Subject: [DNSOP] Fwd: New Version Notification for draft-wkumari-dnsop-omniscient-as112-03.txt

From: Warren Kumari <[email-masked]>
Date: Fri, 21 Jun 2013 11:25:25 -0400

Hi there all,

We have incorporated consensus from the Orlando meeting (and ML discussions). We have also fleshed this out with e batter overview section, an explanation of why DNSSEC doesn't happen with AS112, etc.

We have requested that the DNSOP chairs adopt this version.

Things that requite more discussions:
1: Is DNAME a viable alternative?
There are pros and cons here -- a better understanding of DNAME support, it may be simpler to just delegate to AS112, etc.
2: Metazones - having a generic DNS sinkhole may be useful for all sorts of things.
3:  Delegating things other than PTR -- we have discussed this in person and it is mentioned in the draft, but perhaps we need more text on using Omniscient AS112 for blackholing things like .belkin / malware..

W

Begin forwarded message:

> From: [email-masked]
> Subject: New Version Notification for draft-wkumari-dnsop-omniscient-as112-03.txt
> Date: June 20, 2013 8:01:18 PM EDT
> To: William F. Maton Sotomayor <[email-masked]>, Ray Bellis <[email-masked]>, William F. M Sotomayor <[email-masked]>, Joe Abley <[email-masked]>, Warren Kumari <[email-masked]>
> 
> 
> A new version of I-D, draft-wkumari-dnsop-omniscient-as112-03.txt
> has been successfully submitted by Warren Kumari and posted to the
> IETF repository.
> 
> Filename:	 draft-wkumari-dnsop-omniscient-as112
> Revision:	 03
> Title:		 Omniscient AS112 Servers
> Creation date:	 2013-06-21
> Group:		 Individual Submission
> Number of pages: 14
> URL:             http://www.ietf.org/internet-drafts/draft-wkumari-dnsop-omniscient-as112-03.txt
> Status:          http://datatracker.ietf.org/doc/draft-wkumari-dnsop-omniscient-as112
> Htmlized:        http://tools.ietf.org/html/draft-wkumari-dnsop-omniscient-as112-03
> Diff:            http://www.ietf.org/rfcdiff?url2=draft-wkumari-dnsop-omniscient-as112-03
> 
> Abstract:
>   The AS112 Project loosely coordinates Domain Name System (DNS)
>   servers to which DNS zones corresponding to private use addresses are
>   delegated.  Queries for names within those zones have no useful
>   responses in a global context.  The purpose of this project is to
>   reduce the load of such junk queries on the authoritative name
>   servers that would otherwise receive them, and instead direct the
>   load to name servers operated within the AS112 project.
> 
>   Due to the loosely-coordinated nature of the project, adding and
>   dropping zones from the AS112 servers is difficult.  This document
>   proposes a mechanism by which AS112 name servers could answer
>   authoritatively for all possible zones.  This eliminates the add/drop
>   problem, changing it to a matter of delegation within the DNS and
>   requiring no operational changes on the servers themselves.
> 
>   This document updates RFC 6304.
> 
> 
> 
> 
> The IETF Secretariat
> 

--
It's a mistake trying to cheer up camels. You might as well drop meringues into a black hole. -- Terry Prachett

---

From: Joe Abley <[email-masked]>
Date: Mon, 24 Jun 2013 14:01:47 -0400

> 1: Is DNAME a viable alternative?

I think it is. I found Brian Dickson's suggestion on this list quite compelling. Some experimentation is likely required to characterise the impact of that approach with and without DNAME-aware resolvers and authority-only servers, and I think that work is worth doing.

I'd be very happy to work with Brian (assuming he's interested; I haven't talked to him) and write this up as a second option.

Joe

---

From: Warren Kumari <[email-masked]>
Date: Mon, 24 Jun 2013 17:12:10 -0400

On Jun 24, 2013, at 2:01 PM, Joe Abley <[email-masked]> wrote:

> I think it is. I found Brian Dickson's suggestion on this list quite compelling.

Yup. It is definitely worth investigating more...

> Some experimentation is likely required to characterise the impact of that approach with and without DNAME-aware resolvers and authority-only servers, and I think that work is worth doing.
> 

Also yup.
This would require some experimentation to make sure that it works under most / all cases, and a better understanding of how widely deployed DNAME support is. 
There were some studies into DNAME support a while back, things have gotten better since then (I'd assume!).

> I'd be very happy to work with Brian (assuming he's interested; I haven't talked to him) and write this up as a second option.

Great. We could:
A: replace the current method outlined in draft-wkumari-dnsop-omniscient-as112-03 with DNAME.
B: have two methods described in one draft or
C: have two drafts, each describing an option.

W 

-- 
"I think it would be a good idea." 
- Mahatma Ghandi, when asked what he thought of Western civilization

---

From: Joe Abley <[email-masked]>
Date: Mon, 24 Jun 2013 18:55:59 -0400

> C: have two drafts, each describing an option.

I heard from Brian; we have a draft nearly ready to post, I would say. So I guess option C, to be followed by lively debate. :-)

Joe