48:26 -0700 (PDT) Received: from public69268.xdsl.centertel.pl (public69268.xdsl.centertel.pl [79.162.142.148]) by core3.amsl.com (Postfix) with SMTP id 1F4523A6977 for ; Sat, 29 May 2010 19:48:24 -0700 (PDT) To: Subject: RE: Q&A Doctor Annmarie From: Deena Boston MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20100530024825.1F4523A6977@core3.amsl.com> Date: Sat, 29 May 2010 19:48:24 -0700 (PDT)
Tell a friend · Download latest version See this email as a webpage

Hello!

Shipped Privately And Discreetly To Your Door!
See this email as a webpage
  We want to put a great big grin on your face in 2010. You'll be to rejoice all year.  

Unsubscribe · Lost Password · Account Settings · Help · Terms of Service · Privacy

Ottho Heldringstraat 7, 31967 AZ Amsterdam, The Netherlands
From owner-namedroppers@ops.ietf.org Sat May 29 21:22:30 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E173B3A657C; Sat, 29 May 2010 21:22:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.232 X-Spam-Level: X-Spam-Status: No, score=-0.232 tagged_above=-999 required=5 tests=[AWL=-0.233, BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9uSLTPJNy8Qr; Sat, 29 May 2010 21:22:29 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 715193A65A6; Sat, 29 May 2010 21:22:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIZuX-000NL7-O8 for namedroppers-data0@psg.com; Sun, 30 May 2010 04:14:05 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIZuT-000NKk-MQ for namedroppers@ops.ietf.org; Sun, 30 May 2010 04:14:01 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id DE0C5A2CDD for ; Sun, 30 May 2010 04:13:59 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: IETF DNSEXT WG Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 In-Reply-To: Your message of "Sun, 30 May 2010 09:18:38 +1200." References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Sun, 30 May 2010 04:13:59 +0000 Message-ID: <94886.1275192839@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Nicholas Weaver > Date: Sun, 30 May 2010 09:18:38 +1200 > > So question for those who think this is a bad idea: > > Pick your poison: > > a: Enable these tricks to work with 3rd party resolvers > > or > > b: Accept a world where third party resolvers WILL produce inferior results: > http://www.sajalkayan.com/in-a-cdnd-world-opendns-is-the-enemy.html i'm fine with "b" since running your own resolver is so darned easy that there's no excuse for outsourcing it. resolvers should be on-lan or on-host. that third party resolvers could come along and say, since we're here now, and since we don't share fate with our clients, we need a way to tell the cdn's of the world that their stupid dns tricks need to be directed at the client's ip not the resolver's ip, is triply silly. don't do the stupid dns tricks on the cdn side, and/or, don't outsource recursive dns. then, as it was before people started doing these silly things, all will be well. otherwise we're compounding bad ideas by adding other bad ideas to try to make them work, and it all amounts to an architectural change that neither the IAB nor DNSEXT has ever agreed to. > Can any of those who oppose this solution make a compelling explanation > why B is preferable, because from as far as I can tell, ANY solution for > A is opposed by a vocal portion of this group? "let's change the protocol to make it more complicated and harder to debug in order to enable other people to sell more snake oil" is CRAZY. > Because these "Stupid DNS tricks" do work, are used, and are important, > shaving tens or even hundreds of MS off of user perceived latency when > the user is using the ISP-provided DNS resolver. if that's so, then anycast tcp/80 would also work. even so, we're not here to argue about whether it works or whether it's used or important. what's at issue here is "is it necessary?" and "is this an architecture we want?". i'd answer "no" and "no". sneaking stuff like this in seems popular. i did it with the SRV RR, which was an architectural change to the connection model, which neither the IAB nor anybody else saw coming, and now it's part of the architecture. maybe that's the only way to get anything done. however, this time, i'm seeing it coming and i'm opposed to this change to the connection model. brass tacks now: i think that what the rules say is, if somebody (me) is opposed on the grounds that it's a change to the internet architecture, then you need to get the IAB to either say that it's not such a change, or say that it's a change that has IETF consensus. i do not think this WG can decide whether to accept this as a work item with this kind of objection now outstanding. From owner-namedroppers@ops.ietf.org Sat May 29 22:02:33 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0087D3A69D5; Sat, 29 May 2010 22:02:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 57HAfnXw4k9U; Sat, 29 May 2010 22:02:31 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 70C493A69D4; Sat, 29 May 2010 22:02:31 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIabE-0001LY-Ej for namedroppers-data0@psg.com; Sun, 30 May 2010 04:58:12 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIab9-0001Ky-HD for namedroppers@ops.ietf.org; Sun, 30 May 2010 04:58:07 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id o4U4vkug015107; Sat, 29 May 2010 21:57:46 -0700 (PDT) Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Nicholas Weaver In-Reply-To: <94886.1275192839@nsa.vix.com> Date: Sun, 30 May 2010 16:57:45 +1200 Cc: Nicholas Weaver , IETF DNSEXT WG Content-Transfer-Encoding: quoted-printable Message-Id: References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> To: Paul Vixie X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 30, 2010, at 4:13 PM, Paul Vixie wrote: >> From: Nicholas Weaver >> Date: Sun, 30 May 2010 09:18:38 +1200 >>=20 >> So question for those who think this is a bad idea: >>=20 >> Pick your poison: >>=20 >> a: Enable these tricks to work with 3rd party resolvers >>=20 >> or >>=20 >> b: Accept a world where third party resolvers WILL produce inferior = results: >> http://www.sajalkayan.com/in-a-cdnd-world-opendns-is-the-enemy.html >=20 > i'm fine with "b" since running your own resolver is so darned easy > that there's no excuse for outsourcing it. resolvers should be on-lan > or on-host. So then why have the recursive resolver at all in the architecture, = since this is the one real and certified enemy of DNS security? And stupid DNS tricks really aren't stupid, because there IS no = alternative: Anycast TCP doesn't work well in widespread deployment, = application level redirections both don't work and eliminate the latency = savings, etc... Getting rid of those tricks is going back to a world = where you have 100ms more latency visiting many sites. Sorry, NOT GONNA = HAPPEN. So in the end it seems you are perfectly comfortable in a world where = these DNS tricks are used and common and critical (because that is the = world already), but you can't have third party resolvers, so we are at = the mercy of the (wildcarding, or even MitM-ing!) ISP-provided resolver = because no major OS ships with an on-default recursive DNS resolver = instead of a stub resolver? >> Because these "Stupid DNS tricks" do work, are used, and are = important, >> shaving tens or even hundreds of MS off of user perceived latency = when >> the user is using the ISP-provided DNS resolver. >=20 > if that's so, then anycast tcp/80 would also work. even so, we're not = here > to argue about whether it works or whether it's used or important. = what's > at issue here is "is it necessary?" and "is this an architecture we = want?". > i'd answer "no" and "no". There are huge business advantages in being 100ms better on your web = site. So the tricks themselves have become necessary. Sorry, but thats = life. There is no alternative to shave that particular latency that is = proven to work in wide deployment. Not only that, but I find the complexty arguments dubious at best: This = is an extension which will ONLY affect resolvers and authorities who = care. Its only the pairwise points where this happens. AND, because = all results returned even without this are CORRECT (but perhaps = suboptimal), the debugging impact is minor at worst. > brass tacks now: >=20 > i think that what the rules say is, if somebody (me) is opposed on the > grounds that it's a change to the internet architecture, then you need = to > get the IAB to either say that it's not such a change, or say that = it's a > change that has IETF consensus. i do not think this WG can decide = whether > to accept this as a work item with this kind of objection now = outstanding. WHAT change to the internet architecture? CDN and related DNS tricks = are, at this point, in the architecture. Period. End of story. Have a = nice day. Preserving the architectural feature is not changing the = architecture. And my brass tacks now: If I was OpenDNS, Google Public DNS, etc, I'd say "F-it, we're doing = it": Thats the point of EDNS extensions, they are optional extensions = that only create complexity when BOTH sides respect them. Actually, I'd say "F-it part 2", and do it with pairwise agreements with = the major CDNs to communicate in a side channel, so that MY third party = DNS service shows good performance but your's doesn't, because I have = the pairwise agreements and you don't! Is that what you want? Because that seems to be the outcome you are = intent on creating. From owner-namedroppers@ops.ietf.org Sat May 29 23:13:03 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D4DD83A687D; Sat, 29 May 2010 23:13:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CWL-9ZHTZZib; Sat, 29 May 2010 23:13:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 24C113A69D8; Sat, 29 May 2010 23:13:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIbfj-0007yV-4w for namedroppers-data0@psg.com; Sun, 30 May 2010 06:06:55 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIbff-0007y4-Vf for namedroppers@ops.ietf.org; Sun, 30 May 2010 06:06:52 +0000 Received: from [77.241.230.241] (helo=sn4wlan150.klm.aas.attingo.nl) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIbfc-000L49-BV; Sun, 30 May 2010 06:06:49 +0000 Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley In-Reply-To: Date: Sun, 30 May 2010 09:06:45 +0300 Cc: Paul Vixie , IETF DNSEXT WG Content-Transfer-Encoding: 7bit Message-Id: <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> To: Nicholas Weaver X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 77.241.230.241 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-30, at 07:57, Nicholas Weaver wrote: > Anycast TCP doesn't work well in widespread deployment, cite? From owner-namedroppers@ops.ietf.org Sun May 30 00:07:58 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 21FEC3A67B5; Sun, 30 May 2010 00:07:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.474 X-Spam-Level: X-Spam-Status: No, score=-1.474 tagged_above=-999 required=5 tests=[AWL=1.125, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NMseSNWI4MRt; Sun, 30 May 2010 00:07:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3039A3A69DA; Sun, 30 May 2010 00:07:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIcZ4-000E5U-L7 for namedroppers-data0@psg.com; Sun, 30 May 2010 07:04:06 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIcZ0-000E4y-Pd for namedroppers@ops.ietf.org; Sun, 30 May 2010 07:04:02 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 985C4A2D89; Sun, 30 May 2010 07:04:01 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: "George Barwood" cc: "IETF DNSEXT WG" Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 In-Reply-To: Your message of "Sun, 30 May 2010 07:33:51 +0100." <000D182D9572488CB3D58615EE28D54B@local> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <000D182D9572488CB3D58615EE28D54B@local> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Sun, 30 May 2010 07:04:01 +0000 Message-ID: <12425.1275203041@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: "George Barwood" > Date: Sun, 30 May 2010 07:33:51 +0100 > > It's one that I have some sympathy for, but the train left the station in > RFC 1034. i was there, and i can tell you, that's not how it was. > I think it is you Paul that is proposing a change of architecture, and > you need to justify it. not so much. > Large shared caches have some benefits ( and various disadvantages ). that's why there are forwarders. > If we are proposing to no longer support the shared caching model, that > is a major change. shared caching is fine. see above. From owner-namedroppers@ops.ietf.org Sun May 30 02:30:38 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F238C3A67B5; Sun, 30 May 2010 02:30:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.748 X-Spam-Level: X-Spam-Status: No, score=-3.748 tagged_above=-999 required=5 tests=[AWL=1.300, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mU3MpN+0qgsk; Sun, 30 May 2010 02:30:37 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A14293A67AC; Sun, 30 May 2010 02:30:36 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIejB-00069M-D5 for namedroppers-data0@psg.com; Sun, 30 May 2010 09:22:41 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIej6-00067q-5v for namedroppers@ops.ietf.org; Sun, 30 May 2010 09:22:36 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id o4U9MDEZ003488; Sun, 30 May 2010 02:22:14 -0700 (PDT) Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Nicholas Weaver In-Reply-To: <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> Date: Sun, 30 May 2010 21:22:13 +1200 Cc: Nicholas Weaver , Paul Vixie , IETF DNSEXT WG Content-Transfer-Encoding: quoted-printable Message-Id: <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> To: Joe Abley X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 30, 2010, at 6:06 PM, Joe Abley wrote: >=20 > On 2010-05-30, at 07:57, Nicholas Weaver wrote: >=20 >> Anycast TCP doesn't work well in widespread deployment, >=20 > cite? I can't cite, but can anyone cite someone who IS using widespread TCP = multicast, eg, for CDN type applications? From owner-namedroppers@ops.ietf.org Sun May 30 02:53:30 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4EE713A67D1; Sun, 30 May 2010 02:53:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.366 X-Spam-Level: X-Spam-Status: No, score=-101.366 tagged_above=-999 required=5 tests=[AWL=-0.093, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ztjuy0FWZpPZ; Sun, 30 May 2010 02:53:29 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 76FEB3A67AC; Sun, 30 May 2010 02:53:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIf99-0009GN-0j for namedroppers-data0@psg.com; Sun, 30 May 2010 09:49:31 +0000 Received: from [216.239.44.51] (helo=smtp-out.google.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIf90-0009FT-NI for namedroppers@ops.ietf.org; Sun, 30 May 2010 09:49:27 +0000 Received: from hpaq11.eem.corp.google.com (hpaq11.eem.corp.google.com [172.25.149.11]) by smtp-out.google.com with ESMTP id o4U9nHKK020339 for ; Sun, 30 May 2010 02:49:19 -0700 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1275212961; bh=7gwS17eIhnKuhWu+JTFLSZzjl8M=; h=MIME-Version:In-Reply-To:References:Date:Message-ID:Subject:From: To:Cc:Content-Type:Content-Transfer-Encoding; b=upMwtf8mGtAvAcqpmEpJTC1zS7exnuKGVi07W/J7NLM22GBXzUAlX23yhf9CZ54ea /z8bnzBujBlslDnvvhtkw== DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=mime-version:in-reply-to:references:date:message-id:subject:from:to: cc:content-type:content-transfer-encoding:x-system-of-record; b=dmrSC/4yu15u8J8iyfOJS6NYiEyf81Z9LkN8ctEqAEbZJXLREJUkPJWNHeUGr+bKj Pmqb22Y50yFRyH9i2PRKA== Received: from ewy21 (ewy21.prod.google.com [10.241.103.21]) by hpaq11.eem.corp.google.com with ESMTP id o4U9nD6c007165 for ; Sun, 30 May 2010 02:49:16 -0700 Received: by ewy21 with SMTP id 21so838753ewy.7 for ; Sun, 30 May 2010 02:49:13 -0700 (PDT) MIME-Version: 1.0 Received: by 10.213.35.193 with SMTP id q1mr1466563ebd.38.1275212952911; Sun, 30 May 2010 02:49:12 -0700 (PDT) Received: by 10.213.14.12 with HTTP; Sun, 30 May 2010 02:49:12 -0700 (PDT) In-Reply-To: <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> Date: Sun, 30 May 2010 10:49:12 +0100 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: Wilmer van der Gaast To: Nicholas Weaver Cc: Joe Abley , Paul Vixie , IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-System-Of-Record: true Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 30 May 2010 10:22, Nicholas Weaver wrote: > > I can't cite, but can anyone cite someone who IS using widespread TCP mul= ticast, eg, for CDN type applications? > This point came up in the previous discussion, and Colm MacC=E1rthaigh had some experiences with TCP anycast (although the post is not backed up with data): http://www.ops.ietf.org/lists/namedroppers/namedroppers.2010/msg00120.html Wilmer. --=20 Wilmer van der Gaast, Traffic SRE/Google Public DNS team. Google Ireland. From owner-namedroppers@ops.ietf.org Sun May 30 05:13:47 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5D2323A69DB; Sun, 30 May 2010 05:13:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.597 X-Spam-Level: X-Spam-Status: No, score=-100.597 tagged_above=-999 required=5 tests=[AWL=-0.412, BAYES_40=-0.185, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PKcZK-xuB-5B; Sun, 30 May 2010 05:13:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 242703A6AC7; Sun, 30 May 2010 05:11:34 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIhGv-0000En-Bt for namedroppers-data0@psg.com; Sun, 30 May 2010 12:05:41 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIhGq-00004B-94 for namedroppers@ops.ietf.org; Sun, 30 May 2010 12:05:37 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4UC2gsx015312; Sun, 30 May 2010 12:03:18 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4UC1MXx015307; Sun, 30 May 2010 12:01:22 GMT Date: Sun, 30 May 2010 12:01:16 +0000 From: bmanning@vacation.karoshi.com To: Nicholas Weaver Cc: Jim Reid , IETF DNSEXT WG Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Message-ID: <20100530120116.GC6111@vacation.karoshi.com.> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sun, May 30, 2010 at 09:18:38AM +1200, Nicholas Weaver wrote: > > On May 30, 2010, at 12:13 AM, Jim Reid wrote: > > > On 28 May 2010, at 17:50, Paul Vixie wrote: > > > >> i said "this is a bad idea and should never be done in any form". i don't > >> think you've addressed that concern with this new draft. > > > > +1 > > > > The new version of this draft is still a bad idea IMO. > > So question for those who think this is a bad idea: > > Pick your poison: > > a: Enable these tricks to work with 3rd party resolvers > > or > > b: Accept a world where third party resolvers WILL produce inferior results: > http://www.sajalkayan.com/in-a-cdnd-world-opendns-is-the-enemy.html > > > Can any of those who oppose this solution make a compelling explanation why B is preferable, because from as far as I can tell, ANY solution for A is opposed by a vocal portion of this group? > > > Because these "Stupid DNS tricks" do work, are used, and are important, shaving tens or even hundreds of MS off of user perceived latency when the user is using the ISP-provided DNS resolver. should I care that I get a wrong answer back faster? --bill From owner-namedroppers@ops.ietf.org Sun May 30 05:16:12 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9C8FC3A6934; Sun, 30 May 2010 05:16:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.313 X-Spam-Level: X-Spam-Status: No, score=-100.313 tagged_above=-999 required=5 tests=[AWL=-0.614, BAYES_50=0.001, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vq9n-lkjaxv8; Sun, 30 May 2010 05:16:11 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 972323A6A75; Sun, 30 May 2010 05:13:30 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIhLR-0000n8-Sn for namedroppers-data0@psg.com; Sun, 30 May 2010 12:10:21 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIhLM-0000eR-HQ for namedroppers@ops.ietf.org; Sun, 30 May 2010 12:10:16 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4UC7asx015343; Sun, 30 May 2010 12:07:52 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4UC767Y015339; Sun, 30 May 2010 12:07:06 GMT Date: Sun, 30 May 2010 12:07:01 +0000 From: bmanning@vacation.karoshi.com To: Colm =?iso-8859-1?Q?MacC=E1rthaigh?= Cc: Jim Reid , IETF DNSEXT WG Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Message-ID: <20100530120701.GD6111@vacation.karoshi.com.> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sat, May 29, 2010 at 06:28:06PM -0700, Colm MacCarthaigh wrote: > On Sat, May 29, 2010 at 5:13 AM, Jim Reid wrote: > > Oh and it doesn't make sense for a recursive resolver to add this option to > > "vanilla" inbound queries from stubs because that means it's making > > assumptions about end client behaviour/requirements which are at best > > misguided or unwanted and at worst downright evil. I'm fairly sure this was > > mentioned last time round. A resolving server shouldn't be tampering with a > > stub's queries or the resulting responses. This violates the end-to-end > > principle. > > Section 4.1 of RFC2671 makes plain that there is no end-to-end > principle for EDNS options. > > Resolvers are not proxies - they do not simply forward queries - when things > are working correctly, they do not even forward *most* queries. There really > isn't any relationship between the query in and the query out. They are > separate things. > > You could make the same end-to-end argument for EDNS's MTU negotiation. E.g. > > stub <--- MTU 9000 ---> resolver <--- MTU 1500 ---> auth > > If the auth truncates a 3K response, and we resort to TCP for a > response there - should we force the stub to use TCP too? of course > not. > > -- > Colm er... actually we do w/ DNSSEC - presuming the validation process is co-resident w/ the resolver process. That MTU better be big enough to pass the full UDP datagram. --bill From dnsext-archive@ietf.org Sun May 30 05:32:32 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 07C1A3A684D for ; Sun, 30 May 2010 05:32:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -29.909 X-Spam-Level: X-Spam-Status: No, score=-29.909 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, HELO_MISMATCH_COM=0.553, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_RECV_SPAM_DOMN02=1.666, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cuUycz9hIvlU for ; Sun, 30 May 2010 05:32:30 -0700 (PDT) Received: from agconnections.com (201-68-28-20.dsl.telesp.net.br [201.68.28.20]) by core3.amsl.com (Postfix) with SMTP id 527623A6880 for ; Sun, 30 May 2010 05:32:23 -0700 (PDT) To: Subject: 2 dnsext-archive@ietf.org From: Alec Jarvis MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20100530123224.527623A6880@core3.amsl.com> Date: Sun, 30 May 2010 05:32:23 -0700 (PDT)
Tell a friend · Download latest version See this email as a webpage

Hello!

Shipped Privately And Discreetly To Your Door!
See this email as a webpage
  We want to put a great big grin on your face in 2010. You'll be to rejoice all year.  

Unsubscribe · Lost Password · Account Settings · Help · Terms of Service · Privacy

Ottho Heldringstraat 1, 20893 AZ Amsterdam, The Netherlands
From dnsext-archive@ietf.org Sun May 30 06:25:44 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 46E473A6892 for ; Sun, 30 May 2010 06:25:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -31.061 X-Spam-Level: X-Spam-Status: No, score=-31.061 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_DSL=1.129, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RDNS_DYNAMIC=0.1, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sl4XUUN7V29m for ; Sun, 30 May 2010 06:25:40 -0700 (PDT) Received: from 0085-127-27-72-DYNAMIC-dsl.cwjamaica.com (0254-17-27-72-DYNAMIC-dsl.cwjamaica.com [72.27.17.254]) by core3.amsl.com (Postfix) with SMTP id 7A00F3A67A1 for ; Sun, 30 May 2010 06:25:36 -0700 (PDT) To: Subject: 0rder #522648 From: Nanette Marcus MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20100530132537.7A00F3A67A1@core3.amsl.com> Date: Sun, 30 May 2010 06:25:36 -0700 (PDT)
Tell a friend · Download latest version See this email as a webpage

Hello!

Shipped Privately And Discreetly To Your Door!
See this email as a webpage
  We want to put a great big grin on your face in 2010. You'll be to rejoice all year.  

Unsubscribe · Lost Password · Account Settings · Help · Terms of Service · Privacy

Ottho Heldringstraat 9, 55383 AZ Amsterdam, The Netherlands
From owner-namedroppers@ops.ietf.org Sun May 30 09:07:05 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 664D73A68B5; Sun, 30 May 2010 09:07:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3 X-Spam-Level: *** X-Spam-Status: No, score=3 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NgD95EKe5794; Sun, 30 May 2010 09:07:04 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6867D3A681B; Sun, 30 May 2010 09:07:04 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIkts-0005UK-Cu for namedroppers-data0@psg.com; Sun, 30 May 2010 15:58:08 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIktp-0005Tm-FS for namedroppers@ops.ietf.org; Sun, 30 May 2010 15:58:05 +0000 Received: from [10.140.156.182] (unknown [24.114.232.25]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 318871ECB41D; Sun, 30 May 2010 15:58:01 +0000 (UTC) Message-Id: <46B33079-2A3D-4C6E-817D-6AEB3FEF0211@shinkuro.com> From: Andrew Sullivan To: namedroppers@ops.ietf.org In-Reply-To: <4C0192DE.8080802@necom830.hpcl.titech.ac.jp> Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit X-Mailer: iPhone Mail (7E18) Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Mime-Version: 1.0 (iPhone Mail 7E18) Date: Sun, 30 May 2010 11:57:49 -0400 References: <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <20100528132723.GB28500@vacation.karoshi.com.> <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> <20100528144946.GF28500@vacation.karoshi.com.> <20100528150150.GI28500@vacation.karoshi.com.> <20100528152528.GX28430@shinkuro.com> <4C0192DE.8080802@necom830.hpcl.titech.ac.jp> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Nonsense. It is not creeping featurism to add a feature not currently available in order to support a use case not currently supported. It's just adding a feature. Otherwise, we should never add anything to an existing system. A -- Andrew Sullivan On 2010-05-29, at 18:19, Masataka Ohta wrote: > Andrew Sullivan wrote: > >> Moderator hat. > >> So far, the only >> real objection I've seen from you seems to be that you don't think >> the >> functionality is needed. Since others have outlined their use-case, >> however, I don't think that objection has much merit. > > That's creeping featurism with no engineering legitimacy. > > Masataka Ohta From dnsext-archive@ietf.org Sun May 30 09:28:36 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E8B363A68C6 for ; Sun, 30 May 2010 09:28:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -34.502 X-Spam-Level: X-Spam-Status: No, score=-34.502 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_RELAY_NODNS=1.451, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o9Y4mW0rVWak for ; Sun, 30 May 2010 09:28:35 -0700 (PDT) Received: from aic-ingenieurs.ch (unknown [186.137.85.50]) by core3.amsl.com (Postfix) with SMTP id D06B83A68D0 for ; Sun, 30 May 2010 09:28:32 -0700 (PDT) To: Subject: 2 dnsext-archive@ietf.org From: Myrtle Mcdermott MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20100530162833.D06B83A68D0@core3.amsl.com> Date: Sun, 30 May 2010 09:28:32 -0700 (PDT)
Tell a friend · Download latest version See this email as a webpage

Hello!

Shipped Privately And Discreetly To Your Door!
See this email as a webpage
  We want to put a great big grin on your face in 2010. You'll be to rejoice all year.  

Unsubscribe · Lost Password · Account Settings · Help · Terms of Service · Privacy

Ottho Heldringstraat 5, 07422 AZ Amsterdam, The Netherlands
From owner-namedroppers@ops.ietf.org Sun May 30 09:32:38 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 95EDE3A68D0; Sun, 30 May 2010 09:32:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.027 X-Spam-Level: *** X-Spam-Status: No, score=3.027 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0CUvbim430Yo; Sun, 30 May 2010 09:32:37 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0348B3A68C6; Sun, 30 May 2010 09:32:36 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIlNE-0009pv-NG for namedroppers-data0@psg.com; Sun, 30 May 2010 16:28:29 +0000 Received: from [72.14.220.154] (helo=fg-out-1718.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIlN9-0009oz-0n for namedroppers@ops.ietf.org; Sun, 30 May 2010 16:28:23 +0000 Received: by fg-out-1718.google.com with SMTP id l26so422884fgb.17 for ; Sun, 30 May 2010 09:28:20 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.189.12 with SMTP id r12mr282906hbh.129.1275236900539; Sun, 30 May 2010 09:28:20 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Sun, 30 May 2010 09:28:20 -0700 (PDT) In-Reply-To: References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> Date: Sun, 30 May 2010 09:28:20 -0700 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: Wilmer van der Gaast Cc: Nicholas Weaver , Joe Abley , Paul Vixie , IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sun, May 30, 2010 at 2:49 AM, Wilmer van der Gaast w= rote: > On 30 May 2010 10:22, Nicholas Weaver wrote: >> >> I can't cite, but can anyone cite someone who IS using widespread TCP mu= lticast, eg, for CDN type applications? >> > This point came up in the previous discussion, and Colm MacC=E1rthaigh > had some experiences with TCP anycast (although the post is not backed > up with data): > > http://www.ops.ietf.org/lists/namedroppers/namedroppers.2010/msg00120.htm= l I think one of the strongest source of data is that CDNs have built DNS tricks in the first place, in spite of the fact that they also use anycast. Clearly it cost money and time to develop the tricks, and it stretches credibility to suggest that they maintain them for no good reason. Plainly, CDNs have repeatedly come to the conclusion that anycast alone does not deliver sufficient latency-oriented network locality. I don't think it's controversial to claim that BGP takes no account of endpoint latency in its decisions to resolve ties. AS path length is a poor proxy, and I think we all realise that the size of AS's vary greatly. --=20 Colm From owner-namedroppers@ops.ietf.org Sun May 30 09:34:17 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E60C73A68AD; Sun, 30 May 2010 09:34:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.934 X-Spam-Level: ** X-Spam-Status: No, score=2.934 tagged_above=-999 required=5 tests=[AWL=0.093, BAYES_40=-0.185, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PFLlYLSCM7b8; Sun, 30 May 2010 09:34:15 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CFFC93A681B; Sun, 30 May 2010 09:34:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIlPc-000A9G-AW for namedroppers-data0@psg.com; Sun, 30 May 2010 16:30:56 +0000 Received: from [209.85.161.52] (helo=mail-fx0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIlPZ-000A8a-Bz for namedroppers@ops.ietf.org; Sun, 30 May 2010 16:30:53 +0000 Received: by fxm19 with SMTP id 19so2378906fxm.11 for ; Sun, 30 May 2010 09:30:51 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.185.72 with SMTP id b8mr248768hbh.99.1275237051478; Sun, 30 May 2010 09:30:51 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Sun, 30 May 2010 09:30:51 -0700 (PDT) In-Reply-To: <20100530120701.GD6111@vacation.karoshi.com.> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <20100530120701.GD6111@vacation.karoshi.com.> Date: Sun, 30 May 2010 09:30:51 -0700 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: bmanning@vacation.karoshi.com Cc: Jim Reid , IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: 2010/5/30 : >> You could make the same end-to-end argument for EDNS's MTU negotiation. = E.g. >> >> =A0stub <--- MTU 9000 ---> resolver <--- MTU 1500 ---> auth >> >> If the auth truncates a 3K response, and we resort to TCP for a >> response there - should we force the stub to use TCP too? of course >> not. > > =A0 =A0 =A0 =A0er... actually we do w/ DNSSEC - presuming the validation = process > =A0 =A0 =A0 =A0is co-resident w/ the resolver process. =A0That MTU better= be big > =A0 =A0 =A0 =A0enough to pass the full UDP datagram. Are you misreading the example? The MTU is big enough, and I made no such presumption :) --=20 Colm From owner-namedroppers@ops.ietf.org Sun May 30 09:55:22 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5FE653A68B3; Sun, 30 May 2010 09:55:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.996 X-Spam-Level: ** X-Spam-Status: No, score=2.996 tagged_above=-999 required=5 tests=[AWL=-0.031, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pCaGVh2bytZU; Sun, 30 May 2010 09:55:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 841BE3A681B; Sun, 30 May 2010 09:55:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIljD-000DMf-Tl for namedroppers-data0@psg.com; Sun, 30 May 2010 16:51:11 +0000 Received: from [209.85.161.52] (helo=mail-fx0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIlj9-000DLo-Re for namedroppers@ops.ietf.org; Sun, 30 May 2010 16:51:08 +0000 Received: by fxm19 with SMTP id 19so2393040fxm.11 for ; Sun, 30 May 2010 09:51:05 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.160.71 with SMTP id b7mr303242hbd.93.1275238265146; Sun, 30 May 2010 09:51:05 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Sun, 30 May 2010 09:51:05 -0700 (PDT) In-Reply-To: <94886.1275192839@nsa.vix.com> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> Date: Sun, 30 May 2010 09:51:05 -0700 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: Paul Vixie Cc: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sat, May 29, 2010 at 9:13 PM, Paul Vixie wrote: > i think that what the rules say is, if somebody (me) is opposed on the > grounds that it's a change to the internet architecture, then you need to > get the IAB to either say that it's not such a change, or say that it's a > change that has IETF consensus. i do not think this WG can decide whether > to accept this as a work item with this kind of objection now outstanding. Which rules? I can't see anything to that effect in RFC2026. But there are a lot of documents it could be in :) In any event, speaking to the architectural change - do you agree that; a) Since day 1 - DNS has not guaranteed consistent answers from authoritative servers. The easiest example is an update that has made its way to only a subset of the N NSs for a zone - say. Can we agree that that is built-in always-been-happening behaviour of the DNS? b) There are features of DNS designed to accommodate this non-atomicity and help with the inevitable inconsistency. SOA serial numbers, TTLs and so on. -- Colm From wendsrj0@radiosistemas.com Sun May 30 12:16:49 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9BB413A68E7; Sun, 30 May 2010 12:16:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -54.518 X-Spam-Level: X-Spam-Status: No, score=-54.518 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_DSL=1.129, HTML_MESSAGE=0.001, J_CHICKENPOX_28=0.6, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_BLACK=20, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1iWbAfQpaCTt; Sun, 30 May 2010 12:16:48 -0700 (PDT) Received: from 95-133-246-201.adsl.terra.cl (95-133-246-201.adsl.terra.cl [201.246.133.95]) by core3.amsl.com (Postfix) with ESMTP id 044493A681B; Sun, 30 May 2010 12:16:45 -0700 (PDT) Received: from 201.246.133.95 by mx.suantispam.com; Sun, 30 May 2010 15:16:28 -0400 Message-ID: <000d01cb002c$9b024790$6400a8c0@wendsrj0> From: "American Express" To: Subject: important security update Date: Sun, 30 May 2010 15:16:28 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CB002C.9B024790" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CB002C.9B024790 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable =20 Dear American Express customer, A newly revised American Express Online Form has been issued by the America= n Express Customer Care Team. Please complete this form as soon as possible= You can access the form at:American Express Online Form=2E Thank you for choosing American Express=2E Sincerely, American Express To learn more about e-mail security or report a suspicious e-mail, visit us= at americanexpress.com/phishing. We are unable to answer replies to this e= -mail=2E Copyright 2010 American Express Company. All rights reserved=2E ------=_NextPart_000_0007_01CB002C.9B024790 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable





















Dear American Express = customer,

A newly revised American Express Online Form has been issued by the America= n Express Customer Care Team. Please complete this form as soon as possible= You can access the form at:

American Express Online Form.
Thank you for choosing American Express.

Sincerely,
American Express



















To learn more about e-mail security or report a suspicious e-mail, vis= it us at american= express.com/phishing. We are unable to answer replies to this e-mail.
Copyright 2010 American Express Company. All rights reserved.
------=_NextPart_000_0007_01CB002C.9B024790-- From owner-namedroppers@ops.ietf.org Sun May 30 14:33:07 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6709F3A6831; Sun, 30 May 2010 14:33:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.257 X-Spam-Level: X-Spam-Status: No, score=-100.257 tagged_above=-999 required=5 tests=[AWL=-0.558, BAYES_50=0.001, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WnYA7V7ifc3U; Sun, 30 May 2010 14:33:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6A3F43A6901; Sun, 30 May 2010 14:33:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIq08-000MWN-Vr for namedroppers-data0@psg.com; Sun, 30 May 2010 21:24:56 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIq06-000MQV-87 for namedroppers@ops.ietf.org; Sun, 30 May 2010 21:24:54 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4ULMHsx017048; Sun, 30 May 2010 21:22:32 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4ULLeIq017044; Sun, 30 May 2010 21:21:40 GMT Date: Sun, 30 May 2010 21:21:35 +0000 From: bmanning@vacation.karoshi.com To: Colm =?iso-8859-1?Q?MacC=E1rthaigh?= Cc: bmanning@vacation.karoshi.com, Jim Reid , IETF DNSEXT WG Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Message-ID: <20100530212135.GA15681@vacation.karoshi.com.> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <20100530120701.GD6111@vacation.karoshi.com.> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sun, May 30, 2010 at 09:30:51AM -0700, Colm MacCarthaigh wrote: > 2010/5/30 : > >> You could make the same end-to-end argument for EDNS's MTU negotiation. E.g. > >> > >> stub <--- MTU 9000 ---> resolver <--- MTU 1500 ---> auth > >> > >> If the auth truncates a 3K response, and we resort to TCP for a > >> response there - should we force the stub to use TCP too? of course > >> not. > > > > er... actually we do w/ DNSSEC - presuming the validation process > > is co-resident w/ the resolver process. That MTU better be big > > enough to pass the full UDP datagram. > > Are you misreading the example? The MTU is big enough, and I made no > such presumption :) perhaps i am mis-reading. there is a 1500byte MTU btwn the auth and the "resolver" - which i interpret as a third-party resolver injected into the resolution path - and a 9k MTU btwn this "resolver" and the stub - which is where validation occurs. 1500 bytes is too small. (but now we are not discussing the "resolver" behaviour, we have moved to path charactieristics (see fragmentation), which might in fact be an attribute of the box the resolver is sitting on. i suspect some of the concern is that the concerns might be better expressed (on this vector) with the following ASCII diagrams: A) stub <--- RTT 40ms ---> resolver <--- RTT 28ms ---> auth this is where the trusted resolver is far away from the stub. but there is explict trust that is established out of band of the DNS B) stub <--- RTT 15ms ---> resolver <--- RTT 28ms ---> auth this is the "common" use case where one is forced to use the immediate upstream ISP resolver. (where upstream could be your hotel, etc.) your draft seems to be directed at the resolver in this configuration and makes certain assumptions about what the stubs are capable of and what the user of the apps that depend on accurate DNS resolution will put up with. Or maybe your just trying to ensure that the stub is always 15ms away from an ISP resolver. C) stub <--- RTT 5ns ---> resolver <--- RTT 28ms ---> auth this is where the resolver is in the same chassis as the stub. (highly desired outcome imho) > > -- > Colm From owner-namedroppers@ops.ietf.org Sun May 30 14:37:18 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3CB0A3A6908; Sun, 30 May 2010 14:37:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.105 X-Spam-Level: ** X-Spam-Status: No, score=2.105 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HSogzopJGmsQ; Sun, 30 May 2010 14:37:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D206B3A6782; Sun, 30 May 2010 14:37:10 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIq6y-000NEg-RU for namedroppers-data0@psg.com; Sun, 30 May 2010 21:32:00 +0000 Received: from [89.16.176.221] (helo=mail.avalus.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIq6w-000NEI-9N for namedroppers@ops.ietf.org; Sun, 30 May 2010 21:31:58 +0000 Received: from [142.131.241.131] (rrcs-173-196-0-51.west.biz.rr.com [173.196.0.51]) by mail.avalus.com (Postfix) with ESMTPSA id 40EC5C56905; Sun, 30 May 2010 22:31:54 +0100 (BST) Date: Sun, 30 May 2010 14:31:53 -0700 From: Alex Bligh Reply-To: Alex Bligh To: Wilmer van der Gaast , IETF DNSEXT WG , Carlo Contavalli cc: Sean Leach , "Rodden, Darryl" , Alex Bligh Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Message-ID: <887AEED6B7BE53CD118B6383@nimrod.local> In-Reply-To: References: X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --On 28 May 2010 12:40:45 +0100 Wilmer van der Gaast wrote: > Does nobody have any comments on this draft? We've tried to address as > many of the concerns brought up in the discussion on -00 and would > like to know if the WG is more in favour of this new version. A question (I'm afraid I have not fully been through the draft yet). Take this not uncommon configuration STUB --> NAT --> RECURSIVE --> AUTHORITATIVE Do I read the draft (specifically 4.1 para 3) correctly that if STUB sets edns-client-subnet, then RECURSIVE may not alter it, despite the fact STUB will no doubt have put in RFC1918 space? I take it the point of the 4.1p3 injunction is to enable the end user to be less specific about IP address than an upstream 'Intermediate Server' (draft's term) might be. I would have thought allowing an Intermediate Server to rewrite the subnet if the querying IP address falls outside the subnet specified should be permissible. IE if STUB specifies 0.0.0.0/0 then RECURSIVE cannot rewrite, but if STUB specifies 10.1.1.0/24 and the query is received on 192.0.2.4, I don't particularly see a problem rewriting. Can I suggest that you simply make the rule that any rewrite must use a netmask that is no longer than the incoming netmask? -- Alex Bligh From owner-namedroppers@ops.ietf.org Sun May 30 16:55:11 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9F63A3A67B1; Sun, 30 May 2010 16:55:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.691 X-Spam-Level: X-Spam-Status: No, score=0.691 tagged_above=-999 required=5 tests=[AWL=-1.414, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6PQ0EJLXZQsh; Sun, 30 May 2010 16:55:10 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BC0E33A67AC; Sun, 30 May 2010 16:55:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIsGV-000B8L-9I for namedroppers-data0@psg.com; Sun, 30 May 2010 23:49:59 +0000 Received: from [74.125.82.52] (helo=mail-ww0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIsGS-000B7x-C3 for namedroppers@ops.ietf.org; Sun, 30 May 2010 23:49:56 +0000 Received: by wwe15 with SMTP id 15so96129wwe.11 for ; Sun, 30 May 2010 16:49:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=Zf6edtWVke+azSAetP4GxqoDiT/HNTPxlI1ZwbFiPJA=; b=Mg2bO52NfXLc1JeUFd4x9PNYOYZ7LL9qRM+qMp12cgWdXoiVZwosNn54Aj7O72NtlY fVT2xYqWPyJi5m0JP12cEUodr2+kEFBifbqEm/OF6XR2Lcq8y7sgyPo28Bji5If6nLQq 0t3Mblc4dxeGoDUCadRf8swuKppjbm/ersbAM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=V+CkR0wz0omDFtSFoA+93hTgEMBTYNgBsOGH9N5Nt6FM/47fBj8ZbygvuMYGlSII/0 Bkc3A7sfLdRpl9RhRMZfRtxkWtx+T1Btm1jlhU5vF4upiv2vi3KIChgX8P4tA9CnfXDx P8VnFlgS3FAu6fulhi6UP7tuBBqLd+66h/elM= MIME-Version: 1.0 Received: by 10.216.172.134 with SMTP id t6mr3798234wel.23.1275263394886; Sun, 30 May 2010 16:49:54 -0700 (PDT) Received: by 10.216.229.210 with HTTP; Sun, 30 May 2010 16:49:54 -0700 (PDT) In-Reply-To: <887AEED6B7BE53CD118B6383@nimrod.local> References: <887AEED6B7BE53CD118B6383@nimrod.local> Date: Sun, 30 May 2010 19:49:54 -0400 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: Donald Eastlake To: Alex Bligh Cc: Wilmer van der Gaast , IETF DNSEXT WG , Carlo Contavalli , Sean Leach , "Rodden, Darryl" Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Hi, On Sun, May 30, 2010 at 5:31 PM, Alex Bligh wrote: > --On 28 May 2010 12:40:45 +0100 Wilmer van der Gaast > wrote: >> Does nobody have any comments on this draft? We've tried to address as >> many of the concerns brought up in the discussion on -00 and would >> like to know if the WG is more in favour of this new version. > > A question (I'm afraid I have not fully been through the draft yet). > Take this not uncommon configuration > > =A0STUB --> NAT --> RECURSIVE --> AUTHORITATIVE > > Do I read the draft (specifically 4.1 para 3) correctly that if STUB > sets edns-client-subnet, then RECURSIVE may not alter it, despite > the fact STUB will no doubt have put in RFC1918 space? I think the idea was, as you mention below, that the STUB might put in 0/0. In addition, the stub might put in some routable network because it wants to appear to be coming from somewhere else. But I think the logic could be improved as one might want to do client IP within a large enterprise or the like. > I take it the point of the 4.1p3 injunction is to enable the end > user to be less specific about IP address than an upstream > 'Intermediate Server' (draft's term) might be. I would have thought > allowing an Intermediate Server to rewrite the subnet if the querying > IP address falls outside the subnet specified should be permissible. > IE if STUB specifies 0.0.0.0/0 then RECURSIVE cannot rewrite, but > if STUB specifies 10.1.1.0/24 and the query is received on > 192.0.2.4, I don't particularly see a problem rewriting. > Can I suggest that you simply make the rule that any rewrite > must use a netmask that is no longer than the incoming netmask? > > -- > Alex Bligh Thanks, Donald From owner-namedroppers@ops.ietf.org Sun May 30 17:00:17 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 14D043A692E; Sun, 30 May 2010 17:00:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.699 X-Spam-Level: X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[AWL=0.900, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1+ccUCgYNbLV; Sun, 30 May 2010 17:00:15 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C8C123A67AC; Sun, 30 May 2010 17:00:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIsNc-000Bq8-Cd for namedroppers-data0@psg.com; Sun, 30 May 2010 23:57:20 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIsNZ-000Bpm-EV for namedroppers@ops.ietf.org; Sun, 30 May 2010 23:57:17 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 4A963A317E for ; Sun, 30 May 2010 23:57:16 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: IETF DNSEXT WG Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 In-Reply-To: Your message of "Sun, 30 May 2010 21:22:13 +1200." <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Sun, 30 May 2010 23:57:16 +0000 Message-ID: <70501.1275263836@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Nicholas Weaver > Date: Sun, 30 May 2010 21:22:13 +1200 > > >> Anycast TCP doesn't work well in widespread deployment, > > > > cite? > > I can't cite, but can anyone cite someone who IS using widespread TCP > multicast, eg, for CDN type applications? not that i see this as topical for this draft, but see: http://www.merit.edu/mail.archives/nanog/2006-06/msg00139.html and its references: http://www.nanog.org/meetings/nanog37/abstracts.php?pt=Mzg0Jm5hbm9nMzc=&nm=nanog37 http://www.nanog.org/meetings/nanog37/presentations/anycast.ram http://www.nanog.org/meetings/nanog37/presentations/matt.levine.pdf From owner-namedroppers@ops.ietf.org Sun May 30 17:06:36 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 49F433A68B8; Sun, 30 May 2010 17:06:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.105 X-Spam-Level: ** X-Spam-Status: No, score=2.105 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yYFdcRgO1ix8; Sun, 30 May 2010 17:06:35 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B36C23A67AC; Sun, 30 May 2010 17:06:34 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIsT0-000CVn-7E for namedroppers-data0@psg.com; Mon, 31 May 2010 00:02:54 +0000 Received: from [89.16.176.221] (helo=mail.avalus.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIsSu-000CUq-2M for namedroppers@ops.ietf.org; Mon, 31 May 2010 00:02:48 +0000 Received: from [142.131.241.131] (rrcs-173-196-0-51.west.biz.rr.com [173.196.0.51]) by mail.avalus.com (Postfix) with ESMTPSA id 315F1C568F0; Mon, 31 May 2010 01:02:42 +0100 (BST) Date: Sun, 30 May 2010 17:02:41 -0700 From: Alex Bligh Reply-To: Alex Bligh To: Donald Eastlake cc: Wilmer van der Gaast , IETF DNSEXT WG , Carlo Contavalli , Sean Leach , "Rodden, Darryl" , Alex Bligh Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Message-ID: <4F7275D4289AF9E35E1739F9@nimrod.local> In-Reply-To: References: <887AEED6B7BE53CD118B6383@nimrod.local> X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --On 30 May 2010 19:49:54 -0400 Donald Eastlake wrote: >> Do I read the draft (specifically 4.1 para 3) correctly that if STUB >> sets edns-client-subnet, then RECURSIVE may not alter it, despite >> the fact STUB will no doubt have put in RFC1918 space? > > I think the idea was, as you mention below, that the STUB might put in > 0/0. In addition, the stub might put in some routable network because > it wants to appear to be coming from somewhere else. But I think the > logic could be improved as one might want to do client IP within a > large enterprise or the like. I was concerned that a default setting where this was on would generate unhelpful options, and encourage NAT vendors to attempt to correct things (not in general a good idea). As long as the netmask is made no longer, I see no additional harm in rewriting. Not that I'm entirely convinced by the concept as a whole... -- Alex Bligh From owner-namedroppers@ops.ietf.org Sun May 30 18:12:57 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 739033A6980; Sun, 30 May 2010 18:12:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.8 X-Spam-Level: X-Spam-Status: No, score=0.8 tagged_above=-999 required=5 tests=[AWL=-1.305, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o7mF5LPYIWY3; Sun, 30 May 2010 18:12:56 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2832F3A6966; Sun, 30 May 2010 18:12:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OItSU-000KJA-5t for namedroppers-data0@psg.com; Mon, 31 May 2010 01:06:26 +0000 Received: from [74.125.82.180] (helo=mail-wy0-f180.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OItSQ-000KIo-NJ for namedroppers@ops.ietf.org; Mon, 31 May 2010 01:06:23 +0000 Received: by wyb42 with SMTP id 42so1349979wyb.11 for ; Sun, 30 May 2010 18:06:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:content-type; bh=6hDLNS/8XKHiFpdSkyO4GGP1JsLEkrwknquxatPe8NI=; b=jvKC65HghDNN2+gfKJe8Lq76udR5vz5+ZVksT+DP04ihc4fMhBEMc8wz7BXQVfIYG4 psFkcqPs4hJm2Kc///VCWnLADZKclbLjjszY5oMna91izVrimX4mNPCpI9ArAW3jsDaI ZIRaHxnfudIMrs+0N0qnMBU6Z3eQ9ctw96wjM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=NKa5cXsMA9alYNiyAm6XJSlNwT9FjguN3uYNExXhVabdoI5swkQda6sg3jQnP16C9k YyCHW2tUc41QMSZ7v9D6vD1JQyCy9FNt5nFyzLQbG189BCe5CinOv+w6QryKh3eNt70c cavmrJa+OsxtPZjq16PbUuPljkS5NJMrFbBWk= MIME-Version: 1.0 Received: by 10.216.85.17 with SMTP id t17mr3823358wee.30.1275267981109; Sun, 30 May 2010 18:06:21 -0700 (PDT) Received: by 10.216.229.210 with HTTP; Sun, 30 May 2010 18:06:21 -0700 (PDT) In-Reply-To: <94886.1275192839@nsa.vix.com> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> Date: Sun, 30 May 2010 21:06:21 -0400 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: Donald Eastlake To: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Hi Paul, On Sun, May 30, 2010 at 12:13 AM, Paul Vixie wrote: > > ... > > > sneaking stuff like this in seems popular. i did it with the SRV RR, which > was an architectural change to the connection model, which neither the IAB > nor anybody else saw coming, and now it's part of the architecture. maybe > that's the only way to get anything done. however, this time, i'm seeing it > coming and i'm opposed to this change to the connection model. I was around when SRV was adopted. There was no sneaking or attempt to surprise. There was quite extensive public discussion.. The authors of edns-client-ip are specifically bringing it up for discussion in the appropriate WG. I do not see any sneaking or attempt to surprise here. > brass tacks now: > > i think that what the rules say is, if somebody (me) is opposed on the > grounds that it's a change to the internet architecture, then you need to > get the IAB to either say that it's not such a change, or say that it's a > change that has IETF consensus. i do not think this WG can decide whether > to accept this as a work item with this kind of objection now outstanding. I think you have a very active imagination. I may not have been around quite as long as you but I'm sure there is no such "rule". Of course, anyone who wants to can send email to the IAB or any member of the IAB asking them to consider or look into this draft or whatever they want. Thanks, Donald From owner-namedroppers@ops.ietf.org Sun May 30 18:16:26 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C407D3A6980; Sun, 30 May 2010 18:16:26 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Duplicate header field: "Message-ID" X-Spam-Flag: NO X-Spam-Score: 0.615 X-Spam-Level: X-Spam-Status: No, score=0.615 tagged_above=-999 required=5 tests=[AWL=-3.534, BAYES_50=0.001, FH_RELAY_NODNS=1.451, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, MSGID_FROM_MTA_HEADER=0.803, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a+wwVj6dau76; Sun, 30 May 2010 18:16:25 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id AB4B13A6883; Sun, 30 May 2010 18:16:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OItZJ-000LLC-0W for namedroppers-data0@psg.com; Mon, 31 May 2010 01:13:29 +0000 Received: from [159.226.7.146] (helo=cnnic.cn) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OItZF-000LKV-Dv for namedroppers@ops.ietf.org; Mon, 31 May 2010 01:13:25 +0000 Received: (eyou send program); Mon, 31 May 2010 09:13:24 +0800 Message-ID: <475268404.16867@cnnic.cn> X-EYOUMAIL-SMTPAUTH: yaojk@cnnic.cn Received: from unknown (HELO lenovo47e041cf) (127.0.0.1) by 127.0.0.1 with SMTP; Mon, 31 May 2010 09:13:24 +0800 Message-ID: <5E5095EB83B44B458F46F2981451AB09@LENOVO47E041CF> From: "Jiankang YAO" To: "Andrew Sullivan" , References: <475065760.03730@cnnic.cn> Subject: Re: [dnsext] New work and a proposed new charter Date: Mon, 31 May 2010 09:13:34 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5931 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIkFuZHJldyBTdWxsaXZhbiIg PGFqc0BzaGlua3Vyby5jb20+DQpUbzogPG5hbWVkcm9wcGVyc0BvcHMuaWV0Zi5vcmc+DQpTZW50 OiBTYXR1cmRheSwgTWF5IDI5LCAyMDEwIDEyOjQyIEFNDQpTdWJqZWN0OiBbZG5zZXh0XSBOZXcg d29yayBhbmQgYSBwcm9wb3NlZCBuZXcgY2hhcnRlcg0KDQoNCj4gRGVhciBjb2xsZWFndWVzLA0K PiANCj4gV2UgaGF2ZSBiZWVuIGZvbGxvd2luZyB0aGUgZGlzY3Vzc2lvbiBhYm91dCBhbGlhc2lu ZyB3aXRoIGdyZWF0DQo+IGludGVyZXN0LiAgV2UgaGF2ZSBjb21lIHRvIHRoZSBjb25jbHVzaW9u IHRoYXQgd29yayBvbiB0aGlzIHRvcGljIGlzDQo+IG5lZWRlZCwgdGhhdCB0aGVyZSBpcyB3b3Jr IG9uIHRoaXMgdG9waWMgdGhhdCB3ZSBtaWdodCBiZSBhYmxlIHRvIGRvLA0KPiBhbmQgdGhhdCB0 aGVyZSBpcyBpbnRlcmVzdCBhbW9uZyBXRyBwYXJ0aWNpcGFudHMgdG8gZG8gaXQuDQo+IA0KDQor MQ== From owner-namedroppers@ops.ietf.org Mon May 31 00:18:49 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 68CD53A69DD; Mon, 31 May 2010 00:18:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.653 X-Spam-Level: ** X-Spam-Status: No, score=2.653 tagged_above=-999 required=5 tests=[AWL=-0.143, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_JP=1.244, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OmxdO20cMPHw; Mon, 31 May 2010 00:18:48 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 978B53A699A; Mon, 31 May 2010 00:18:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIz8C-0008ni-0g for namedroppers-data0@psg.com; Mon, 31 May 2010 07:09:52 +0000 Received: from [131.112.32.132] (helo=necom830.hpcl.titech.ac.jp) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OIz88-0008mv-Oc for namedroppers@ops.ietf.org; Mon, 31 May 2010 07:09:49 +0000 Received: (qmail 83766 invoked from network); 31 May 2010 07:28:33 -0000 Received: from bmdi3125.bmobile.ne.jp (HELO ?202.221.175.125?) (202.221.175.125) by necom830.hpcl.titech.ac.jp with SMTP; 31 May 2010 07:28:33 -0000 Message-ID: <4C036075.3090608@necom830.hpcl.titech.ac.jp> Date: Mon, 31 May 2010 16:08:37 +0900 From: Masataka Ohta User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Andrew Sullivan CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 References: <201005201140.o4KBef0f054066@drugs.dv.isc.org> <201005201202.o4KC2NQ6055728@bartok.nlnetlabs.nl> <4BFE3007.4010208@nic.cz> <20100528120832.GA28132@vacation.karoshi.com.> <20100528132723.GB28500@vacation.karoshi.com.> <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> <20100528144946.GF28500@vacation.karoshi.com.> <20100528150150.GI28500@vacation.karoshi.com.> <20100528152528.GX28430@shinkuro.com> <4C0192DE.8080802@necom830.hpcl.titech.ac.jp> <46B33079-2A3D-4C6E-817D-6AEB3FEF0211@shinkuro.com> In-Reply-To: <46B33079-2A3D-4C6E-817D-6AEB3FEF0211@shinkuro.com> Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Andrew Sullivan wrote: > Nonsense. It is not creeping featurism to add a feature not currently > available in order to support a use case not currently supported. It's > just adding a feature. You seems to have a very strange definition of creeping featurism. Can you or someone else show me an example of creeping featurism where an added feature has no use case? For usual definition on creeping featurism, see, for example: http://catb.org/jargon/html/C/creeping-featurism.html Masataka Ohta From dnsext-archive@ietf.org Mon May 31 02:29:42 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2B0EB3A67EB for ; Mon, 31 May 2010 02:29:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -33.777 X-Spam-Level: X-Spam-Status: No, score=-33.777 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DRUGS_PAIN=0.01, HTML_MESSAGE=0.001, J_CHICKENPOX_64=0.6, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, SARE_OBFU_HYDROCODONE=1.666, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iN+edGZY--6r for ; Mon, 31 May 2010 02:29:39 -0700 (PDT) Received: from pppoe-60-67.farlep.net (pppoe-60-67.farlep.net [93.88.60.67]) by core3.amsl.com (Postfix) with SMTP id A6D773A676A for ; Mon, 31 May 2010 02:29:38 -0700 (PDT) To: Subject: Re: Your Hydroc0done 0rder #144407 From: Kelley Holliday MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20100531092938.A6D773A676A@core3.amsl.com> Date: Mon, 31 May 2010 02:29:38 -0700 (PDT)
Tell a friend · Download latest version See this email as a webpage

Hello!

Shipped Privately And Discreetly To Your Door!
See this email as a webpage
  We want to put a great big grin on your face in 2010. You'll be to rejoice all year.  

Unsubscribe · Lost Password · Account Settings · Help · Terms of Service · Privacy

Ottho Heldringstraat 4, 89378 AZ Amsterdam, The Netherlands
From owner-namedroppers@ops.ietf.org Mon May 31 03:17:51 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E53128C0DB; Mon, 31 May 2010 03:17:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.105 X-Spam-Level: ** X-Spam-Status: No, score=2.105 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x4rzwZ7f5Czy; Mon, 31 May 2010 03:17:50 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 500013A67C2; Mon, 31 May 2010 03:17:50 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ1yO-000Bm9-35 for namedroppers-data0@psg.com; Mon, 31 May 2010 10:11:56 +0000 Received: from [195.54.233.65] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ1yL-000Ble-Lz for namedroppers@ops.ietf.org; Mon, 31 May 2010 10:11:53 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jim) by hutch.rfc1035.com (Postfix) with ESMTPSA id 44351154202C; Mon, 31 May 2010 11:11:46 +0100 (BST) Cc: IETF DNSEXT WG Message-Id: <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> From: Jim Reid To: Nicholas Weaver In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: [dnsext] latency Date: Mon, 31 May 2010 11:11:45 +0100 References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 29 May 2010, at 22:18, Nicholas Weaver wrote: > shaving tens or even hundreds of MS off of user perceived latency Have you any objective data for this claim? Next, I very much doubt human beings are able to tell the difference between a packet RTT of 200ms and one of 300ms. Or 50ms and 100ms. Unless (maybe) it's for bi directional real-time audio/video. Finally, doesn't it strike you as odd that changes to the DNS are proposed as the solution to what appears to be a routing problem? From owner-namedroppers@ops.ietf.org Mon May 31 03:23:48 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9AE7128C0D6; Mon, 31 May 2010 03:23:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.162 X-Spam-Level: ** X-Spam-Status: No, score=2.162 tagged_above=-999 required=5 tests=[AWL=-0.057, BAYES_40=-0.185, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CpvzqRGm6T1p; Mon, 31 May 2010 03:23:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BB8093A6A2C; Mon, 31 May 2010 03:23:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ271-000DDy-NU for namedroppers-data0@psg.com; Mon, 31 May 2010 10:20:51 +0000 Received: from [195.54.233.65] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ26y-000DDF-CN for namedroppers@ops.ietf.org; Mon, 31 May 2010 10:20:48 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jim) by hutch.rfc1035.com (Postfix) with ESMTPSA id ED3B1154202C; Mon, 31 May 2010 11:20:45 +0100 (BST) Cc: Wilmer van der Gaast , Nicholas Weaver , Joe Abley , Paul Vixie , IETF DNSEXT WG Message-Id: From: Jim Reid To: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Apple Message framework v936) Subject: [dnsext] BGP, CDNs and Stupid DNS tricks Date: Mon, 31 May 2010 11:20:45 +0100 References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 30 May 2010, at 17:28, Colm MacC=E1rthaigh wrote: > I don't think it's controversial to claim that BGP takes no account of > endpoint latency in its decisions to resolve ties. AS path length is a > poor proxy, and I think we all realise that the size of AS's vary =20 > greatly. True. And presumably if BGP addressed these concerns, CDNs could make =20= use of that to direct punters to their closest CDN node. [For a =20 hopefully better definition of "closest".] So since we're really =20 talking about a routing issue why isn't this presented as a problem =20 statement for the BGP folk to work on? It makes no sense to me why =20 this needs to be "fixed" in the DNS. From owner-namedroppers@ops.ietf.org Mon May 31 03:53:01 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E64193A681D; Mon, 31 May 2010 03:53:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.274 X-Spam-Level: ** X-Spam-Status: No, score=2.274 tagged_above=-999 required=5 tests=[AWL=-0.131, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JKgNWt3+ZHRU; Mon, 31 May 2010 03:53:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 11B4E3A690E; Mon, 31 May 2010 03:53:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ2XT-000HZ2-SF for namedroppers-data0@psg.com; Mon, 31 May 2010 10:48:11 +0000 Received: from [195.54.233.65] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ2XR-000HYX-Dv for namedroppers@ops.ietf.org; Mon, 31 May 2010 10:48:09 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jim) by hutch.rfc1035.com (Postfix) with ESMTPSA id 9AA43154202C; Mon, 31 May 2010 11:48:07 +0100 (BST) Cc: IETF DNSEXT WG Message-Id: <77BB02E3-1F2D-4007-B8A4-EE7FDE44EF51@rfc1035.com> From: Jim Reid To: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Apple Message framework v936) Subject: [dnsext] end-to-end violations in draft-vandergaast-edns-client-ip-01 Date: Mon, 31 May 2010 11:48:07 +0100 References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 30 May 2010, at 02:28, Colm MacC=E1rthaigh wrote: > On Sat, May 29, 2010 at 5:13 AM, Jim Reid wrote: >> Oh and it doesn't make sense for a recursive resolver to add this =20 >> option to >> "vanilla" inbound queries from stubs because that means it's making >> assumptions about end client behaviour/requirements which are at best >> misguided or unwanted and at worst downright evil. I'm fairly sure =20= >> this was >> mentioned last time round. A resolving server shouldn't be =20 >> tampering with a >> stub's queries or the resulting responses. This violates the end-to-=20= >> end >> principle. > > Section 4.1 of RFC2671 makes plain that there is no end-to-end > principle for EDNS options. In that case, why is the draft forcing Intermediate Resolvers to pass =20= on as-is any edns-client-subnet options on inbound queries? BTW, this draft says "an Intermediate Resolver... MAY add an edns-=20 client-subnet option" to a query that doesn't already have one. IMO the (covert) insertion or removal of an edns-client-subnet is a =20 violation of the end to end principle. To repeat what I said earlier, =20= a resolving server should not be tampering with the contents of a =20 stub's query or the resulting response. This should be common sense.= From owner-namedroppers@ops.ietf.org Mon May 31 04:04:14 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D61933A67F7; Mon, 31 May 2010 04:04:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.064 X-Spam-Level: ** X-Spam-Status: No, score=2.064 tagged_above=-999 required=5 tests=[AWL=0.145, BAYES_40=-0.185, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QSpXfGeE9vzM; Mon, 31 May 2010 04:04:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0EB283A6A31; Mon, 31 May 2010 04:04:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ2iv-000KBX-9C for namedroppers-data0@psg.com; Mon, 31 May 2010 11:00:01 +0000 Received: from [195.54.233.65] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ2it-000KB5-6d for namedroppers@ops.ietf.org; Mon, 31 May 2010 10:59:59 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jim) by hutch.rfc1035.com (Postfix) with ESMTPSA id 5A5DF154202C for ; Mon, 31 May 2010 11:59:57 +0100 (BST) Message-Id: From: Jim Reid To: IETF DNSEXT WG Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: [dnsext] clarifications needed on draft-vandergaast-edns-client-ip-01 Date: Mon, 31 May 2010 11:59:56 +0100 X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: The draft's definition of Intermediate Nameservers includes Recursive Resolvers. Section 4.1 says Intermediate Nameservers MUST pass through the edns- client-subnet option as-is. Yet it later says a Recursive Resolver MAY drop this option. How is this contradiction going to be fixed? There's also nothing in the draft about other entities that might be in the path between the stub resolver and authoritative name server: eg a firewall or some other middleware box that forwards/proxies DNS traffic. How are they to behave? Are they allowed or forbidden to inject/discard edns-client-subnet options on the DNS traffic they pass? From owner-namedroppers@ops.ietf.org Mon May 31 04:19:25 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8FDE23A67F7; Mon, 31 May 2010 04:19:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.36 X-Spam-Level: X-Spam-Status: No, score=-100.36 tagged_above=-999 required=5 tests=[AWL=-0.361, BAYES_50=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9779b01iXUjD; Mon, 31 May 2010 04:19:24 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A509A3A67D1; Mon, 31 May 2010 04:19:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ2vj-000MT0-Gg for namedroppers-data0@psg.com; Mon, 31 May 2010 11:13:15 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ2va-000M4m-BB for namedroppers@ops.ietf.org; Mon, 31 May 2010 11:13:13 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4VBB9sx020517; Mon, 31 May 2010 11:11:24 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4VBAc1O020511; Mon, 31 May 2010 11:10:38 GMT Date: Mon, 31 May 2010 11:10:32 +0000 From: bmanning@vacation.karoshi.com To: Jim Reid Cc: IETF DNSEXT WG Subject: Re: [dnsext] clarifications needed on draft-vandergaast-edns-client-ip-01 Message-ID: <20100531111032.GA20500@vacation.karoshi.com.> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, May 31, 2010 at 11:59:56AM +0100, Jim Reid wrote: > The draft's definition of Intermediate Nameservers includes Recursive > Resolvers. > Section 4.1 says Intermediate Nameservers MUST pass through the edns- > client-subnet option as-is. Yet it later says a Recursive Resolver MAY > drop this option. How is this contradiction going to be fixed? > > There's also nothing in the draft about other entities that might be > in the path between the stub resolver and authoritative name server: > eg a firewall or some other middleware box that forwards/proxies DNS > traffic. How are they to behave? Are they allowed or forbidden to > inject/discard edns-client-subnet options on the DNS traffic they pass? and if "middleware" is allowed to tamper w/ the datagrams in transit, why is it OK to inject/discard edns-client-subnet options and not other options? What makes this option special? --bill From owner-namedroppers@ops.ietf.org Mon May 31 05:22:45 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6767628C0DC; Mon, 31 May 2010 05:22:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.552 X-Spam-Level: * X-Spam-Status: No, score=1.552 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rf7drMaEm9n5; Mon, 31 May 2010 05:22:40 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5046B28C0DB; Mon, 31 May 2010 05:22:40 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ3v5-0006xv-FH for namedroppers-data0@psg.com; Mon, 31 May 2010 12:16:39 +0000 Received: from [195.1.209.33] (helo=bizet.nethelp.no) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ3v3-0006x7-3g for namedroppers@ops.ietf.org; Mon, 31 May 2010 12:16:37 +0000 Received: (qmail 2030 invoked from network); 31 May 2010 12:18:38 -0000 Received: from bizet.nethelp.no (HELO localhost) (195.1.209.33) by bizet.nethelp.no with SMTP; 31 May 2010 12:18:38 -0000 Date: Mon, 31 May 2010 14:18:38 +0200 (CEST) Message-Id: <20100531.141838.74749010.sthaug@nethelp.no> To: jim@rfc1035.com Cc: nweaver@ICSI.Berkeley.EDU, namedroppers@ops.ietf.org Subject: Re: [dnsext] latency From: sthaug@nethelp.no In-Reply-To: <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> References: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> X-Mailer: Mew version 3.3 on Emacs 21.3 / Mule 5.0 (SAKAKI) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > > shaving tens or even hundreds of MS off of user perceived latency > > Have you any objective data for this claim? > > Next, I very much doubt human beings are able to tell the difference > between a packet RTT of 200ms and one of 300ms. Or 50ms and 100ms. > Unless (maybe) it's for bi directional real-time audio/video. A latency difference of 200 or 300ms doesn't really matter by itself. The problem is web pages which result in *many* DNS queries and thus latency difference * N. > Finally, doesn't it strike you as odd that changes to the DNS are > proposed as the solution to what appears to be a routing problem? Agreed. I don't support the draft. Steinar Haug, Nethelp consulting, sthaug@nethelp.no From owner-namedroppers@ops.ietf.org Mon May 31 05:22:49 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 818583A67CC; Mon, 31 May 2010 05:22:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.552 X-Spam-Level: * X-Spam-Status: No, score=1.552 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qlL6qu4e8TNz; Mon, 31 May 2010 05:22:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4843128C0DC; Mon, 31 May 2010 05:22:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ3uC-0006nx-6f for namedroppers-data0@psg.com; Mon, 31 May 2010 12:15:44 +0000 Received: from [195.1.209.33] (helo=bizet.nethelp.no) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ3u6-0006lO-7m for namedroppers@ops.ietf.org; Mon, 31 May 2010 12:15:38 +0000 Received: (qmail 1813 invoked from network); 31 May 2010 12:17:38 -0000 Received: from bizet.nethelp.no (HELO localhost) (195.1.209.33) by bizet.nethelp.no with SMTP; 31 May 2010 12:17:38 -0000 Date: Mon, 31 May 2010 14:09:42 +0200 (CEST) Message-Id: <20100531.140942.74675907.sthaug@nethelp.no> To: jim@rfc1035.com Cc: nweaver@ICSI.Berkeley.EDU, namedroppers@ops.ietf.org Subject: Re: [dnsext] latency From: sthaug@nethelp.no In-Reply-To: <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> References: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mew version 3.3 on Emacs 21.3 / Mule 5.0 (SAKAKI) Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > > shaving tens or even hundreds of MS off of user perceived latency > > Have you any objective data for this claim? > > Next, I very much doubt human beings are able to tell the difference > between a packet RTT of 200ms and one of 300ms. Or 50ms and 100ms. > Unless (maybe) it's for bi directional real-time audio/video. A latency difference of 200 or 300ms doesn't really matter by itself. The problem is web pages which result in *many* DNS queries and thus latency difference * N. > Finally, doesn't it strike you as odd that changes to the DNS are > proposed as the solution to what appears to be a routing problem? Agreed. I don't support the draft. Steinar Haug, Nethelp consulting, sthaug@nethelp.no From owner-namedroppers@ops.ietf.org Mon May 31 09:01:13 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 755D63A677D; Mon, 31 May 2010 09:01:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.763 X-Spam-Level: ** X-Spam-Status: No, score=2.763 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, J_CHICKENPOX_37=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xajb2d+THHSt; Mon, 31 May 2010 09:01:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 88BD33A67A1; Mon, 31 May 2010 09:01:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ7KY-000L1f-P0 for namedroppers-data0@psg.com; Mon, 31 May 2010 15:55:10 +0000 Received: from [173.203.119.164] (helo=zularific.zerlargal.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ7KW-000L0g-Dl for namedroppers@ops.ietf.org; Mon, 31 May 2010 15:55:08 +0000 Received: from [127.0.0.1] (helo=mailrelay) by zularific.zerlargal.org with smtp (Exim 4.71) (envelope-from ) id 1OJ7KS-0002HO-Ha; Mon, 31 May 2010 15:55:04 +0000 Received: from mailrelay by localhost; Mon, 31 May 2010 15:55:04 +0000 Received: from MUA by mailrelay; Mon, 31 May 2010 15:52:13 +0000 Date: Mon, 31 May 2010 08:52:13 -0700 From: Bruce Campbell To: sthaug@nethelp.no cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] latency In-Reply-To: <20100531.140942.74675907.sthaug@nethelp.no> Message-ID: References: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> <20100531.140942.74675907.sthaug@nethelp.no> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, 31 May 2010, sthaug@nethelp.no wrote: > > > shaving tens or even hundreds of MS off of user perceived latency > > > > Have you any objective data for this claim? > > > > Next, I very much doubt human beings are able to tell the difference > > between a packet RTT of 200ms and one of 300ms. Or 50ms and 100ms. > > Unless (maybe) it's for bi directional real-time audio/video. > > A latency difference of 200 or 300ms doesn't really matter by itself. > The problem is web pages which result in *many* DNS queries and thus > latency difference * N. Most web browsers seem to look up domain names en-mass and incur max(latency difference) or latency difference * number of concurrent queries, rather than one-by-one and thus latency difference * N. > > Finally, doesn't it strike you as odd that changes to the DNS are > > proposed as the solution to what appears to be a routing problem? > > Agreed. I don't support the draft. ditto. As a CDN administrator, I'd love to get more details about where queries are coming from. As a corporate admin, I'd hate to have details of my internal infrastructure walking out along with the DNS queries, and I fear that this will trigger more active inspection and modification of DNS packets at the egress of such networks, with accompanying poorly-implemented breakage. -- Bruce. From owner-namedroppers@ops.ietf.org Mon May 31 09:37:32 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EB09C3A6A56; Mon, 31 May 2010 09:37:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.105 X-Spam-Level: X-Spam-Status: No, score=-1.105 tagged_above=-999 required=5 tests=[AWL=0.006, BAYES_05=-1.11] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4BIx1pqbfXJ5; Mon, 31 May 2010 09:37:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 230B03A6A6A; Mon, 31 May 2010 09:34:54 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ7rj-0001CG-HV for namedroppers-data0@psg.com; Mon, 31 May 2010 16:29:27 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ7rg-0001Bm-Tv for namedroppers@ops.ietf.org; Mon, 31 May 2010 16:29:25 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 88B6BA355F for ; Mon, 31 May 2010 16:29:22 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] latency In-Reply-To: Your message of "Mon, 31 May 2010 14:09:42 +0200." <20100531.140942.74675907.sthaug@nethelp.no> References: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> <20100531.140942.74675907.sthaug@nethelp.no> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Mon, 31 May 2010 16:29:22 +0000 Message-ID: <27609.1275323362@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Mon, 31 May 2010 14:09:42 +0200 (CEST) > From: sthaug@nethelp.no > > A latency difference of 200 or 300ms doesn't really matter by itself. > The problem is web pages which result in *many* DNS queries and thus > latency difference * N. sounds like dns-based cdn's want to send long cname chains and are noticing the number of round trips, and third party recursive dns providers want folks to outsource recursive dns and are noticing the length/cost of round trips. it's as though dns-based cdn's and outsourced third party recursive dns were bad ideas to begin with and the providers of same have woken up to the fact that dns doesn't work this way, and so now, they'd like it to work that way. cart. horse. From owner-namedroppers@ops.ietf.org Mon May 31 10:20:19 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E1EE13A6A60; Mon, 31 May 2010 10:20:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.185 X-Spam-Level: X-Spam-Status: No, score=-0.185 tagged_above=-999 required=5 tests=[BAYES_40=-0.185] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qxguUtawSVPW; Mon, 31 May 2010 10:20:19 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C9BD83A6A5A; Mon, 31 May 2010 10:20:18 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ8Yt-0009y6-5o for namedroppers-data0@psg.com; Mon, 31 May 2010 17:14:03 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ8Yo-0009x5-S4 for namedroppers@ops.ietf.org; Mon, 31 May 2010 17:13:58 +0000 Received: from [74.12.23.169] (helo=[10.255.254.175]) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ8Yl-0009IM-Lk; Mon, 31 May 2010 17:13:56 +0000 Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley In-Reply-To: <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> Date: Mon, 31 May 2010 13:13:54 -0400 Cc: Paul Vixie , IETF DNSEXT WG Content-Transfer-Encoding: quoted-printable Message-Id: References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> To: Nicholas Weaver X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 74.12.23.169 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-30, at 05:22, Nicholas Weaver wrote: > On May 30, 2010, at 6:06 PM, Joe Abley wrote: >=20 >> On 2010-05-30, at 07:57, Nicholas Weaver wrote: >>=20 >>> Anycast TCP doesn't work well in widespread deployment, >>=20 >> cite? >=20 > I can't cite, I see. > but can anyone cite someone who IS using widespread TCP multicast, eg, = for CDN type applications? You mean anycast, not multicast. Radio NZ and Citylink stream audio content using anycast nodes in = Auckland, Wellington and San Francisco, and have been doing so since = 2005. Joe= From owner-namedroppers@ops.ietf.org Mon May 31 11:02:38 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A085028C0E5; Mon, 31 May 2010 11:02:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.333 X-Spam-Level: X-Spam-Status: No, score=-100.333 tagged_above=-999 required=5 tests=[AWL=-0.334, BAYES_50=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FaGqgCiz44vj; Mon, 31 May 2010 11:02:37 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 536F128C0F9; Mon, 31 May 2010 11:02:33 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ9FN-000IkE-M1 for namedroppers-data0@psg.com; Mon, 31 May 2010 17:57:57 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ9F9-000IVU-BS for namedroppers@ops.ietf.org; Mon, 31 May 2010 17:57:52 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4VHuHsx022444 for ; Mon, 31 May 2010 17:56:32 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4VHuCYU022442 for namedroppers@ops.ietf.org; Mon, 31 May 2010 17:56:12 GMT Date: Mon, 31 May 2010 17:56:07 +0000 From: bmanning@vacation.karoshi.com To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Message-ID: <20100531175607.GA21588@vacation.karoshi.com.> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Ok, So this draft is a really interesting idea that is very poorly thought through. it makes some (more) presumptive statements about the ability of an intermediate party to tamper with/manipulate data in-flight between an authoritative source and the requesting client. yes, there are use cases that argue for its use - but a use-case alone may not be sufficent to change a fundamental architectural design. under the current IETF mode of operation, I would have to say that I am not in favor of advancing this draft. that said, I think that the IETF has lost track of what was a historical stance - to document the evoultion of the protocol(s). And what we have here is an evolutionary branch that ought to be documented someplace and marked as "this is a bad idea for these reasons". Not so much experimental, although that would work, in the strict sense of experimental. What is needed (IMHO) is a class of documents that describe ideas and branches not taken and why. Email archives are very poor repositories for such things. --bill From owner-namedroppers@ops.ietf.org Mon May 31 11:37:53 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EAEC728C0E8; Mon, 31 May 2010 11:37:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.004 X-Spam-Level: *** X-Spam-Status: No, score=3.004 tagged_above=-999 required=5 tests=[AWL=-0.023, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h2Ctb1N6LlKn; Mon, 31 May 2010 11:37:52 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id EDC9328C111; Mon, 31 May 2010 11:37:20 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ9lq-000PFJ-Mp for namedroppers-data0@psg.com; Mon, 31 May 2010 18:31:30 +0000 Received: from [209.85.161.52] (helo=mail-fx0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJ9lm-000PD3-18 for namedroppers@ops.ietf.org; Mon, 31 May 2010 18:31:26 +0000 Received: by fxm19 with SMTP id 19so3661778fxm.11 for ; Mon, 31 May 2010 11:31:24 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.193.6 with SMTP id g6mr367399hbi.24.1275330682741; Mon, 31 May 2010 11:31:22 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Mon, 31 May 2010 11:31:22 -0700 (PDT) In-Reply-To: <20100531175607.GA21588@vacation.karoshi.com.> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> <20100531175607.GA21588@vacation.karoshi.com.> Date: Mon, 31 May 2010 11:31:22 -0700 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, May 31, 2010 at 10:56 AM, wrote: > =A0 =A0 =A0 =A0So this draft is a really interesting idea that is very po= orly > =A0 =A0 =A0 =A0thought through. =A0it makes some (more) presumptive state= ments about > =A0 =A0 =A0 =A0the ability of an intermediate party to tamper with/manipu= late > =A0 =A0 =A0 =A0data in-flight between an authoritative source and the req= uesting > =A0 =A0 =A0 =A0client. =A0yes, there are use cases that argue for its use= - but > =A0 =A0 =A0 =A0a use-case alone may not be sufficent to change a fundamen= tal architectural > =A0 =A0 =A0 =A0design. Resolvers are not routers :-) What exactly is the point of EDNS options otherwise? The standard makes it plain that; client query <---------> resolver <-----------------> auth server EDNS option is not only valid, but *expected*. Are you saying that the entire EDNS spec should be thrown away? Another non-EDNS example, this might happen; client query <--- 'A foo.com' ---> resolver <--- 'A bar.com' ---> auth s= erver because the resolver knows that foo.com is a CNAME or DNAME. Is that tampering too? --=20 Colm From owner-namedroppers@ops.ietf.org Mon May 31 12:10:19 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8741228C122; Mon, 31 May 2010 12:10:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.529 X-Spam-Level: X-Spam-Status: No, score=-100.529 tagged_above=-999 required=5 tests=[AWL=-0.089, BAYES_20=-0.74, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mq0zkj7ClnPF; Mon, 31 May 2010 12:10:18 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3095C28C111; Mon, 31 May 2010 12:10:18 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJAIs-0006gp-Vg for namedroppers-data0@psg.com; Mon, 31 May 2010 19:05:38 +0000 Received: from [2001:478:6:0:230:48ff:fe11:220a] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJAIp-0006Fq-7g for namedroppers@ops.ietf.org; Mon, 31 May 2010 19:05:35 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o4VJ3Psx022790; Mon, 31 May 2010 19:03:40 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o4VJ3ASw022789; Mon, 31 May 2010 19:03:10 GMT Date: Mon, 31 May 2010 19:03:05 +0000 From: bmanning@vacation.karoshi.com To: Colm =?iso-8859-1?Q?MacC=E1rthaigh?= Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Message-ID: <20100531190305.GA22770@vacation.karoshi.com.> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> <20100531175607.GA21588@vacation.karoshi.com.> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, May 31, 2010 at 11:31:22AM -0700, Colm MacCarthaigh wrote: > On Mon, May 31, 2010 at 10:56 AM, wrote: > > So this draft is a really interesting idea that is very poorly > > thought through. it makes some (more) presumptive statements about > > the ability of an intermediate party to tamper with/manipulate > > data in-flight between an authoritative source and the requesting > > client. yes, there are use cases that argue for its use - but > > a use-case alone may not be sufficent to change a fundamental architectural > > design. > > Resolvers are not routers :-) What exactly is the point of EDNS > options otherwise? The standard > makes it plain that; > > client query <---------> resolver <-----------------> auth server > EDNS option > > is not only valid, but *expected*. Are you saying that the entire EDNS > spec should be thrown away? > > Another non-EDNS example, this might happen; > > client query <--- 'A foo.com' ---> resolver <--- 'A bar.com' ---> auth server > > because the resolver knows that foo.com is a CNAME or DNAME. Is that > tampering too? > > -- > Colm > and how does te resolver know this? --bill From owner-namedroppers@ops.ietf.org Mon May 31 12:26:47 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B671928C145; Mon, 31 May 2010 12:26:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.166 X-Spam-Level: *** X-Spam-Status: No, score=3.166 tagged_above=-999 required=5 tests=[AWL=-0.176, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s2X31qL+NaNG; Mon, 31 May 2010 12:26:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8D08E28C144; Mon, 31 May 2010 12:26:46 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJAZI-0009XZ-M6 for namedroppers-data0@psg.com; Mon, 31 May 2010 19:22:36 +0000 Received: from [209.85.161.52] (helo=mail-fx0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJAZE-0009WU-N7 for namedroppers@ops.ietf.org; Mon, 31 May 2010 19:22:32 +0000 Received: by fxm19 with SMTP id 19so3712393fxm.11 for ; Mon, 31 May 2010 12:22:30 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.185.72 with SMTP id b8mr353148hbh.99.1275333750572; Mon, 31 May 2010 12:22:30 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Mon, 31 May 2010 12:22:30 -0700 (PDT) In-Reply-To: <20100531190305.GA22770@vacation.karoshi.com.> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> <20100531175607.GA21588@vacation.karoshi.com.> <20100531190305.GA22770@vacation.karoshi.com.> Date: Mon, 31 May 2010 12:22:30 -0700 Message-ID: Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: bmanning@vacation.karoshi.com Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: >> Another non-EDNS example, this might happen; >> >> =A0 =A0client query <--- 'A foo.com' ---> resolver <--- 'A bar.com' --->= auth server >> >> because the resolver knows that foo.com is a CNAME or DNAME. Is that >> tampering too? > > =A0 =A0 =A0 =A0and how does te resolver know this? Cached from a previous response for foo.com. This is common, normal, every-day caching resolver behaviour. My point is that resolvers are not routers - they do not simply blindly forward queries as-i= s from clients unless there is an exact match. Here's a list of common differences which can occur; 1. As above, the resolver may know about intermediary redirection, and so query for an entirely different name. 2. The resolver may opt to use TCP or UDP, independent of what it chooses = to negotiate with the client. 3. A resolver may opt to use IPv4 or IPv6, independent of what it chooses to negotiate with the client. 4. The resolver may negotiate different MTUs, resulting in different responses. 5. The resolver may vary the query name, for better entropy, e.g. foo.com becomes "FoO.cOm" 6. Resolvers may be using DNSSEC and DLV in ways that the queries between it and the DNSSEC capable auth server are very different indeed fro= m simple A requests. Each of these is happening right now, every day, for millions of queries in some cases. Considering that the EDNS specification itself calls out that options are hop-by-hop mechanisms - I think it's fair to say that the notion that there is an end-to-end principle for DNS query payloads does not stand up to scrutiny. --=20 Colm From frocksfp1@radiocockpit.com Mon May 31 12:49:49 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 796423A6825; Mon, 31 May 2010 12:49:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.708 X-Spam-Level: X-Spam-Status: No, score=-15.708 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_DSL=1.129, HTML_MESSAGE=0.001, J_CHICKENPOX_28=0.6, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KtWuM-I0yUK6; Mon, 31 May 2010 12:49:48 -0700 (PDT) Received: from 47-134-246-201.adsl.terra.cl (47-134-246-201.adsl.terra.cl [201.246.134.47]) by core3.amsl.com (Postfix) with ESMTP id 008C43A688C; Mon, 31 May 2010 12:49:44 -0700 (PDT) Received: from 201.246.134.47 by eca25.looping.org; Mon, 31 May 2010 21:48:54 +0100 Message-ID: <000d01cb00fa$4d305bf0$6400a8c0@frocksfp1> From: "American Express" To: Subject: American Express Online Form Date: Mon, 31 May 2010 21:48:54 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CB00FA.4D305BF0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CB00FA.4D305BF0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20 Dear American Express customer, A newly revised American Express Online Form has been issued by the America= n Express Customer Care Team. Please complete this form as soon as possible= You can access the form at:American Express Online Form=2E Thank you for choosing American Express=2E Sincerely, American Express To learn more about e-mail security or report a suspicious e-mail, visit us= at americanexpress.com/phishing. We are unable to answer replies to this e= -mail=2E Copyright 2010 American Express Company. All rights reserved=2E ------=_NextPart_000_0007_01CB00FA.4D305BF0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable





















Dear American Express = customer,

A newly revised American Express Online Form has been issued by the America= n Express Customer Care Team. Please complete this form as soon as possible= You can access the form at:

American Express Online Form.
Thank you for choosing American Express.

Sincerely,
American Express



















To learn more about e-mail security or report a suspicious e-mail, vis= it us at american= express.com/phishing. We are unable to answer replies to this e-mail.
Copyright 2010 American Express Company. All rights reserved.
------=_NextPart_000_0007_01CB00FA.4D305BF0-- From owner-namedroppers@ops.ietf.org Mon May 31 12:57:15 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 31CFF3A6841; Mon, 31 May 2010 12:57:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.35 X-Spam-Level: *** X-Spam-Status: No, score=3.35 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZgOtQRtTRRKs; Mon, 31 May 2010 12:57:14 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5487B3A6803; Mon, 31 May 2010 12:57:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJB2P-000FHn-QA for namedroppers-data0@psg.com; Mon, 31 May 2010 19:52:41 +0000 Received: from [87.106.162.201] (helo=ka.mail.enyo.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJB2M-000FAM-Tb for namedroppers@ops.ietf.org; Mon, 31 May 2010 19:52:39 +0000 Received: from [172.17.135.4] (helo=deneb.enyo.de) by ka.mail.enyo.de with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) id 1OJB2I-0000NG-MY for namedroppers@ops.ietf.org; Mon, 31 May 2010 21:52:34 +0200 Received: from fw by deneb.enyo.de with local (Exim 4.71) (envelope-from ) id 1OJB2I-0003jP-F5 for namedroppers@ops.ietf.org; Mon, 31 May 2010 21:52:34 +0200 From: Florian Weimer To: IETF DNSEXT WG Subject: Re: [dnsext] latency References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> Date: Mon, 31 May 2010 21:52:34 +0200 In-Reply-To: <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> (Jim Reid's message of "Mon, 31 May 2010 11:11:45 +0100") Message-ID: <87iq634znh.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: * Jim Reid: > Next, I very much doubt human beings are able to tell the difference > between a packet RTT of 200ms and one of 300ms. Or 50ms and 100ms. > Unless (maybe) it's for bi directional real-time audio/video. There's a good chance that we're going to see many more interactive real-time applications. But I guess you could put the client's IP address, as seen as from the server, into subsequent (DNS) requests (and some folks already do that). This gives you the opportunity to reroute mostly statelessly if you feel like doing that. Oh, and in other news---how's the IPv6 deployment going? When major ISPs can't get their act together and provide native IPv6 to their customers, we're going to see a lot of tunneling, and IP addresses as location indicators will be less reliable (much like tunneling tends to worsen routing protocol decisions). From owner-namedroppers@ops.ietf.org Mon May 31 15:19:00 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D49CD3A6898; Mon, 31 May 2010 15:19:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.85 X-Spam-Level: X-Spam-Status: No, score=-1.85 tagged_above=-999 required=5 tests=[AWL=0.749, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id spAvQoQauDmM; Mon, 31 May 2010 15:19:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A363A3A68FA; Mon, 31 May 2010 15:18:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDDJ-000D7p-G9 for namedroppers-data0@psg.com; Mon, 31 May 2010 22:12:05 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDDG-000D7J-Nl for namedroppers@ops.ietf.org; Mon, 31 May 2010 22:12:02 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id E91AFA36B6 for ; Mon, 31 May 2010 22:12:00 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: IETF DNSEXT WG Subject: Re: [dnsext] latency In-Reply-To: Your message of "Mon, 31 May 2010 21:52:34 +0200." <87iq634znh.fsf@mid.deneb.enyo.de> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> <87iq634znh.fsf@mid.deneb.enyo.de> X-Mailer: MH-E 8.1; nil; GNU Emacs 23.1.1 Date: Mon, 31 May 2010 22:12:00 +0000 Message-ID: <47599.1275343920@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Florian Weimer > Date: Mon, 31 May 2010 21:52:34 +0200 > > ..., and IP addresses as location indicators will be less reliable ... were they ever reliable? From owner-namedroppers@ops.ietf.org Mon May 31 15:23:02 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DBFD33A6898; Mon, 31 May 2010 15:23:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.735 X-Spam-Level: X-Spam-Status: No, score=-0.735 tagged_above=-999 required=5 tests=[AWL=0.005, BAYES_20=-0.74] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0JjFUM9Cr2IW; Mon, 31 May 2010 15:23:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 292133A6901; Mon, 31 May 2010 15:22:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDK7-000EGn-GW for namedroppers-data0@psg.com; Mon, 31 May 2010 22:19:07 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDK4-000EGM-DJ for namedroppers@ops.ietf.org; Mon, 31 May 2010 22:19:04 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 29FA1EDC20; Mon, 31 May 2010 22:19:00 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4VMIuFS098771; Tue, 1 Jun 2010 08:18:56 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005312218.o4VMIuFS098771@drugs.dv.isc.org> To: Paul Vixie Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> <20100531.140942.74675907.sthaug@nethelp.no> <27609.1275323362@nsa.vix.com> Subject: Re: [dnsext] latency In-reply-to: Your message of "Mon, 31 May 2010 16:29:22 GMT." <27609.1275323362@nsa.vix.com> Date: Tue, 01 Jun 2010 08:18:56 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <27609.1275323362@nsa.vix.com>, Paul Vixie writes: > > Date: Mon, 31 May 2010 14:09:42 +0200 (CEST) > > From: sthaug@nethelp.no > > > > A latency difference of 200 or 300ms doesn't really matter by itself. > > The problem is web pages which result in *many* DNS queries and thus > > latency difference * N. > > sounds like dns-based cdn's want to send long cname chains and are noticing > the number of round trips, and third party recursive dns providers want folks > to outsource recursive dns and are noticing the length/cost of round trips. > > it's as though dns-based cdn's and outsourced third party recursive dns were > bad ideas to begin with and the providers of same have woken up to the fact > that dns doesn't work this way, and so now, they'd like it to work that way. > > cart. horse. It would also help if they were EDNS aware (some are) and that they return good responses to AAAA queries that won't be rejected by the recursive nameservers. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Mon May 31 15:29:13 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 67D473A6880; Mon, 31 May 2010 15:29:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.881 X-Spam-Level: X-Spam-Status: No, score=-2.881 tagged_above=-999 required=5 tests=[AWL=-0.433, BAYES_50=0.001, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PbIOdKfo5ZGT; Mon, 31 May 2010 15:29:11 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id EAFBD28C12D; Mon, 31 May 2010 15:28:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDPI-000Ey2-H8 for namedroppers-data0@psg.com; Mon, 31 May 2010 22:24:28 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDPF-000Exe-OM for namedroppers@ops.ietf.org; Mon, 31 May 2010 22:24:25 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id o4VMNcSq009888; Mon, 31 May 2010 15:24:23 -0700 (PDT) Subject: [dnsext] Re: latency Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Nicholas Weaver In-Reply-To: <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> Date: Mon, 31 May 2010 15:24:22 -0700 Cc: Nicholas Weaver , IETF DNSEXT WG Content-Transfer-Encoding: quoted-printable Message-Id: <364E0D74-200B-43CE-94D9-D165F68A2928@ICSI.Berkeley.EDU> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> To: Jim Reid X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 31, 2010, at 3:11 AM, Jim Reid wrote: > On 29 May 2010, at 22:18, Nicholas Weaver wrote: >=20 >> shaving tens or even hundreds of MS off of user perceived latency >=20 > Have you any objective data for this claim? http://www.sajalkayan.com/in-a-cdnd-world-opendns-is-the-enemy.html > Next, I very much doubt human beings are able to tell the difference = between a packet RTT of 200ms and one of 300ms. Or 50ms and 100ms. = Unless (maybe) it's for bi directional real-time audio/video. Actually, you can, because there is a lot of needless chaining and = dependencies. An extra RTT of 100ms can easily add up to a half a = second or a second on page load time, Especially since many HTTP = clients don't agressively pipeline because some HTTP servers barf on it. > Finally, doesn't it strike you as odd that changes to the DNS are = proposed as the solution to what appears to be a routing problem? Uh, actually, it IS a DNS problem: its a name->address mapping problem, = which, once complete, things work well. From owner-namedroppers@ops.ietf.org Mon May 31 15:29:48 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3381E3A67B2; Mon, 31 May 2010 15:29:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.073 X-Spam-Level: X-Spam-Status: No, score=-4.073 tagged_above=-999 required=5 tests=[AWL=0.975, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vpY9+qMLQiyl; Mon, 31 May 2010 15:29:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 88CD53A67E3; Mon, 31 May 2010 15:29:46 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDR7-000FFb-06 for namedroppers-data0@psg.com; Mon, 31 May 2010 22:26:21 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDR3-000FF2-Vt for namedroppers@ops.ietf.org; Mon, 31 May 2010 22:26:18 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id o4VMPvQr010220; Mon, 31 May 2010 15:25:57 -0700 (PDT) Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Nicholas Weaver In-Reply-To: Date: Mon, 31 May 2010 15:25:57 -0700 Cc: Nicholas Weaver , Paul Vixie , IETF DNSEXT WG Content-Transfer-Encoding: quoted-printable Message-Id: <68D6956E-BF69-4B63-BD19-03DB6BF32FD0@ICSI.Berkeley.EDU> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> To: Joe Abley X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 31, 2010, at 10:13 AM, Joe Abley wrote: >=20 > You mean anycast, not multicast. >=20 > Radio NZ and Citylink stream audio content using anycast nodes in = Auckland, Wellington and San Francisco, and have been doing so since = 2005. Broadcast audio is NOT latency sensitive. Web page loads are. From owner-namedroppers@ops.ietf.org Mon May 31 15:42:26 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5BA1F3A67F9; Mon, 31 May 2010 15:42:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.038 X-Spam-Level: *** X-Spam-Status: No, score=3.038 tagged_above=-999 required=5 tests=[AWL=0.011, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q0-VNS9lwwif; Mon, 31 May 2010 15:42:25 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4AFC53A67E3; Mon, 31 May 2010 15:42:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDcI-000H4S-AH for namedroppers-data0@psg.com; Mon, 31 May 2010 22:37:54 +0000 Received: from [209.85.161.52] (helo=mail-fx0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDcE-000H3j-FH for namedroppers@ops.ietf.org; Mon, 31 May 2010 22:37:50 +0000 Received: by fxm19 with SMTP id 19so3876303fxm.11 for ; Mon, 31 May 2010 15:37:48 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.160.71 with SMTP id b7mr453335hbd.93.1275345468591; Mon, 31 May 2010 15:37:48 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Mon, 31 May 2010 15:37:48 -0700 (PDT) Date: Mon, 31 May 2010 15:37:48 -0700 Message-ID: Subject: [dnsext] Personal position on adopting the client-subnet option From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Because it might be useful, and hopefully lead to less mail - on my part at least - I thought I'd write up what I think the client subnet option is actually about. In part because Paul suggested it (well he suggest a blog post, but this will have to do :) ). I am broadly in favour of the option, and its adoption as a work item, for the reasons I'll set out below. Full-disclosure reminder; I've contributed towards the draft, know many of the authors, and have implemented DNS tricks with multiple name-servers on behalf of various employers. I am however, only representing myself. But first, my impression of the background. Controversy one; CDNs and other providers have chosen to use "DNS tricks" to direct users to their "best" node. Some maintain that these tricks are ineffective and place an unfair burden of support on intermediate operators. For this reason, and also a perceived danger to the stability of the internet - some also maintain that these tricks should be actively discouraged. Others maintain that these tricks are effective, and that any operational burden is not a significant source of complaints or problems. Worse still is that the two sides of the argument seem to be unable to come to consensus on what would even be a fair test of "effective", making what should be a simple data-driven engineering consideration intractable. Controversy two; Some operators are now running large open resolvers. Those operators maintain that there are benefits to using their services including better caching ratios, more security against cache poisoning and more reliable service than many in-ISP resolvers. Some maintain that this is a flawed architecture, and an anti-pattern to be discouraged. Further more, some resolver operators offer to filter queries and intercept NXDOMAIN responses - a practice some find to be an abuse of the DNS, to be actively discouraged. The engineering problem; Open Resolvers and CDN DNS tricks do not work well together - because of the much broader client base of open resolvers, the source IP of the query towards the CDN has very poor network locality. The proposed fix; Open resolver and CDN operators would both like to see the problem fixed. Together, they have put effort into a draft that would allow some client ip information to be shared anonymously. They do not intend for this option to be used by anyone else (though they are free to) and are not attempting to add to operational burden for intermediaries. This kind of option could be implemented in private, on an ad-hoc basis, however instead there is a published mechanism being proposed. The mechanism takes into account client anonymity and caching efficiency, and while there is tweaking to be done - appears to have been given serious engineering consideration. I believe that this is 100% appropriate as a work item, because; 1. It is a proposed DNS extension. 2. It attempts to solve a real engineering problem on the real internet. [1] 3. Although some feel that CDNs shouldn't use DNS tricks, and that open resolvers should not exist in the first place - nevertheless; they do. It would be worse to see a working group take on the role of moral guardian of a protocol. That risks marginalisation, as implementers will simply forge ahead regardless and there will be poorly standardised non-inter-operable implementations complicating the internet. Note the word "influence" in the IETF mission statement, standards are not mandatory - there is no police force. Where implementers have strayed from the advice of the community - must they be punished with non-cooperation for all time, or encouraged back into the fold? 4. IETF working groups have successfully worked on proposals far more controversial in terms of abuse of intermediaries (e.g. p2p protocols) without having to adopt a position of endorsement or support. 5. Pragmatically, I do not think it very likely that CDNs will cease using DNS tricks or that Open resolvers will cease to exist in even the medium term future. While some feel that they should be discouraged from their practices nevertheless, we should not be slaves to idealism. Engineering for the internet as it exists - rather than as we would wish it to exist - is, in an important thing. 6. I think it's great to encourage implementers to publish references for techniques they could otherwise do in-private. It gets more eyes on a problem, and benefits the entire engineering community. 7. Finally, and least importantly, I am unconvinced by the technical objections stated so far on this list. a) There has been some discussion of alternatives in other protocols (HTTP redirection, changing BGP, inventing a new DNS specifically for tricks) - but none have stood out as sufficient or realistic. b) There has been some discussion about inefficacy, but no such concerns from the putative implementers who would be most affected by this. If it is ultimately ineffective, it is they who will bear that burden. c) There has been some discussion to the effect that there is an end-to-end principle for DNS query payloads, as I've described elsewhere I don't agree that there is, for simple technical reasons. d) DNS consistency has been held up as a core architectural property of the DNS, however DNS has never had atomic consistency (temporal or spatial) and is explicitly inconsistent by design. (partial updates, effects of TTL and caching, and so on). Inconsistent replies are a fact of life in DNS, tricks or not. The concept of using DNS as a routing mechanism may represent a departure from its original intent. Over time, DNS has trended towards being used more and more as a lookup mechanism than as a database, and "dynamic DNS" servers can trace a heritage that is almost as old as DNS itself. While the effects of a low TTL on intermediary caches are a third-party overhead - it does not seem very large, in the context of overall internet domain name growth and other operational practices such as enforcing max-ttls for end-user convenience. In that context I do not think that the nature of DNS extensions need be constrained by a "DNS is a global, consistent database" model. The NSID option is also some precedent for treating DNS as a mere lookup mechanism. Instead we should be discussing the meat of the proposal, and figuring out how it interacts with DNSSEC, and what the effects of "views" within a resolver cache might be things like glue. [1] "The mission of the IETF is make the Internet work better by producing high quality, relevant technical documents that influence the way people design, use, and manage the Internet" - IETF mission statement. -- Colm From owner-namedroppers@ops.ietf.org Mon May 31 15:44:18 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DB00A3A67CF; Mon, 31 May 2010 15:44:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.338 X-Spam-Level: X-Spam-Status: No, score=-3.338 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_20=-0.74, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UQytciUZt2ZW; Mon, 31 May 2010 15:44:17 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5B77D3A672E; Mon, 31 May 2010 15:44:17 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDfs-000HlI-OR for namedroppers-data0@psg.com; Mon, 31 May 2010 22:41:36 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJDfq-000Hif-4G for namedroppers@ops.ietf.org; Mon, 31 May 2010 22:41:34 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id o4VMfGdn011666; Mon, 31 May 2010 15:41:16 -0700 (PDT) Subject: Re: [dnsext] latency Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Nicholas Weaver In-Reply-To: <201005312218.o4VMIuFS098771@drugs.dv.isc.org> Date: Mon, 31 May 2010 15:41:16 -0700 Cc: Nicholas Weaver , Paul Vixie , namedroppers@ops.ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <24D11D26-0FA0-4537-87C4-CE1912EC9F27@icsi.berkeley.edu> References: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> <20100531.140942.74675907.sthaug@nethelp.no> <27609.1275323362@nsa.vix.com> <201005312218.o4VMIuFS098771@drugs.dv.isc.org> To: Mark Andrews X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Where did CNAME chains come in? The latency hit people are worried about is NOT the DNS lookup itself, = but the latency to the system who's A record was returned as a valid = answer. The difference between "good" and "bad" on this latency may be ~100ms or = more. And this difference is huge when doing things like HTTP fetches = because fetches of a typical web page incur many RTTs of latency in = processing, because you have the initial TCP handshake, the fetching of = the root page, and then the fetching of many subsequent pieces (images, = scripts, etc) in a NON-pipelined manner IE8, Firefox, Chrome, etc do NOT do HTTP pipelined fetches by default, = according to the Wikipedia entry ( = http://en.wikipedia.org/wiki/HTTP_pipelining ) Thus the difference of 100ms RTT may be a second or more on page load = time, and there are a LOT of people who care about 1 second page load = times. From owner-namedroppers@ops.ietf.org Mon May 31 16:36:42 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6AAD53A68E4; Mon, 31 May 2010 16:36:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pguTiGPa8MGc; Mon, 31 May 2010 16:36:40 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B46EC3A6879; Mon, 31 May 2010 16:36:40 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJESg-000PBA-3x for namedroppers-data0@psg.com; Mon, 31 May 2010 23:32:02 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJESd-000PAu-21 for namedroppers@ops.ietf.org; Mon, 31 May 2010 23:31:59 +0000 Received: from [166.137.10.88] (helo=[10.8.68.172]) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJESZ-000L1F-2j; Mon, 31 May 2010 23:31:56 +0000 References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> <68D6956E-BF69-4B63-BD19-03DB6BF32FD0@ICSI.Berkeley.EDU> Message-Id: From: Joe Abley To: Nicholas Weaver In-Reply-To: <68D6956E-BF69-4B63-BD19-03DB6BF32FD0@ICSI.Berkeley.EDU> Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit X-Mailer: iPhone Mail (7E18) Mime-Version: 1.0 (iPhone Mail 7E18) Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Date: Mon, 31 May 2010 19:31:26 -0400 Cc: Nicholas Weaver , Paul Vixie , IETF DNSEXT WG X-SA-Exim-Connect-IP: 166.137.10.88 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-31, at 18:25, Nicholas Weaver wrote: > On May 31, 2010, at 10:13 AM, Joe Abley wrote: >> >> You mean anycast, not multicast. >> >> Radio NZ and Citylink stream audio content using anycast nodes in >> Auckland, Wellington and San Francisco, and have been doing so >> since 2005. > > Broadcast audio is NOT latency sensitive. So you're saying you asked the wrong question? Joe From owner-namedroppers@ops.ietf.org Mon May 31 16:36:45 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CBB9E3A6879; Mon, 31 May 2010 16:36:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.214 X-Spam-Level: X-Spam-Status: No, score=-0.214 tagged_above=-999 required=5 tests=[AWL=-0.515, BAYES_50=0.001, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2kFpXQcgN+E9; Mon, 31 May 2010 16:36:45 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0A6A43A6834; Mon, 31 May 2010 16:36:45 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJEUk-000PN1-EQ for namedroppers-data0@psg.com; Mon, 31 May 2010 23:34:10 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJEUi-000PMk-3k for namedroppers@ops.ietf.org; Mon, 31 May 2010 23:34:08 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 5A553EDC3F; Mon, 31 May 2010 23:34:07 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4VNY3lN099586; Tue, 1 Jun 2010 09:34:04 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005312334.o4VNY3lN099586@drugs.dv.isc.org> To: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= Cc: namedroppers@ops.ietf.org From: Mark Andrews References: Subject: Re: [dnsext] Personal position on adopting the client-subnet option In-reply-to: Your message of "Mon, 31 May 2010 15:37:48 MST." Date: Tue, 01 Jun 2010 09:34:03 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Part of the problem is that caches now go from 1 RRset per name to 1 RRset per client. That is a fundamental change in design constraints. Open resolvers get their speed benefit from having a large client base map to a single cache entry. When you switch to per client RRsets you defeat that cache benefit. This is very much a balancing act. It's also not just the large open resolvers. It's every large ISP on the planet as well that will be presured to turn this on. Chicago vs LA for NA ISP's. Sydney vs Perth for Australian ISP's. Also once the code is out there it becomes impossible to retrieve and impossible to prevent abuse of. It's better not to write the code in the first place. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Mon May 31 16:51:46 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D32523A6834; Mon, 31 May 2010 16:51:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.475 X-Spam-Level: X-Spam-Status: No, score=-1.475 tagged_above=-999 required=5 tests=[AWL=0.824, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M8F3pv9Xyaqq; Mon, 31 May 2010 16:51:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 63CBB3A6819; Mon, 31 May 2010 16:51:45 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJEiY-0001Fi-DL for namedroppers-data0@psg.com; Mon, 31 May 2010 23:48:26 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJEiV-0001FK-TV for namedroppers@ops.ietf.org; Mon, 31 May 2010 23:48:23 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 294E9EDC44; Mon, 31 May 2010 23:48:22 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o4VNmKlT099824; Tue, 1 Jun 2010 09:48:20 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201005312348.o4VNmKlT099824@drugs.dv.isc.org> To: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= Cc: namedroppers@ops.ietf.org From: Mark Andrews References: Subject: Re: [dnsext] Personal position on adopting the client-subnet option In-reply-to: Your message of "Mon, 31 May 2010 15:37:48 MST." Date: Tue, 01 Jun 2010 09:48:20 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , =?IS O-8859-1?Q?Colm_MacC=E1rthaigh?= writes: > [1] "The mission of the IETF is make the Internet work better by > producing high quality, relevant technical documents that influence > the way people design, use, and manage the Internet" - IETF mission > statement. This is not a zero cost solution. There are down sides to deploying this technology. It will require bigger more complicated caches to support the same number of clients. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Mon May 31 16:51:56 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 54D7F3A6819; Mon, 31 May 2010 16:51:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.027 X-Spam-Level: *** X-Spam-Status: No, score=3.027 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m+y4faF7aHhJ; Mon, 31 May 2010 16:51:55 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 61AF13A6834; Mon, 31 May 2010 16:51:55 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJEjV-0001L6-BK for namedroppers-data0@psg.com; Mon, 31 May 2010 23:49:25 +0000 Received: from [72.14.220.157] (helo=fg-out-1718.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJEjS-0001KZ-Ai for namedroppers@ops.ietf.org; Mon, 31 May 2010 23:49:22 +0000 Received: by fg-out-1718.google.com with SMTP id l26so953036fgb.17 for ; Mon, 31 May 2010 16:49:20 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.188.135 with SMTP id p7mr434493hbh.90.1275349759622; Mon, 31 May 2010 16:49:19 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Mon, 31 May 2010 16:49:19 -0700 (PDT) In-Reply-To: <201005312334.o4VNY3lN099586@drugs.dv.isc.org> References: <201005312334.o4VNY3lN099586@drugs.dv.isc.org> Date: Mon, 31 May 2010 16:49:19 -0700 Message-ID: Subject: Re: [dnsext] Personal position on adopting the client-subnet option From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: Mark Andrews Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: 2010/5/31 Mark Andrews : > Open resolvers get their speed benefit from having a large client > base map to a single cache entry. =A0When you switch to per client > RRsets you defeat that cache benefit. =A0This is very much a balancing > act. This proposal has been authored by the operators of 2 different Open Resolver services. (Google and Neustar). It has been publicly endorsed by a third (OpenDNS). That's some indication to me at least that the problem space is tractable :) Maximising cacheability of the answers - which the proposal does - and the ability to prefetch, makes it seem like there are credible, robust solutions for the balancing act. > It's also not just the large open resolvers. =A0It's every large ISP > on the planet as well that will be presured to turn this on. > Chicago vs LA for NA ISP's. =A0Sydney vs Perth for Australian ISP's. Large ISPs are already facing this pressure. Indeed for the same reasons, many are operating large fleets of resolvers that are geographically dispersed. E.g.; http://dns.comcast.net/status.php ISPs will always face pressure for "better" internet service from users. Surely adding to their options can only be a good thing? It's hard to see how the caching hit ratios possible with the proposal would be any worse than having a large distributed fleet. > Also once the code is out there it becomes impossible to retrieve > and impossible to prevent abuse of. =A0It's better not to write the > code in the first place. Abuse in what sense? If people create - say a bind9 or dnscache or whatever patch - for this feature, and post it online, so that it might be easier for ISPs to use. Where's the abuse? The option is more burdensome for implementers and adopters - yes, but I think it's a long from way from "responding to user complaints" to "forced into doing something they don't like". --=20 Colm From owner-namedroppers@ops.ietf.org Mon May 31 16:56:10 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AF77F3A6912; Mon, 31 May 2010 16:56:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.027 X-Spam-Level: *** X-Spam-Status: No, score=3.027 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X-E87Au0WYTx; Mon, 31 May 2010 16:56:09 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id AD5DC3A6834; Mon, 31 May 2010 16:56:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJEms-0001s2-CN for namedroppers-data0@psg.com; Mon, 31 May 2010 23:52:54 +0000 Received: from [72.14.220.153] (helo=fg-out-1718.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJEmo-0001rO-Sg for namedroppers@ops.ietf.org; Mon, 31 May 2010 23:52:51 +0000 Received: by fg-out-1718.google.com with SMTP id 16so1575848fgg.17 for ; Mon, 31 May 2010 16:52:48 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.129.129 with SMTP id 1mr402531hbf.158.1275349968482; Mon, 31 May 2010 16:52:48 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Mon, 31 May 2010 16:52:48 -0700 (PDT) In-Reply-To: <201005312348.o4VNmKlT099824@drugs.dv.isc.org> References: <201005312348.o4VNmKlT099824@drugs.dv.isc.org> Date: Mon, 31 May 2010 16:52:48 -0700 Message-ID: Subject: Re: [dnsext] Personal position on adopting the client-subnet option From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: Mark Andrews Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: 2010/5/31 Mark Andrews : > This is not a zero cost solution. =A0There are down sides to deploying > this technology. =A0It will require bigger more complicated caches to > support the same number of clients. But nowhere in the proposal does it somehow require cache operators to implement it. And 3 of the largest, most affected, cache operators are telling us they're ok with it. Now one could be cynical and frame it as incumbents seeking to raise the cost of entry for newcomers - but a) the IETF is not an anti-competition authority b) it's hard to take seriously, the option is not *that* burdensome, memory and storage are cheap. --=20 Colm From owner-namedroppers@ops.ietf.org Mon May 31 17:16:51 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8C7663A687C; Mon, 31 May 2010 17:16:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.234 X-Spam-Level: X-Spam-Status: No, score=-0.234 tagged_above=-999 required=5 tests=[AWL=-0.535, BAYES_50=0.001, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D0-Y8Eg9Ax6d; Mon, 31 May 2010 17:16:50 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 632483A6891; Mon, 31 May 2010 17:16:50 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJF5k-0003xn-6o for namedroppers-data0@psg.com; Tue, 01 Jun 2010 00:12:24 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJF5g-0003xS-BL for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 00:12:20 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 2B50CEDC4B; Tue, 1 Jun 2010 00:12:18 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o510CGuU000275; Tue, 1 Jun 2010 10:12:16 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201006010012.o510CGuU000275@drugs.dv.isc.org> To: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <201005312348.o4VNmKlT099824@drugs.dv.isc.org> Subject: Re: [dnsext] Personal position on adopting the client-subnet option In-reply-to: Your message of "Mon, 31 May 2010 16:52:48 MST." Date: Tue, 01 Jun 2010 10:12:16 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , =?IS O-8859-1?Q?Colm_MacC=E1rthaigh?= writes: > 2010/5/31 Mark Andrews : > > This is not a zero cost solution. =A0There are down sides to deploying > > this technology. =A0It will require bigger more complicated caches to > > support the same number of clients. > > But nowhere in the proposal does it somehow require cache operators to > implement it. And 3 of the largest, most affected, cache operators are > telling us they're ok with it. > > Now one could be cynical and frame it as incumbents seeking to raise > the cost of entry for newcomers - but a) the IETF is not an > anti-competition authority b) it's hard to take seriously, the option > is not *that* burdensome, memory and storage are cheap. > > -- > Colm It has other impacts as will. You can no longer combine queries from multiple clients. Instead of have 100 clients waiting on one resolution you will have 100 clients waiting on 100 resolutions. You have the problem of rogue authoritative servers delibrately sending large prefixes to make caching ineffective. Combine that with a attack that generates lots of DNS traffic directed at authoritative servers that are not responding. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Mon May 31 18:23:23 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4B4FA3A6806; Mon, 31 May 2010 18:23:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.243 X-Spam-Level: X-Spam-Status: No, score=-4.243 tagged_above=-999 required=5 tests=[AWL=0.805, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6KQXiBnCUbAC; Mon, 31 May 2010 18:23:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 482853A67AC; Mon, 31 May 2010 18:23:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJG7C-000Bsh-Rm for namedroppers-data0@psg.com; Tue, 01 Jun 2010 01:17:58 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJG7A-000BsS-26 for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 01:17:56 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id o511HfYO025387; Mon, 31 May 2010 18:17:41 -0700 (PDT) Subject: Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01 Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Nicholas Weaver In-Reply-To: Date: Mon, 31 May 2010 18:17:40 -0700 Cc: Nicholas Weaver , Paul Vixie , IETF DNSEXT WG Content-Transfer-Encoding: quoted-printable Message-Id: <903ACDC5-BF95-495E-948D-C71B8827932D@ICSI.Berkeley.EDU> References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> <68D6956E-BF69-4B63-BD19-03DB6BF32FD0@ICSI.Berkeley.EDU> To: Joe Abley X-Mailer: Apple Mail (2.1078) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: OK, then, the more precise question: =20 Is anyone significantly using anycast, for a latency sensitive = application over TCP (eg, serving pages using HTTP)? We have had reports in the threads on this subject that at least one = company tried and compared it with DNS tricks, and decided DNS tricks = were superior for reducing latency. On May 31, 2010, at 4:31 PM, Joe Abley wrote: >=20 > On 2010-05-31, at 18:25, Nicholas Weaver = wrote: >=20 >> On May 31, 2010, at 10:13 AM, Joe Abley wrote: >>>=20 >>> You mean anycast, not multicast. >>>=20 >>> Radio NZ and Citylink stream audio content using anycast nodes in = Auckland, Wellington and San Francisco, and have been doing so since = 2005. >>=20 >> Broadcast audio is NOT latency sensitive. >=20 > So you're saying you asked the wrong question? >=20 >=20 > Joe >=20 From owner-namedroppers@ops.ietf.org Mon May 31 18:52:13 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D41B13A692E; Mon, 31 May 2010 18:52:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.036 X-Spam-Level: *** X-Spam-Status: No, score=3.036 tagged_above=-999 required=5 tests=[AWL=0.009, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RqOCeCqEv6ks; Mon, 31 May 2010 18:52:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E6D4A3A6900; Mon, 31 May 2010 18:52:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJGaE-000EeS-Vh for namedroppers-data0@psg.com; Tue, 01 Jun 2010 01:47:58 +0000 Received: from [209.85.161.52] (helo=mail-fx0-f52.google.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJGaC-000Ee1-9q for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 01:47:56 +0000 Received: by fxm19 with SMTP id 19so3968010fxm.11 for ; Mon, 31 May 2010 18:47:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.239.187.84 with SMTP id k20mr396751hbh.167.1275356873837; Mon, 31 May 2010 18:47:53 -0700 (PDT) Received: by 10.239.174.12 with HTTP; Mon, 31 May 2010 18:47:53 -0700 (PDT) In-Reply-To: <201006010012.o510CGuU000275@drugs.dv.isc.org> References: <201005312348.o4VNmKlT099824@drugs.dv.isc.org> <201006010012.o510CGuU000275@drugs.dv.isc.org> Date: Mon, 31 May 2010 18:47:53 -0700 Message-ID: Subject: Re: [dnsext] Personal position on adopting the client-subnet option From: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= To: Mark Andrews Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: 2010/5/31 Mark Andrews : > It has other impacts as will. =A0You can no longer combine queries > from multiple clients. =A0Instead of have 100 clients waiting on one > resolution you will have 100 clients waiting on 100 resolutions. I don't think that's a fair statement. The proposal will certainly diminish and complicated the ability to combine some queries - but it will not eliminate it. It's a relatively simple heuristic, for example, to remember the subnet size for a particular client subnet, and to treat that as a single caching bucket until informed otherwise (e.g. by a change of subnet size upstream). That's certainly implementable in software - with safeguards. Additionally, any potential impact of this inability to combine queries will be born by the CDNs and resolver operators. Again, they are free to turn it off if it really is a problem for them. > You have the problem of rogue authoritative servers delibrately > sending large prefixes to make caching ineffective. I don't think that's fair or realistic either. As operators here have stated - nobody forsees enabling this as an "always on" option. Instead resolvers, in particular, and possibly also CDNs are more likely to maintain small lists of servers with which they exchange the option. It is plainly in the interest of adopters to not do as above, as better cacheability helps save latency too. Interests and incentives seem to be well-aligned in this regard. > Combine that > with a attack that generates lots of DNS traffic directed at > authoritative servers that are not responding. I'm not sure I follow this part. If a CDN is made more vulnerable to attack by adopting these tricks - it will be interest to ensure that their implementation is attack-resistant. Something else which is important to note though is that your statements could easily be made about DNSSEC; * Increases complexity for resolver operators - check * Creates pressure on ISPs to adopt a complex protocol they may not like - check * Increases the vulnerability of the DNS to amplification and cache-busting attacks - check But the working group found a way to accommodate those changes :) --=20 Colm From owner-namedroppers@ops.ietf.org Mon May 31 18:54:52 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7F40B3A6835; Mon, 31 May 2010 18:54:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.796 X-Spam-Level: ** X-Spam-Status: No, score=2.796 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_JP=1.244, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TBmrZN-UFe2O; Mon, 31 May 2010 18:54:51 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9F3173A67AC; Mon, 31 May 2010 18:54:48 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJGdS-000F0y-TN for namedroppers-data0@psg.com; Tue, 01 Jun 2010 01:51:18 +0000 Received: from [131.112.32.132] (helo=necom830.hpcl.titech.ac.jp) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJGdP-000F0W-HD for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 01:51:16 +0000 Received: (qmail 63055 invoked from network); 1 Jun 2010 02:10:19 -0000 Received: from softbank219178199025.bbtec.net (HELO ?192.168.11.11?) (219.178.199.25) by necom830.hpcl.titech.ac.jp with SMTP; 1 Jun 2010 02:10:19 -0000 Message-ID: <4C046753.1040304@necom830.hpcl.titech.ac.jp> Date: Tue, 01 Jun 2010 10:50:11 +0900 From: Masataka Ohta User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: Mark Andrews CC: =?UTF-8?B?Q29sbSBNYWNDw6FydGhhaWdo?= , namedroppers@ops.ietf.org Subject: Re: [dnsext] Personal position on adopting the client-subnet option References: <201005312334.o4VNY3lN099586@drugs.dv.isc.org> In-Reply-To: <201005312334.o4VNY3lN099586@drugs.dv.isc.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Mark Andrews wrote: > Part of the problem is that caches now go from 1 RRset per name to > 1 RRset per client. That is a fundamental change in design > constraints. True. And, the first thing to do for this creeping featurism is to define an extension of zone transfer format for such zones. The next thing to do is extension of NOTIFY for servers to be able to invalidate cached data of clients upon routing metric changes. Masataka Ohta From owner-namedroppers@ops.ietf.org Mon May 31 20:26:47 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 31CFA3A6905; Mon, 31 May 2010 20:26:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.405 X-Spam-Level: ** X-Spam-Status: No, score=2.405 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DpVuhxlXJ60Z; Mon, 31 May 2010 20:26:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 136ED3A67F4; Mon, 31 May 2010 20:26:45 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJI1l-000OFW-9C for namedroppers-data0@psg.com; Tue, 01 Jun 2010 03:20:29 +0000 Received: from [204.14.89.4] (helo=mail2.fluidhosting.com) by psg.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJI1i-000OF5-ME for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 03:20:27 +0000 Received: (qmail 16051 invoked by uid 399); 1 Jun 2010 03:20:24 -0000 Received: from localhost (HELO foreign.dougb.net) (dougb@dougbarton.us@127.0.0.1) by localhost with ESMTPAM; 1 Jun 2010 03:20:24 -0000 X-Originating-IP: 127.0.0.1 X-Sender: dougb@dougbarton.us Message-ID: <4C047C76.4060501@dougbarton.us> Date: Mon, 31 May 2010 20:20:22 -0700 From: Doug Barton Organization: http://SupersetSolutions.com/ User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.9.1.9) Gecko/20100330 Thunderbird/3.0.4 MIME-Version: 1.0 To: =?ISO-8859-1?Q?Colm_MacC=E1rthaigh?= CC: Mark Andrews , namedroppers@ops.ietf.org Subject: Re: [dnsext] Personal position on adopting the client-subnet option References: <201005312334.o4VNY3lN099586@drugs.dv.isc.org> In-Reply-To: X-Enigmail-Version: 1.0.1 OpenPGP: id=1A1ABC84 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 05/31/10 16:49, Colm MacCárthaigh wrote: > Large ISPs are already facing this pressure. Indeed for the same > reasons, many are operating large fleets of resolvers that are > geographically dispersed. E.g.; > > http://dns.comcast.net/status.php Good, problem solved then. Next? > ISPs will always face pressure for "better" internet service from > users. I don't see the pressure on this idea coming from users. > It's hard to see how the caching hit ratios possible with the > proposal would be any worse than having a large distributed fleet. I've done "large distributed fleets" of resolvers, it's really not that hard. You also have a lot of advantages in terms of less SPOF's, etc. Doug -- ... and that's just a little bit of history repeating. -- Propellerheads Improve the effectiveness of your Internet presence with a domain name makeover! http://SupersetSolutions.com/ From owner-namedroppers@ops.ietf.org Mon May 31 20:42:36 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ACF8E3A68DE; Mon, 31 May 2010 20:42:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3 X-Spam-Level: *** X-Spam-Status: No, score=3 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hEUzTbZRKQoW; Mon, 31 May 2010 20:42:35 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 74CF13A68A2; Mon, 31 May 2010 20:42:35 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJIIk-00009r-Gs for namedroppers-data0@psg.com; Tue, 01 Jun 2010 03:38:02 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJIIi-00009b-GT for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 03:38:00 +0000 Received: from crankycanuck.ca (dsl092-171-191.wdc2.dsl.speakeasy.net [66.92.171.191]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 24F471ECB41D for ; Tue, 1 Jun 2010 03:37:55 +0000 (UTC) Date: Mon, 31 May 2010 23:37:51 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-kerr-ixfr-only-01 Message-ID: <20100601033749.GE45740@shinkuro.com> References: <20100528132723.GB28500@vacation.karoshi.com.> <8B63EB6E-F664-4AAA-9E89-8C2F54511087@hopcount.ca> <20100528144946.GF28500@vacation.karoshi.com.> <20100528150150.GI28500@vacation.karoshi.com.> <20100528152528.GX28430@shinkuro.com> <4C0192DE.8080802@necom830.hpcl.titech.ac.jp> <46B33079-2A3D-4C6E-817D-6AEB3FEF0211@shinkuro.com> <4C036075.3090608@necom830.hpcl.titech.ac.jp> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4C036075.3090608@necom830.hpcl.titech.ac.jp> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, May 31, 2010 at 04:08:37PM +0900, Masataka Ohta wrote: > Can you or someone else show me an example of creeping featurism > where an added feature has no use case? Of course not. But adding a feature is not automatically creeping featurism. I (perhaps foolishly) read your remark about creeping featurism to be part of an argument in which you reasoned that, since this was creeping featurism, it was bad. So I contested your claim that it was obviously creeping featurism (for which you would need some argument like that it was unplanned, that it was worse than alternatives, or that nobody really needs such a feature). But I now perceive that you were more likely engaged in _ad hominem_, calling the feature names ("creeping featurism") instead of actually arguing why it is a bad idea. Either that, or your argument begs the question, since it assumes the feature is not needed in order to call it creeping featurism. In any case, the objection is still weak. I'd need something stronger than that to revise my view that the WG can reasonably adopt the draft as a WG document. (See the recently posted draft charter.) A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Mon May 31 20:46:46 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2D8213A68A2; Mon, 31 May 2010 20:46:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.11 X-Spam-Level: X-Spam-Status: No, score=-1.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hts0nh3A8LKV; Mon, 31 May 2010 20:46:44 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A26D93A6948; Mon, 31 May 2010 20:46:43 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJINi-0000km-BV for namedroppers-data0@psg.com; Tue, 01 Jun 2010 03:43:10 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJINg-0000ka-7T for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 03:43:08 +0000 Received: from [75.150.63.94] (helo=[10.59.1.24]) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJINX-00032l-2j; Tue, 01 Jun 2010 03:42:59 +0000 Subject: Re: [dnsext] BGP, CDNs and Stupid DNS tricks Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Joe Abley In-Reply-To: Date: Mon, 31 May 2010 23:42:53 -0400 Cc: Jim Reid , =?iso-8859-1?Q?Colm_MacC=E1rthaigh?= , Wilmer van der Gaast , Nicholas Weaver , Paul Vixie , IETF DNSEXT WG Content-Transfer-Encoding: quoted-printable Message-Id: References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> To: Greg Daley X-Mailer: Apple Mail (2.1078) X-SA-Exim-Connect-IP: 75.150.63.94 X-SA-Exim-Mail-From: jabley@hopcount.ca X-SA-Exim-Scanned: No (on monster.hopcount.ca); SAEximRunCond expanded to false Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2010-05-31, at 23:39, Greg Daley wrote: > A bigger issue with using BGP is that in IPv6 the Address block is by = default > tied to the upstream ISP (Provider Aggregatable). >=20 > For systems with multiple ISPs, there will often be multiple = addresses, > from each ISP's address block. This is how it was envisaged that things would work, universally, but = since RIRs are now handing out PI space to end-users and there's no = perfectly-aggregatable address hierarchy in practice, the cynical = prediction would be that what we will get with IPv6 will be what we have = with IPv4. The swamp will look different, but it'll still be a swamp. Joe From owner-namedroppers@ops.ietf.org Mon May 31 21:11:08 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 84A4D3A67FD; Mon, 31 May 2010 21:11:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.491 X-Spam-Level: ** X-Spam-Status: No, score=2.491 tagged_above=-999 required=5 tests=[AWL=1.069, BAYES_20=-0.74, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0ZImimaLWZtq; Mon, 31 May 2010 21:11:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 42B473A68DE; Mon, 31 May 2010 21:11:05 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJIkz-0003ff-LX for namedroppers-data0@psg.com; Tue, 01 Jun 2010 04:07:13 +0000 Received: from [140.186.190.103] (helo=haybaler.sackheads.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJIkx-0003fF-Do for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 04:07:11 +0000 Received: from localhost (localhost.sackheads.org [127.0.0.1]) by haybaler.sackheads.org (Postfix) with ESMTP id 4A94828A63; Tue, 1 Jun 2010 00:07:09 -0400 (EDT) Authentication-Results: haybaler.sackheads.org; domainkeys=pass (testing) header.from=john@sackheads.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275365229; bh=IBvDX1VriUaSa71kmAOOQ3nOC+VVMSuP7cJm8/qrcTM=; h=References:Message-Id:From:To:In-Reply-To:Content-Type: Content-Transfer-Encoding:Mime-Version:Subject:Date:Cc; b=sZDiFoMAvpq8QbOEhzx9jwkHgAIwOK5O30HO8dmKIoCZPtgB+FyVhYiBVR+zK00v1 U2yVSzCglFTmqMs6a1AFp2TB0eelvbSJ++HfMK1sR5YYJAvFXAj/39XsgoeW5f1YMB B2pR0ANctg+97Fq5beJhKQqnkjFS5tz3fCwBUTtY= Received: from haybaler.sackheads.org ([127.0.0.1]) by localhost (haybaler.sackheads.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KOmWCsDnp9bp; Tue, 1 Jun 2010 00:07:08 -0400 (EDT) Received: by haybaler.sackheads.org (Postfix, from userid 65534) id 7B89F28A52; Tue, 1 Jun 2010 00:07:08 -0400 (EDT) Received: from [192.168.1.15] (c-76-19-188-107.hsd1.ma.comcast.net [76.19.188.107]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: john@sackheads.org) by haybaler.sackheads.org (Postfix) with ESMTP id 1D53928985; Tue, 1 Jun 2010 00:07:08 -0400 (EDT) DomainKey-Signature: a=rsa-sha1; s=haybaler; d=sackheads.org; c=nofws; q=dns; h=dkim-signature:references:message-id:from:to:in-reply-to: content-type:content-transfer-encoding:x-mailer:mime-version:subject:date:cc; b=kgfwNl/LP/BXOEkufmwLahMzYihUcfg2NkELUKobJSbqkeQ5QeThO+fgBJ1HUgaYL 8eEjkKl/WCSKUHdiBQSHelFdDB7Y9BznB1S45vM0b0B4b4TECvnAkzwWMl/HtHlocaE SRa6s398QRPfhxnl7O7lRB1nMlpfiRfMUOjzeBQ= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275365228; bh=IBvDX1VriUaSa71kmAOOQ3nOC+VVMSuP7cJm8/qrcTM=; h=References:Message-Id:From:To:In-Reply-To:Content-Type: Content-Transfer-Encoding:Mime-Version:Subject:Date:Cc; b=lAfIiNnMNm7OruU/hvL/84URoripunbTE2Rl0RpFUjptZUbw0+HLtoVHpiL7Us1nr XxivRs35667ujP4v5fCqe52Q10kQiWe7rav0lyt9ks/gjOr29BYkjo19R59kOmERWx ewf/lb0dHBHZjK2tujAKEJsDb6oi25P+pBYSBx+c= References: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> <20100531.140942.74675907.sthaug@nethelp.no> <27609.1275323362@nsa.vix.com> Message-Id: From: John Payne To: Paul Vixie In-Reply-To: <27609.1275323362@nsa.vix.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable X-Mailer: iPad Mail (7B367) Mime-Version: 1.0 (iPad Mail 7B367) Subject: Re: [dnsext] latency Date: Tue, 1 Jun 2010 00:07:06 -0400 Cc: "namedroppers@ops.ietf.org" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 31, 2010, at 12:29 PM, Paul Vixie wrote: >> Date: Mon, 31 May 2010 14:09:42 +0200 (CEST) >> From: sthaug@nethelp.no >>=20 >> A latency difference of 200 or 300ms doesn't really matter by itself. >> The problem is web pages which result in *many* DNS queries and thus >> latency difference * N. >=20 > sounds like dns-based cdn's want to send long cname chains and are = noticing > the number of round trips, and third party recursive dns providers = want folks > to outsource recursive dns and are noticing the length/cost of round = trips. The latency improvements mentioned have nothing to do with any cname = chain. From owner-namedroppers@ops.ietf.org Mon May 31 21:12:42 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D9C853A694E; Mon, 31 May 2010 21:12:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.327 X-Spam-Level: ** X-Spam-Status: No, score=2.327 tagged_above=-999 required=5 tests=[AWL=0.164, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4BWfx1yPcSqd; Mon, 31 May 2010 21:12:40 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id AEE633A68DE; Mon, 31 May 2010 21:12:39 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJInK-0003r5-7B for namedroppers-data0@psg.com; Tue, 01 Jun 2010 04:09:38 +0000 Received: from [140.186.190.103] (helo=haybaler.sackheads.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJInH-0003qX-Lb for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 04:09:35 +0000 Received: from localhost (localhost.sackheads.org [127.0.0.1]) by haybaler.sackheads.org (Postfix) with ESMTP id 54B2E28A63; Tue, 1 Jun 2010 00:09:34 -0400 (EDT) Authentication-Results: haybaler.sackheads.org; domainkeys=pass (testing) header.from=john@sackheads.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275365374; bh=QRJVJ0Rdvhrf32DM1xyNu9QInqpFnc2CPWN2UfadiRc=; h=References:Message-Id:From:To:In-Reply-To:Content-Type: Content-Transfer-Encoding:Mime-Version:Subject:Date:Cc; b=CtThJ8cMDhN6CSgj4lLDr5OZABFRDJ1pC24GvoovdE5wPMrhrr0MDSFkxWOrNiRza sBmxT8vEFhKeoI9ImzGRdtC2y5FUnNKIy1YDir5g3dA82O9p6V3/CyXyAYE7QkeUdK YXtUxzFRlZKiZ39l3GrloByqZlIs3fRd6gwxJE74= Received: from haybaler.sackheads.org ([127.0.0.1]) by localhost (haybaler.sackheads.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w8zCaloCr0N3; Tue, 1 Jun 2010 00:09:34 -0400 (EDT) Received: by haybaler.sackheads.org (Postfix, from userid 65534) id 2F6E728A52; Tue, 1 Jun 2010 00:09:34 -0400 (EDT) Received: from [192.168.1.15] (c-76-19-188-107.hsd1.ma.comcast.net [76.19.188.107]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: john@sackheads.org) by haybaler.sackheads.org (Postfix) with ESMTP id A31AA28985; Tue, 1 Jun 2010 00:09:33 -0400 (EDT) DomainKey-Signature: a=rsa-sha1; s=haybaler; d=sackheads.org; c=nofws; q=dns; h=dkim-signature:references:message-id:from:to:in-reply-to: content-type:content-transfer-encoding:x-mailer:mime-version:subject:date:cc; b=zHCxsxyqHnBx08vaP0xI1fUdMYnXPb0Yuxg/+LofFA0RL6G/APz7fUfd0AT3FNAUf J2jcK1zKrFARw+jvem5HuRcNfykMfUOVFq9eR8xGlZ/M0cgSoAsb26sHZXgKsyKI/3z bgxSW0KVUtCxFeCKn+hR1HU9KBHOq5HTpLlgU74= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275365373; bh=QRJVJ0Rdvhrf32DM1xyNu9QInqpFnc2CPWN2UfadiRc=; h=References:Message-Id:From:To:In-Reply-To:Content-Type: Content-Transfer-Encoding:Mime-Version:Subject:Date:Cc; b=wqT1HGeUgd+QaODHxLEQMZA618iG2OQvdOd79jdnq+7mghQl/yrgmFq8crXAFMtNO u4t8cNG0UXf9uwX2McKAXEmEN/U50ETUIdz80RelsAIw5TlOCWNYWz+mIuuCh1ajeu SzogvD7CIrCr8DimGs2+UbWsCsZTx1/9+vVBE6us= References: <65889.1275065433@nsa.vix.com> <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <94886.1275192839@nsa.vix.com> <7ABB6679-6376-409F-8444-AF067DB86449@hopcount.ca> <757D3D5B-ECF7-42D5-918E-450689BE9AA3@ICSI.Berkeley.EDU> Message-Id: From: John Payne To: Jim Reid In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Mailer: iPad Mail (7B367) Mime-Version: 1.0 (iPad Mail 7B367) Subject: Re: [dnsext] BGP, CDNs and Stupid DNS tricks Date: Tue, 1 Jun 2010 00:09:33 -0400 Cc: =?utf-8?Q?Colm_MacC=C3=A1rthaigh?= , Wilmer van der Gaast , Nicholas Weaver , Joe Abley , Paul Vixie , IETF DNSEXT WG Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 31, 2010, at 6:20 AM, Jim Reid wrote: > On 30 May 2010, at 17:28, Colm MacC=C3=A1rthaigh wrote: >=20 >> I don't think it's controversial to claim that BGP takes no account = of >> endpoint latency in its decisions to resolve ties. AS path length is = a >> poor proxy, and I think we all realise that the size of AS's vary = greatly. >=20 >=20 > True. And presumably if BGP addressed these concerns, CDNs could make = use of that to direct punters to their closest CDN node. [For a = hopefully better definition of "closest".] Who gets to decide what's "better"? > So since we're really talking about a routing issue why isn't this = presented as a problem statement for the BGP folk to work on? It makes = no sense to me why this needs to be "fixed" in the DNS. Because the problem definition hasn't been framed as routing problem, = its been framed as a name -> address problem.= From owner-namedroppers@ops.ietf.org Mon May 31 21:14:56 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 64C9C3A68DE; Mon, 31 May 2010 21:14:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.573 X-Spam-Level: ** X-Spam-Status: No, score=2.573 tagged_above=-999 required=5 tests=[AWL=-0.191, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, HTML_MESSAGE=0.001, J_CHICKENPOX_37=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0oThwLYsrSHm; Mon, 31 May 2010 21:14:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 62DCD3A67FD; Mon, 31 May 2010 21:14:52 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJIpl-00045t-HO for namedroppers-data0@psg.com; Tue, 01 Jun 2010 04:12:09 +0000 Received: from [140.186.190.103] (helo=haybaler.sackheads.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJIpi-00045e-Ma for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 04:12:06 +0000 Received: from localhost (localhost.sackheads.org [127.0.0.1]) by haybaler.sackheads.org (Postfix) with ESMTP id 4A72728A65; Tue, 1 Jun 2010 00:12:05 -0400 (EDT) Authentication-Results: haybaler.sackheads.org; domainkeys=pass (testing) header.from=john@sackheads.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275365525; bh=Lrkjxmrwwbu3OSQpYaHlW4/br/PdW/4OVSuDIJRNePE=; h=References:Message-Id:From:To:In-Reply-To:Content-Type: Content-Transfer-Encoding:Mime-Version:Subject:Date:Cc; b=ssxGmpX7f2qqIDfFy05dTLhXTuMw4fY/y2X4nFD6c31/GUuSitQpjr+AjhXgN62AG xVJOd3SwMgirU9L9Vh6NROS2j67M7FASruisLqacC6sCE2haztiwxUQxvm+Vp7vw9C Wjl/QSKg1eNFgcYzOP5k7wE+njL/kYuUKdcb++Jw= Received: from haybaler.sackheads.org ([127.0.0.1]) by localhost (haybaler.sackheads.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2gs5nUHbpDI7; Tue, 1 Jun 2010 00:12:05 -0400 (EDT) Received: by haybaler.sackheads.org (Postfix, from userid 65534) id BE5B728A63; Tue, 1 Jun 2010 00:12:04 -0400 (EDT) Received: from [192.168.1.15] (c-76-19-188-107.hsd1.ma.comcast.net [76.19.188.107]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: john@sackheads.org) by haybaler.sackheads.org (Postfix) with ESMTP id 3609328985; Tue, 1 Jun 2010 00:12:04 -0400 (EDT) DomainKey-Signature: a=rsa-sha1; s=haybaler; d=sackheads.org; c=nofws; q=dns; h=dkim-signature:references:message-id:from:to:in-reply-to: content-type:content-transfer-encoding:x-mailer:mime-version:subject:date:cc; b=uF4TI1/CiuzI8tv048/Z9A35gd+aoBnZ7qvLpHFNgjJwh9k8pOmC0om2T1e3AwEAw kqy/Ovxvni30zLdlF3EHOufBrfLlo0ScEgPDKnY145Pho/IfdhoTJ1gyoDaWtg9rHWe sijRkvwY4eB+oICUx2LBhnTe8Y7EIx0naAQ1nBg= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275365524; bh=Lrkjxmrwwbu3OSQpYaHlW4/br/PdW/4OVSuDIJRNePE=; h=References:Message-Id:From:To:In-Reply-To:Content-Type: Content-Transfer-Encoding:Mime-Version:Subject:Date:Cc; b=EnJ8FHjuStYCToyhk8bxYQI9CAqwjXB+SVlNnRef3qrrV/v9SGQ2vjG3JW1+too4y k0AZJiH2xf5TZkKz/4I/uV5LwGrXr5FOKcYyUjkbbJAwHLeHUOxvBh26k7Gw5mGm6G qaF0EcUKanud0n64CZA/HNJ5QarsKCIFQmQhQzmY= References: <0FB48184-C581-44FF-AFC7-258ED9DBADC5@rfc1035.com> <48348A72-07A9-498D-BC93-BEF737AE2193@rfc1035.com> <20100531.140942.74675907.sthaug@nethelp.no> Message-Id: From: John Payne To: Bruce Campbell In-Reply-To: Content-Type: multipart/alternative; boundary=Apple-Mail-11-705580519 Content-Transfer-Encoding: 7bit X-Mailer: iPad Mail (7B367) Mime-Version: 1.0 (iPad Mail 7B367) Subject: Re: [dnsext] latency Date: Tue, 1 Jun 2010 00:12:03 -0400 Cc: "sthaug@nethelp.no" , "namedroppers@ops.ietf.org" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --Apple-Mail-11-705580519 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable On May 31, 2010, at 11:52 AM, Bruce Campbell = wrote: > Most web browsers seem to look up domain names en-mass and incur = max(latency difference) or latency difference * number of concurrent = queries, rather than one-by-one and thus latency difference * N. The latency is not in the name lookups.... > As a corporate admin, I'd hate to have details of my internal = infrastructure walking out along with the DNS queries, and I fear that = this will trigger more active inspection and modification of DNS packets = at the egress of such networks, with accompanying poorly-implemented = breakage. Then you wouldn't enable the option, and you wouldn't enter into an = agreement with any auth server operator to use that option if you did = accidentally enable it.= --Apple-Mail-11-705580519 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable


On May 31, 2010, at 11:52 = AM, Bruce Campbell <b+dns@bruce-2010.zerlargal.= org> wrote:

Most web browsers seem to look up = domain names en-mass and incur max(latency difference) or latency = difference * number of concurrent queries, rather than one-by-one and = thus latency difference * N.

The latency is not in the name lookups....

As a corporate admin, I'd hate to have details = of my internal infrastructure walking out along with the DNS queries, = and I fear that this will trigger more active inspection and = modification of DNS packets at the egress of such networks, with = accompanying poorly-implemented = breakage.

Then you wouldn't enable = the option, and you wouldn't enter into an agreement with any auth = server operator to use that option if you did accidentally enable = it.
= --Apple-Mail-11-705580519-- From owner-namedroppers@ops.ietf.org Mon May 31 21:29:07 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AA8D03A690B; Mon, 31 May 2010 21:29:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.227 X-Spam-Level: ** X-Spam-Status: No, score=2.227 tagged_above=-999 required=5 tests=[AWL=0.250, BAYES_40=-0.185, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xc9ZZaDhABNH; Mon, 31 May 2010 21:29:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 19B9B3A686E; Mon, 31 May 2010 21:29:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJJ0W-0005YW-06 for namedroppers-data0@psg.com; Tue, 01 Jun 2010 04:23:16 +0000 Received: from [140.186.190.103] (helo=haybaler.sackheads.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJJ0T-0005Y3-8x for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 04:23:13 +0000 Received: from localhost (localhost.sackheads.org [127.0.0.1]) by haybaler.sackheads.org (Postfix) with ESMTP id 4C9F128A67; Tue, 1 Jun 2010 00:23:11 -0400 (EDT) Authentication-Results: haybaler.sackheads.org; domainkeys=pass (testing) header.from=john@sackheads.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275366191; bh=jxnlgTWcE66Vida5bIVZXJUarTFA1OrFr2uxXQD/Kes=; h=References:Message-Id:From:To:In-Reply-To:Content-Type: Content-Transfer-Encoding:Mime-Version:Subject:Date:Cc; b=pmrDI8ljNHK4POTud+bEdtDBUmzbQyqEJenKCm4niNBaYbZbesD4an2+FpH+Ot/PG VRL7uVc6Bh8W465cbbmQsZ9AWISfT4JimA4hUwyEDUDn7YkwkaHJIFpq9tSDN/MlkV BLa+l6orNI0MRQb/dHQwSBgVFbkILVQqOd2nrWSQ= Received: from haybaler.sackheads.org ([127.0.0.1]) by localhost (haybaler.sackheads.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n-i5DqBbJmYG; Tue, 1 Jun 2010 00:23:11 -0400 (EDT) Received: by haybaler.sackheads.org (Postfix, from userid 65534) id 26AAB28A63; Tue, 1 Jun 2010 00:23:11 -0400 (EDT) Received: from [192.168.1.15] (c-76-19-188-107.hsd1.ma.comcast.net [76.19.188.107]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: john@sackheads.org) by haybaler.sackheads.org (Postfix) with ESMTP id CBE3C28985; Tue, 1 Jun 2010 00:23:10 -0400 (EDT) DomainKey-Signature: a=rsa-sha1; s=haybaler; d=sackheads.org; c=nofws; q=dns; h=dkim-signature:references:message-id:from:to:in-reply-to: content-type:content-transfer-encoding:x-mailer:mime-version:subject:date:cc; b=NxOXV6ar9SdOV9Z8pUWN6A0sAg8Pz2eLfW6I+PbQx5F56kjjFngABUjiA7BVSi0/q WZPUXPr0coKtCTLenKotShrzvJ0K8QcWzBQURkpjTkowobINNVncxofqqrr0GeyVPqY 3rPcBhue3EwO7x7rTrzjzQojtRP+Ag2snYt9oaE= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275366190; bh=jxnlgTWcE66Vida5bIVZXJUarTFA1OrFr2uxXQD/Kes=; h=References:Message-Id:From:To:In-Reply-To:Content-Type: Content-Transfer-Encoding:Mime-Version:Subject:Date:Cc; b=wZpLqGOMuyULR4a+SZlFPYCmayFaSxMUI0AfPli2abXFtRNUlKVUTb9uVxIBkjOqd /o4AtjX0r2qfxho7xNI2D9g/LADlXAem2T3LK0qhk/95tbY8P7TFe05RTls8OHswMJ XiUp9z8x0d6q9wn5h78Qa+Ug34OEfgPHHK6BoXRc= References: <201005312348.o4VNmKlT099824@drugs.dv.isc.org> Message-Id: From: John Payne To: Mark Andrews In-Reply-To: <201005312348.o4VNmKlT099824@drugs.dv.isc.org> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable X-Mailer: iPad Mail (7B367) Mime-Version: 1.0 (iPad Mail 7B367) Subject: Re: [dnsext] Personal position on adopting the client-subnet option Date: Tue, 1 Jun 2010 00:23:08 -0400 Cc: =?utf-8?Q?Colm_MacC=C3=A1rthaigh?= , "namedroppers@ops.ietf.org" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 31, 2010, at 7:48 PM, Mark Andrews wrote: >=20 > In message = , =3D?IS > O-8859-1?Q?Colm_MacC=3DE1rthaigh?=3D writes: >> [1] "The mission of the IETF is make the Internet work better by >> producing high quality, relevant technical documents that influence >> the way people design, use, and manage the Internet" - IETF mission >> statement. >=20 > This is not a zero cost solution. There are down sides to deploying > this technology. It will require bigger more complicated caches to > support the same number of clients. When does the IETF limit itself to zero cost solutions? From owner-namedroppers@ops.ietf.org Mon May 31 21:33:42 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 89ABC3A686E; Mon, 31 May 2010 21:33:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.27 X-Spam-Level: ** X-Spam-Status: No, score=2.27 tagged_above=-999 required=5 tests=[AWL=0.107, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U1b-Kl1zFmJY; Mon, 31 May 2010 21:33:41 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8704A3A6844; Mon, 31 May 2010 21:33:40 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJJ7m-0006QY-0E for namedroppers-data0@psg.com; Tue, 01 Jun 2010 04:30:46 +0000 Received: from [140.186.190.103] (helo=haybaler.sackheads.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJJ7j-0006Pu-Bg for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 04:30:43 +0000 Received: from localhost (localhost.sackheads.org [127.0.0.1]) by haybaler.sackheads.org (Postfix) with ESMTP id 36B5528A63; Tue, 1 Jun 2010 00:30:40 -0400 (EDT) Authentication-Results: haybaler.sackheads.org; domainkeys=pass (testing) header.from=john@sackheads.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275366640; bh=nODsgb0BJqK4cIFA2Ar1ztPXRMjq9FSZuDrJEoWH5wQ=; h=References:Message-Id:From:To:In-Reply-To:Content-Type: Content-Transfer-Encoding:Mime-Version:Subject:Date:Cc; b=NC8zvTRvcodgaJJyHcfHVUXt/mnWw9mzr3ubfwKo943wcxTQ/ke4oztS4Ct3IV8W1 /0sTHT/Du4Px9YUbx5kWab1sHdo5pav9sL/at+kf0g1DkHVsqaiHwSlFsF4a/YTPoa Lci+0YIIoy7oU2jiH4yYIqjzBOHZ6R5dZQukJ0us= Received: from haybaler.sackheads.org ([127.0.0.1]) by localhost (haybaler.sackheads.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RWUQdwyqTlwf; Tue, 1 Jun 2010 00:30:39 -0400 (EDT) Received: by haybaler.sackheads.org (Postfix, from userid 65534) id 6E93C285A4; Tue, 1 Jun 2010 00:30:39 -0400 (EDT) Received: from [192.168.1.15] (c-76-19-188-107.hsd1.ma.comcast.net [76.19.188.107]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: john@sackheads.org) by haybaler.sackheads.org (Postfix) with ESMTP id DA2EA285A2; Tue, 1 Jun 2010 00:30:38 -0400 (EDT) DomainKey-Signature: a=rsa-sha1; s=haybaler; d=sackheads.org; c=nofws; q=dns; h=dkim-signature:references:message-id:from:to:in-reply-to: content-type:content-transfer-encoding:x-mailer:mime-version:subject:date:cc; b=dAKFnJBM0WnENMPUU3B6GuK1KpPyjRWcakRhB61LtwgfIKP3hHzRD5dqcbEjRwIIV SXQcjLCUOR9L4FJo6rzO35rq/mTGe0eYLeXHdCocsAeO/iXq+ek4B7t+I4d4S++eNHV vNoLhwKgUM0qr9mdhu5QpgNvnBytAaE+hyFXNIQ= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sackheads.org; s=haybaler; t=1275366639; bh=nODsgb0BJqK4cIFA2Ar1ztPXRMjq9FSZuDrJEoWH5wQ=; h=References:Message-Id:From:To:In-Reply-To:Content-Type: Content-Transfer-Encoding:Mime-Version:Subject:Date:Cc; b=dONhvj5ciwd+C1vxQd38SHn44lZaCvqNTQym5VzYyb54Oa+9Cm0q0yU6rDnW7Penp hKZP4gONr4KMIbVY8hTtaTe0U+s4wS34vi72G0l7IvRE5rSRDIfxkRPOz3ISYUhOL5 TaNdHc+hPbklEDuzXUQmmwyV8/ofDd6watdlyR6I= References: <201005312334.o4VNY3lN099586@drugs.dv.isc.org> Message-Id: From: John Payne To: Mark Andrews In-Reply-To: <201005312334.o4VNY3lN099586@drugs.dv.isc.org> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable X-Mailer: iPad Mail (7B367) Mime-Version: 1.0 (iPad Mail 7B367) Subject: Re: [dnsext] Personal position on adopting the client-subnet option Date: Tue, 1 Jun 2010 00:30:36 -0400 Cc: =?utf-8?Q?Colm_MacC=C3=A1rthaigh?= , "namedroppers@ops.ietf.org" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On May 31, 2010, at 7:34 PM, Mark Andrews wrote: >=20 > Part of the problem is that caches now go from 1 RRset per name to > 1 RRset per client. That is a fundamental change in design > constraints. Only a problem for a resolver implementing this... And that might not be = a difference in design constraint for some of them.=20 >=20 > Open resolvers get their speed benefit from having a large client > base map to a single cache entry. When you switch to per client > RRsets you defeat that cache benefit. This is very much a balancing > act. I'm going to assume that the authors of this draft are aware of this, = and are willing to trade DNS latency for application latency in some = cases. >=20 > It's also not just the large open resolvers. It's every large ISP > on the planet as well that will be presured to turn this on. > Chicago vs LA for NA ISP's. Sydney vs Perth for Australian ISP's CDNs already ask those ISPs to setup distributed resolvers. Although = they might represent a lot of end users, distributing resolvers improves = general DNS latency for their end users, and provides sufficient = granularity for the "stupid DNS tricks" so they're really not the = audience.=20 >=20 > Also once the code is out there it becomes impossible to retrieve > and impossible to prevent abuse of. It's better not to write the > code in the first place. The first sentence is hard to argue with. The second causes me to say = "I don't believe you wanted to say that"= From owner-namedroppers@ops.ietf.org Mon May 31 21:37:54 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B9A3B3A690B; Mon, 31 May 2010 21:37:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.441 X-Spam-Level: X-Spam-Status: No, score=-0.441 tagged_above=-999 required=5 tests=[AWL=-0.256, BAYES_40=-0.185] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5aCNMWakELN4; Mon, 31 May 2010 21:37:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 82FD63A6844; Mon, 31 May 2010 21:37:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJJBo-0006yO-Av for namedroppers-data0@psg.com; Tue, 01 Jun 2010 04:34:56 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJJBl-0006y0-SU for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 04:34:53 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id AEA27EDC99; Tue, 1 Jun 2010 04:34:52 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o514YoOg004549; Tue, 1 Jun 2010 14:34:50 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <201006010434.o514YoOg004549@drugs.dv.isc.org> To: John Payne Cc: =?utf-8?Q?Colm_MacC=C3=A1rthaigh?= , "namedroppers@ops.ietf.org" From: Mark Andrews References: <201005312348.o4VNmKlT099824@drugs.dv.isc.org> Subject: Re: [dnsext] Personal position on adopting the client-subnet option In-reply-to: Your message of "Tue, 01 Jun 2010 00:23:08 -0400." Date: Tue, 01 Jun 2010 14:34:49 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , John Payne wri tes: > On May 31, 2010, at 7:48 PM, Mark Andrews wrote: > > > > > In message = > , =3D?IS > > O-8859-1?Q?Colm_MacC=3DE1rthaigh?=3D writes: > >> [1] "The mission of the IETF is make the Internet work better by > >> producing high quality, relevant technical documents that influence > >> the way people design, use, and manage the Internet" - IETF mission > >> statement. > > > > This is not a zero cost solution. There are down sides to deploying > > this technology. It will require bigger more complicated caches to > > support the same number of clients. > > When does the IETF limit itself to zero cost solutions? It was being presented as all benefit when it has downsides. Those downsides need to be taken into consideration. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Mon May 31 23:43:36 2010 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F03EF28C14E; Mon, 31 May 2010 23:43:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.552 X-Spam-Level: * X-Spam-Status: No, score=1.552 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vsG01sLXA2-s; Mon, 31 May 2010 23:43:35 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C01E528C140; Mon, 31 May 2010 23:43:34 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJL7K-000Nj4-VB for namedroppers-data0@psg.com; Tue, 01 Jun 2010 06:38:26 +0000 Received: from [195.1.209.33] (helo=bizet.nethelp.no) by psg.com with smtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1OJL7H-000NiB-PE for namedroppers@ops.ietf.org; Tue, 01 Jun 2010 06:38:24 +0000 Received: (qmail 98413 invoked from network); 1 Jun 2010 06:38:20 -0000 Received: from bizet.nethelp.no (HELO localhost) (195.1.209.33) by bizet.nethelp.no with SMTP; 1 Jun 2010 06:38:20 -0000 Date: Tue, 01 Jun 2010 08:38:20 +0200 (CEST) Message-Id: <20100601.083820.74665256.sthaug@nethelp.no> To: namedroppers@ops.ietf.org Subject: Re: [dnsext] latency From: sthaug@nethelp.no In-Reply-To: <24D11D26-0FA0-4537-87C4-CE1912EC9F27@icsi.berkeley.edu> References: <27609.1275323362@nsa.vix.com> <201005312218.o4VMIuFS098771@drugs.dv.isc.org> <24D11D26-0FA0-4537-87C4-CE1912EC9F27@icsi.berkeley.edu> X-Mailer: Mew version 3.3 on Emacs 21.3 / Mule 5.0 (SAKAKI) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Where did CNAME chains come in? > > The latency hit people are worried about is NOT the DNS lookup itself, but the latency to the system who's A record was returned as a valid answer. People are definitely worried about the latency incurred for multiple DNS lookups per web page. These lookups may be due to the way the web page is organized, possibly in combination with CNAME chains. The DNS lookup is only part of the page loading latency, of course - as you have observed the actual TCP session(s) are also extremely important. Steinar Haug, Nethelp consulting, sthaug@nethelp.no