Subject: The case against A6 and DNAME

From: "D. J. Bernstein" <[email-masked]>
Date: 7 Feb 2001 08:56:16 -0000

I recommend that the A6 and DNAME proposals be terminated. I've set up a
web page on this topic:

   http://cr.yp.to/djbdns/killa6.html

---Dan
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Ignatios Souvatzis <[email-masked]>
Date: Wed, 7 Feb 2001 11:07:15 +0100

>    http://cr.yp.to/djbdns/killa6.html

Yes, read, and understood.

How is the example you show different from what is warned against in
RFC 2874, paragraph 5.1.2 ?

OTOH, if you want to eliminate protocol-(cache-) level indirection
altogether, (including CNAMEs (and NS) records pointing to names),
you'd need to write a draft of all of it up. (This includes an
address-valued NS replacement.)

And by providing a formal description of how the servers resolve the
indirections, and how renaming has to happen if this is implemented, we
will be able to check whether this will work, and what requirements are
needed to make this work (e.g., how to ensure convergence when renaming
or renumbering happens for one of the components). I'm not yet convinced
that moving the indirection from the caches to the servers helps in all
cases.

Regards,
	-is

---

From: David Harmelin <[email-masked]>
Date: Wed, 07 Feb 2001 17:21:35 +0000

Dan,

In your "AOL committing A6 suicide" scenario, you describe how the 
protection against poison may break A6 chains.

Now, what if AOL did configure verything like this:

>    http://cr.yp.to/djbdns/killa6.html

___________________________________________________________________
             * *         David Harmelin  	Network Engineer
           *     *				DANCERT Representative
          *              Francis House
         *               112 Hills Road       Tel +44 1223 302992
         *               Cambridge CB2 1PQ    Fax +44 1223 303005
      D  A  N  T  E      United Kingdom       WWW http://www.dante.net
____________________________________________________________________

---

From: David Harmelin <[email-masked]>
Date: Wed, 07 Feb 2001 17:40:24 +0000

(hm.. apparently hit the wrong button in the previous mail)

Dan,

Now, what would happen if AOL did configure everything like this:

For its aol.net zone:
dns-01.ns.aol.com A6 ... prefix.aol.com
dns-02.ns.aol.com A6 ... prefix.aol.com
prefix.aol.com A6 <prefix1>

For its aol.com zone:
dns-01.ns.aol.net A6 ... prefix.aol.net
dns-02.ns.aol.net A6 ... prefix.aol.net
prefix.aol.net A6 <prefix1>

(same prefix1)

My point is, if poison is susceptible of breaking A6 chains, DNS admins 
(possibly enforced by the DNS server implementation) should make sure that 
locally, A6 chains are defined under the same domain.

In the case above, dns-01.ns.aol.com and dns-01.ns.aol.net could even lead 
to the same IPv6 address, if AOL wants to maintain their .net and .com 
servers on the same machine.

Now it does require more records to define/maintain/..

Best regards,

DH.

---

From: "D. J. Bernstein" <[email-masked]>
Date: 7 Feb 2001 18:13:50 -0000

> prefix.aol.com A6 <prefix1>

Right. In-bailiwick A6 records don't trigger the reliability problems.
But then why bother with A6? Use AAAA.

---Dan

---

From: "Ed McKnight" <[email-masked]>
Date: Wed, 7 Feb 2001 10:08:35 -0800

---

From: [email-masked]
Date: Thu, 08 Feb 2001 10:27:03 +1100

Someone hand me a clue bat.

	Read the bottom of this message.

	Mark

--
Mark Andrews, Nominum Inc.
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Ian Jackson <[email-masked]>
Date: Thu, 8 Feb 2001 01:00:09 +0000 (GMT)

>    http://cr.yp.to/djbdns/killa6.html

As I've stated before, I strongly agree.  I asked here what the
purpose of A6 and DNAME are, and the end result has been that we're
told that they're a fancy macro scheme to save zone administrators
having to write trivial perl scripts.

Ian.

---

From: Nathan Lutchansky <[email-masked]>
Date: Wed, 7 Feb 2001 22:19:43 -0500

> having to write trivial perl scripts.

FWIW, I agree too.  The DNS system is already struggling with too many
poorly-configured zones and too much gluelessness to handle increasing 
indirection by two or three fold.

The argument that A6 avoids signature problems with DNSSEC does not
provide a suitable incentive to adopt A6, as a renumbering event is likely
to require significant administrative work anyway, albeit less than IPv4
renumbering.

However, if A6 and DNAME become the standard when IPv6 takes off
commercially, either it will work or it won't.  If it causes problems, as
Dan predicts, people will simply revert to AAAA records in their zones.  
Unlike NS/MX indirection, there is an alternative to A6/DNAME.  -Nathan

-- 
+-------------------+---------------------+------------------------+
| Nathan Lutchansky | [email-masked] |  Lithium Technologies  |
+------------------------------------------------------------------+
|  I dread success.  To have succeeded is to have finished one's   |
|  business on earth...  I like a state of continual becoming,     |
|  with a goal in front and not behind. - George Bernard Shaw      |
+------------------------------------------------------------------+
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Matt Crawford" <[email-masked]>
Date: Thu, 08 Feb 2001 08:13:19 -0600

> having to write trivial perl scripts.

Oh, who told "us" that?

---

From: "Matt Crawford" <[email-masked]>
Date: Thu, 08 Feb 2001 08:35:06 -0600

> Dan predicts, people will simply revert to AAAA records in their zones.  

You don't even need to worry about the transition reaching the point
where some servers or clients drop support for AAAA -- A6 records can
be use like AAAA with one waste byte.

And as long as you don't ditch DNAME + binary labels, you can put
your reverse data in the same zone.  Now there's a job for a perl
script.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------