Subject: Re: (ngtrans) The reverse lookup issue

From: Bruce Campbell <[email-masked]>
Date: Wed, 3 Jul 2002 23:53:07 +0200 (CEST)

On Wed, 3 Jul 2002, Louis A. Mamakos wrote in reply to Christian Huitema:

> > So, my question is, do we really need to invest in a reverse lookup DNS
> > tree for IPv6? Or should we not just "declare victory" and recognize
> > that reverse lookup has very little practical value?
>
> I think that about a decade ago (or so I it seems..) I suggested that
> we abandon the notion of using the DNS to do address->name lookups.

> Rather, define a simple standard service where a host can be asked
> what it thinks it's name is.  In many cases, this does the "right

If you wish 'simple', you may as well use something very much akin to
ident(1431), or indeed, overload the existing ident protocol with a
slightly different request and answer.  Not that I'm seriously suggesting
that.

> thing" in that you get a meaningful name at the time that the
> address was allocated to someone (e.g., out of a DHCP pool or other
> transient network connection.)

As DNS operational folk have seen (MS, ddns by default), if you give the
user the ability to define their own name, they will attempt to declare
themselves to be 'all.high.and.mighty', and I really wouldn't like to see
that sort of string appearing in my access logs.

> Sure, you can't "trust" this name.  Just like you can't really trust
> the one in DNS PTR records, either.

If you wish vaguely reliable, you've got the existing (reverse) DNS at the
administrative mercies of providers/hopefully clued users.  Most PTR
records, if available, do have some sort of relationship to the
responsible person behind the host.

> Or simply decide the practical value is small.

The practical value of address to name mapping is large for the site
administrator; 'What is the host behind this IP address?'.  If the host in
question has been compromised, you can no longer trust _anything_ from
that host.  Hence, a requirement for address to name mapping does exist.
DNS, so far, appears to work in providing that functionality.

People outside your site may have policies (sometimes poorly thought out)
that require you to provide some level of address to name mapping.  This
may or may not alter your liking of doing such.

Regards,

--==--
Bruce.

Speaking for myself.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "John M. Brown" <[email-masked]>
Date: Wed, 3 Jul 2002 18:27:29 -0600

yet if the host you are asking has been compromised then
it could give back an invalid name.   whereas the in-addr
tree is typically managed one or more levels above the
host, and often by a different party.  thus two or
more systems would have to be compromised.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Louis
> A. Mamakos
> Sent: Wednesday, July 03, 2002 1:36 PM
> To: Christian Huitema
> Cc: [email-masked]; [email-masked]
> Subject: Re: (ngtrans) The reverse lookup issue
>
>
> [ post by non-subscriber.  with the massive amount of spam,
> it is easy to
>   miss and therefore delete mis-posts.  so fix subscription
> addresses! ]
>
> louie