Subject: [idn] How should labels be encoded?

From: Dan Oscarsson <[email-masked]>
Date: Mon, 30 Jul 2001 11:13:46 +0200 (MEST)

The IDNA (ACE+nameprep) discussions have been focused on how to
encode "host names" to be used in DNS.

In DNS there are records that have an owner name and can include
names and text elements. All names are composed of labels.
A label is today maximum 63 bytes and can contain any character.
RFC 2181 defines that the DNS protocol and servers may not
restrict the characters that may be used in a label. But an
application can.

IDNA defines that a "host name" is to be nameprepped and ACEd before
being sent into the DNS protocol. As using nameprep results in
some characters being forbidden, it cannot be used as a general
mechanism on all labels.

So now my question is: how should the labels in the DNS protocol
be encoded? 
Which labels are "host names"?
The SOA record contains one that is an e-mail address.
The SRV record has an owner name that represents a protocol.
Also not every thing which has an IP-address is a "host".
As DNS is more than "host names", how are labels that are not
"host names" to be encoded when non-ASCII is used?

IDNA does not answer this and it does not define which labels
are "host names" and must be ACE+nameprep encoded.
It can happen that one application thinks a label in a
DNS record is a host names, and another application uses it
as something else (using some other encoding that ACE+nameprep).

There is a possibility of difficulties here.

   Dan

---

From: "Adam M. Costello" <[email-masked]>
Date: Tue, 31 Jul 2001 06:32:16 +0000

> The SOA record contains one that is an e-mail address.

Not a problem.  RFC 1035 tells how to represent an email address as
a domain name:  Prepend the local-part as a single label to the mail
domain.  IDNA affects the mail domain part, but not the local-part.  If
and when a working group forms to specify internationalized local-parts,
they will decide how to handle it here.  Until then, local-parts follow
the same rules as they do today, so there's nothing new to worry about
here.

> The SRV record has an owner name that represents a protocol.

Sorry, I'm not familiar with SRV, but perhaps the same argument would
apply.  Until some other working group specifies internationalized
owner-names (whatever those are), there's nothing new to be done here.

> Also not every thing which has an IP-address is a "host".

I'm not sure what you have in mind.  What's an example of something with
an IP address that's not a host?

> As DNS is more than "host names", how are labels that are not "host
> names" to be encoded when non-ASCII is used?
>
> IDNA does not answer this and it does not define which labels are
> "host names" and must be ACE+nameprep encoded.  It can happen that
> one application thinks a label in a DNS record is a host names, and
> another application uses it as something else (using some other
> encoding that ACE+nameprep).

IDNA says how to represent the labels of domain names.  It has nothing
to say about how to represent labels that are not labels of domain
names (that would be out-of-scope for IDN).  Not every sequence of
labels is a domain name; a domain name is the name of a domain.  When
amc.cs.berkeley.edu appears in an SOA record, amc.cs.berkeley.edu
is *not* a domain name, because it does not name a domain.  It is a
sequence of labels, the first of which is the local-part of an email
address.  The remaining labels form a domain name, and IDNA would apply
to them.

Maybe this is not clear enough in the IDNA draft, but I have no doubt
that this is the intention.

Maybe part of the confusion is that RFC 1035 uses the notation
<domain-name> to mean any sequence of labels, even when it's not really
a domain name.

AMC

---

From: David Hopwood <[email-masked]>
Date: Tue, 31 Jul 2001 20:32:13 +0100

-----BEGIN PGP SIGNED MESSAGE-----

> So now my question is: how should the labels in the DNS protocol

RFC 2181 forces the answer to that: they are 8-bit clean binary.
They can also be interpreted as text at the edges of DNS, i.e. when
preparing a name to be resolved, and when comparing against a zone
file. (What encoding is used when interpreting them as non-ASCII text
is obviously not decided yet.)

> Which labels are "host names"?

That is defined by the application protocol.

> The SOA record contains one that is an e-mail address.

Since the local part of an email address is internationalizable text,
and is subject to exactly the same compatibility and normalization
considerations as domain names, it should use the same encoding as
domain names, IMHO.

> The SRV record has an owner name that represents a protocol.

The encoding of the protocol name is defined by RFC 2782. Since it is
ASCII ('_' followed by an LDH identifier), it is not affected by ACE
encoding or nameprep. So even though the protocol name is not
internationalizable, it won't matter if something applies ACE and/or
nameprep to it.

This does make clear, however, that it is not correct for a general
purpose resolver interface to reject non-LDH ASCII characters; instead,
it should pass through such characters (if no non-LDH characters are
used in that domain, the query will simply fail).

> Also not every thing which has an IP-address is a "host".

That doesn't matter. Any domain name can map to zero or more IP
addresses. Normally there should be a machine at each address that
satisfies the requirements on hosts (RFCs 1122 & 1123), but if there
isn't, that is no concern of DNS.

> "host names" to be encoded when non-ASCII is used?

If the protocol that uses DNS defines the label to be binary, or
some type of identifier that does not need to be internationalized,
its interpretation should stay exactly as it is. If it defines the
label to be internationalizable text, the obvious design decision
would be to use the same encoding as for host names.

> as something else (using some other encoding that ACE+nameprep).

I don't see any situation where this would happen in practice,
although I may be missing something. Are there any protocols that
currently allow text DNS labels in some 8-bit encoding other than
ASCII, or labels that are likely to be confused with an ACE encoding?
(SRV and SOA don't pose any problems in this respect. Is there an
exhaustive list of DNS RRs and query types anywhere?)

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

---

From: "Adam M. Costello" <[email-masked]>
Date: Tue, 31 Jul 2001 21:45:56 +0000

> considerations as domain names, it should use the same encoding as

This working group is not the place to decide how to internationalize
email address local-parts.  Local-parts do not have exactly the same
compatibility and normalization considerations as domain names: they
may contain non-LDH ASCII characters, they may be case-sensitive, and
they may be structured using separators other than "." (for example,
owner-FOO and FOO-request and FOO+TAG are common constructions that have
particular relationships to FOO).  I once tried to start discussing this
issue and was told (correctly) that it's off-topic for this working
group.

> purpose resolver interface to reject non-LDH ASCII characters;
> instead, it should pass through such characters (if no non-LDH
> characters are used in that domain, the query will simply fail).

You seem to be confusing queries and responses, or domain names and
resource records.  Currently, all domain names (which are the things
that appear in queries) are advised to use the preferred name syntax
(LDH characters in labels).  The resource records (the things that
appear in responses, like SOA and SRV data) already contain non-LDH
characters, and of course they are not rejected for that.  Some resource
records contain domain names (like CNAME and PTR) but some contain
other things.  The mailbox field of the SOA record, even though it is
formatted as a sequence of labels, is not a domain name and is not
expected to conform to the preferred name syntax (although after you
chop off the first label, the result is a domain name and is expected to
conform).  I gather than the same is true of the SRV record.

AMC