Subject: [DNSOP] I-D Action: draft-ietf-dnsop-refuse-any-02.txt

From: [email-masked]
Date: Mon, 25 Jul 2016 03:38:41 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations of the IETF.

        Title           : Providing Minimal-Sized Responses to DNS Queries with QTYPE=ANY
        Authors         : Joe Abley
                          Olafur Gudmundsson
                          Marek Majkowski
	Filename        : draft-ietf-dnsop-refuse-any-02.txt
	Pages           : 9
	Date            : 2016-07-21

Abstract:
   The Domain Name System (DNS) specifies a query type (QTYPE) "ANY".
   The operator of an authoritative DNS server might choose not to
   respond to such queries for reasons of local policy, motivated by
   security, performance or other reasons.

   The DNS specification does not include specific guidance for the
   behaviour of DNS servers or clients in this situation.  This document
   aims to provide such guidance.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-refuse-any/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-dnsop-refuse-any-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-refuse-any-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Ólafur Guðmundsson <[email-masked]>
Date: Mon, 25 Jul 2016 09:37:06 -0400

This version contains minor text and structure improvements suggested by
TimW.

Editors think the document is ready for WGLC

Olafur

On Mon, Jul 25, 2016 at 6:38 AM, <[email-masked]> wrote:

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Tony Finch <[email-masked]>
Date: Tue, 26 Jul 2016 15:29:51 +0100

I have given it anothre read through and it looks good.

Maybe section 7 should be titled "No changes to RFC 1035" ?

Maybe make it a bit more clear that my implementation successfully
mitigated the attack? :-)

Would it be worth adding a section on responding to RRSIG queries?
(Cloudflare REFUSEs; BIND 9.11 will minimize similar to ANY)

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/  -  I xn--zr8h punycode
Viking, North Utsire, South Utsire, Northeast Forties: Westerly or
southwesterly 4 or 5, becoming cyclonic 5 to 7 later. Slight or moderate.
Showers, rain later. Good, becoming moderate or poor later.

---

From: Matthew Pounsett <[email-masked]>
Date: Tue, 26 Jul 2016 11:09:01 -0400

> Editors think the document is ready for WGLC

I'd agree.  A comment though:

I missed this earlier, but in 2. Motivations, third paragraph... between
-00 and -01 the phrase "a DNS operator MAY prefer not to send large ANY
responses" appeared.  Since that modifies the feelings of the operator, not
their actions, is that really an RFC 2119 "MAY"?  I'd suggest either
lower-casing the MAY, or change the sentence to something like:
"If a DNS operator prefers to reduce the potential for information leaks,
they MAY choose not to send large ANY responses."

Grammar nit:
§3, paragraph 4:  "This proposal specifies two different modes of behaviour
by DNS responders, for names that exists." should probably be "This
proposal specifies two different modes of behaviour by DNS responders for
names that exist." (drop the comma and make the tense of the verb agree)