Subject: Re: [dnssd] A concrete example of the Punycode fallback variants for the <Domain> portion

From: Stuart Cheshire <[email-masked]>
Date: Wed, 22 Jan 2014 21:30:24 -0800

On 15 Dec, 2013, at 07:53, Andrew Sullivan <[email-masked]> wrote:

> On Sun, Dec 15, 2013 at 02:15:15PM +0200, Ilya Kulakov wrote:
> 
>> If I have domain is ‘my.домен.рф.’ what are the fallback variants? Should I try every combination:
>> ‘my.домен.рф.’
>> ‘my.домен.xn--p1ai.’
>> ‘my.xn--d1acufc.рф.’
>> ''my.xn--d1acufc.xn--p1ai.’
> 
> This is the only correct answer.  You have to cover all possible
> combinations.  However, the text doesn't read that way.  It reads as
> though you start label by label:
> 
>> Or I should avoid “gaps”:
>> ‘my.домен.рф.’
>> ‘my.домен.xn--p1ai.’
>> ''my.xn--d1acufc.xn--p1ai.’

I realise you may not agree with the design, but the text reads the way it does intentionally, and, yes, the intent is that you do go label by label, starting at the right.

We wanted a simple linear algorithm, not an n^2 algorithm. And, like many engineering decisions, that design decision comes with trade offs. The benefit is that it’s a simple linear search. The consequence is that it constrains the choice of names. We felt that constraint was reasonable.

1. Users want rich text for instance names, so they want UTF-8 instance names, not Punycode, because Punycode doesn’t even allow simple things like spaces (remember the days when DOS filenames couldn’t even have spaces in them?).

2. Top-level and second-level domains are likely to be Punycode.

So, in any given FQDN, it’s likely that Punycode labels will be closer to the root, and UTF-8 labels will be closer to the leaves.

The algorithm works like this:

1. Upon receiving NXDOMAIN, examine the name in question. Starting at the root, examine each label in turn, looking for the first label that’s not composed of letters, digits, and hyphens. Possible outcomes:
2. No such non-LDH label found. Return NXDOMAIN to caller.
3. A non-LDH label is found. Convert it to Punycode, if possible. If not possible, return NXDOMAIN to caller, else
4. Repeat query with this UTF-8 label converted to Punycode. If you get another NXDOMAIN, goto 1.

This simple algorithm stores minimal state (just the name currently being queried for). Any organisation is free to use either Punycode or UTF-8 labels, as long as the name delegated to them is either LDH or Punycode — which is always the case today, and I expect to remain the case. The constraint is that if your parent organisation has decided to delegate a UTF-8 name to you, then you also have to use UTF-8 downstream of that delegation. I don’t foresee this becoming a realistic problem, which is why the simple linear algorithm was chosen.

Stuart Cheshire