Subject: caching no-delegation 'nxdomains'?

From: bert hubert <[email-masked]>
Date: Sun, 21 Sep 2003 12:48:09 +0200

Hi DNS people,

PowerDNS has now also implemented the ISC 'no-delegation' semantics which, I
must say, are pretty nifty. Thanks, ISC.

This is the brunt of the patch:

if(aabit && d_lwr.d_rcode==RCode::NoError 
   && i->d_place==DNSResourceRecord::ANSWER &&
   arg().contains("delegation-only",auth)) 
{
	LOG<<"NO! Is from delegation-only zone"<<endl;
	return RCode::NXDomain;
}

Not sure if this exactly equals ISC semantics but it appears to work here.

However, I'm wondering now, would it be opportune to negatively cache this
result? 

I haven't yet formed an opinion yet, interested in yours.

Thanks.

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 21 Sep 2003 22:08:26 +0859 ()

Bert;

> Not sure if this exactly equals ISC semantics but it appears to work here.

As I explained, It won't work.

							Masataka Ohta

---

From: Paul Vixie <[email-masked]>
Date: 21 Sep 2003 19:42:13 +0000

[email-masked] (bert hubert) writes:

> PowerDNS has now also implemented the ISC 'no-delegation' semantics
> which, I must say, are pretty nifty. Thanks, ISC.

we've already had to patch our patch, and there's another patch coming.
this whole area turns out to be more subtle than anybody realized.

> ...

we're working on an isc technote to document the specifics, in case other
vendors are interested in our experiences.  naturally, i do not think that
namedroppers will want to adopt this work since it's not really protocol
related.

> However, I'm wondering now, would it be opportune to negatively cache
> this result?
> 

we transform to nxdomain on input, so if goes into the normal rules about
negative caching.  so far, no ill effects have been felt from this, but i
think our negative caching ttl is 5 minutes whereas the controversial
wildcards come out with a 15 minute ttl, so there's no harm to do other
than if one turns off the feature and doesn't do a full server restart
(since the cache, including the negative cache, will still have the old
synthetic negative elements.)
-- 
Paul Vixie
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: Paul Vixie <[email-masked]>
Date: 21 Sep 2003 19:46:43 +0000

> As I explained, It won't work.

there are two ways of looking at it.  if this were information warfare and
if gtld registries were determined to frustrate the expressed and explicit
desires of a subset of resolver owners, then you're right, it won't work.

however, verisign's position is that "users are free to block site-finder
if they don't want it", and in that sense, the patch will work.  then there's
my log file for .COM alone in the last two hours, which claims:

Sep 21 17:51:36 named: enforced delegation-only for 'com' (hotmail2037.com/A/IN)
Sep 21 17:51:36 named: enforced delegation-only for 'com' (hotmail2037.com/AAAA/IN)
Sep 21 18:06:55 named: enforced delegation-only for 'com' (jachinit.com/A/IN)
Sep 21 18:06:55 named: enforced delegation-only for 'com' (jachinit.com/AAAA/IN)
Sep 21 18:07:02 named: enforced delegation-only for 'com' (mcconnll.com/A/IN)
Sep 21 18:07:03 named: enforced delegation-only for 'com' (mcconnll.com/AAAA/IN)
Sep 21 18:20:59 named: enforced delegation-only for 'com' (azal.com/A/IN)
Sep 21 18:20:59 named: enforced delegation-only for 'com' (azal.com/AAAA/IN)
Sep 21 18:21:09 named: enforced delegation-only for 'com' (compactl.com/A/IN)
Sep 21 18:21:10 named: enforced delegation-only for 'com' (compactl.com/AAAA/IN)
Sep 21 18:40:09 named: enforced delegation-only for 'com' (infeasib.com/A/IN)
Sep 21 18:40:09 named: enforced delegation-only for 'com' (infeasib.com/AAAA/IN)
Sep 21 18:55:45 named: enforced delegation-only for 'com' (hotmail2436.com/A/IN)
Sep 21 18:55:45 named: enforced delegation-only for 'com' (hotmail2436.com/AAAA/IN)
Sep 21 19:04:55 named: enforced delegation-only for 'com' (jacs5074.com/A/IN)
Sep 21 19:04:55 named: enforced delegation-only for 'com' (jacs5074.com/AAAA/IN)
Sep 21 19:13:24 named: enforced delegation-only for 'com' (cta550.com/A/IN)
Sep 21 19:13:25 named: enforced delegation-only for 'com' (cta550.com/AAAA/IN)
Sep 21 19:13:31 named: enforced delegation-only for 'com' (cta682.com/A/IN)
Sep 21 19:13:31 named: enforced delegation-only for 'com' (cta682.com/AAAA/IN)
Sep 21 19:19:37 named: enforced delegation-only for 'com' (sdaf34539d.com/A/IN)
Sep 21 19:19:37 named: enforced delegation-only for 'com' (sdaf34539d.com/AAAA/IN)
Sep 21 19:21:02 named: enforced delegation-only for 'com' (3450dfc.com/A/IN)
Sep 21 19:21:02 named: enforced delegation-only for 'com' (3450dfc.com/AAAA/IN)

that was spam that i didn't get because of the root-delegation-only feature
we added in BIND this week.  so, at at least this level, "it will work."
-- 
Paul Vixie
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: "D. J. Bernstein" <[email-masked]>
Date: 21 Sep 2003 21:28:12 -0000

Paul Vixie writes:
> if this were information warfare

It's simple economics. See http://cr.yp.to/qmail/antispam.html.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.