Subject: Re: [DNSOP] AS112 for TLDs

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Mon, 3 Dec 2007 13:44:56 -0500 (EST)

On Tue, 27 Nov 2007, Stephane Bortzmeyer wrote:

> I cannot find another report about the TLDs most often queried at a
> root name server. Other reports I've seen aggregated data, while this
> small glimpse, however partial, at least *names* the TLDs.
>
> All the non-existing TLDs queried are local domains (such as Apple's
> ".local"), leaking through a configuration error. This looks like a
> job for AS112.

I think it very may well be suited to that task, but are we crossing a 
line here that may result down a path we might regret later on.  I think 
what would need to be worked out is what criteria would be used to declare 
a local or nonsense domain, nonsense or junk, and have that suitably 
delegated to AS112.  It could go ad infinitum (ever word in every 
language), or it could be we need to take whatever floats to the top 25 
of a domain lookup chart.  Of course, someone needs to determine what 
makes a good sample to create that statistic.

>
> http://blog.icann.org/?p=240
>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dnsop
>

wfms

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Mon, 3 Dec 2007 13:44:56 -0500 (EST)

wfms

---

From: Phil Regnauld <[email-masked]>
Date: Mon, 3 Dec 2007 20:52:32 +0100

William F. Maton Sotomayor (wmaton) writes:
> 
>  I think it very may well be suited to that task, but are we crossing a line 
>  here that may result down a path we might regret later on.  I think what 
>  would need to be worked out is what criteria would be used to declare a 
>  local or nonsense domain, nonsense or junk, and have that suitably delegated 
>  to AS112.  It could go ad infinitum (ever word in every language), or it 
>  could be we need to take whatever floats to the top 25 of a domain lookup 
>  chart.  Of course, someone needs to determine what makes a good sample to 
>  create that statistic.

	The first step is to decide whether delegating to AS112 is reserved
	to standardized (read: RFC) zones, like RFC1918, 169.254, etc..., or
	whether anything sufficiently large -- and bogus -- is sufficient.

	.local fits the latter criteria.  But yes, it does make the requirement
	criteria more fuzzy.

---

From: Phil Regnauld <[email-masked]>
Date: Mon, 3 Dec 2007 20:52:32 +0100

---

From: Brian Dickson <[email-masked]>
Date: Mon, 03 Dec 2007 12:57:23 -0800

William F. Maton Sotomayor wrote:
> line here that may result down a path we might regret later on.  I 
> think what would need to be worked out is what criteria would be used 
> to declare a local or nonsense domain, nonsense or junk, and have that 
> suitably delegated to AS112.  It could go ad infinitum (ever word in 
> every language), or it could be we need to take whatever floats to the 
> top 25 of a domain lookup chart.  Of course, someone needs to 
> determine what makes a good sample to create that statistic.
>
I wonder if it is even necessary to enumerate/instantiate the junk TLDs?

Given that root servers have (by definition) *the* authoritative list of 
TLDs, everything else is junk.

Would not it make sense to put in wildcard delegations to AS112?

What are the pros/cons of this, other than the obvious offloading of 
junk TLD lookups?

Brian

---

From: Brian Dickson <[email-masked]>
Date: Mon, 03 Dec 2007 12:57:23 -0800

Brian

---

From: Mark Andrews <[email-masked]>
Date: Tue, 04 Dec 2007 08:36:06 +1100

> 	.local fits the latter criteria.  But yes, it does make the requirement

	We should be looking at mechanisms to allow the root zone to
	be distributed to every iterative resolver in the world.

	You then don't have to use AS112 to absorb the load.  The local
	resolver will answer the query.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mark Andrews <[email-masked]>
Date: Tue, 04 Dec 2007 08:36:06 +1100

Mark

---

From: Joe Baptista <[email-masked]>
Date: Mon, 03 Dec 2007 17:42:44 -0500

>	resolver will answer the query.

For the last two years we have been advocating just that.  Root should 
be broadly distributed.  But even with that AS112 would still be needed 
to redirect some errors.  If only ICANN used AS112 to redirect bogus 
request they would see less of a load.  Right now AS112 is mainly 
available to those who willing participate.  Not many do.  Not many know 
about AS112.

regards
joe baptista

-- 
Joe Baptista                                www.publicroot.org
PublicRoot Consortium
----------------------------------------------------------------
The future of the Internet is Open, Transparent, Inclusive,
Representative & Accountable to the Internet community @large.
----------------------------------------------------------------
  Office: +1 (202) 517-1593
     Fax: +1 (509) 479-0084

---

From: Joe Baptista <[email-masked]>
Date: Mon, 03 Dec 2007 17:42:44 -0500

regards
joe baptista

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 04 Dec 2007 08:13:20 +0900

> 	be distributed to every iterative resolver in the world.

Zone transfer is the mechanism.

> 	resolver will answer the query.

It will be an interesting experiment to let AS112 nameservers offer
root zone transfer for any client.

							Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 04 Dec 2007 08:13:20 +0900

Masataka Ohta

---

From: "Elmar K. Bins" <[email-masked]>
Date: Tue, 4 Dec 2007 09:24:36 +0100

> root zone transfer for any client.

Would certainly boost the MegBit of traffic the box here pushes...
I'm not certain if this wouldn't necessitate an upgrade ;)

Elmar.

-- 

"Hinken ist kein Mangel eines Vergleichs, sondern sollte als wesentliche
 Eigenschaft von Vergleichen angesehen werden."       (Marius Fränzel in desd)

--------------------------------------------------------------[ ELMI-RIPE ]---

---

From: "Elmar K. Bins" <[email-masked]>
Date: Tue, 4 Dec 2007 09:24:36 +0100

Elmar.

--

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 4 Dec 2007 17:28:20 +0100

On Mon, Dec 03, 2007 at 01:44:56PM -0500,
 William F. Maton Sotomayor <[email-masked]> wrote 
 a message of 35 lines which said:

> I think what would need to be worked out is what criteria would be
> used to declare a local or nonsense domain, nonsense or junk, and
> have that suitably delegated to AS112.

IETF Consensus? Expert review? :-)

> or it could be we need to take whatever floats to the top 25 of a
> domain lookup chart.

That's certainly the good way and that's why I pointed to such a chart
at the beginning of this thread.

> Of course, someone needs to determine what makes a good sample to
> create that statistic.

IMHO, it (this determination) could be outsourced to the root name
servers operators. The distribution of these broken domain names is
exponential with a fast decay. So, even adding only the first two or
three would handle most of the problem.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 4 Dec 2007 17:28:20 +0100

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 4 Dec 2007 12:59:49 -0500 (EST)

> 	whether anything sufficiently large -- and bogus -- is sufficient.

Step 0 of course is to get the as112 docs moving. :-)

wfms

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 4 Dec 2007 12:59:49 -0500 (EST)

wfms

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 4 Dec 2007 13:03:54 -0500 (EST)

> three would handle most of the problem.

Since AS112 is part of the Root Server Technical Operations Assn, then 
getting the root server operators to provide feedback to AS112 (and I 
guess someone arranging for the delegation thereof) of what junk zones 
need to be dealt with makes sense.  I don't know if this needs to be 
formalized in an expanded draft of the current ops document, or not (I 
think the floor is open on that one for comments).

wfms

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 4 Dec 2007 13:03:54 -0500 (EST)

wfms

---

From: Mark Andrews <[email-masked]>
Date: Wed, 05 Dec 2007 05:19:33 +1100

> think the floor is open on that one for comments).

This is using a hammer as a screwdriver.

---

From: Mark Andrews <[email-masked]>
Date: Wed, 05 Dec 2007 05:19:33 +1100

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 4 Dec 2007 13:23:36 -0500 (EST)

> This is using a hammer as a screwdriver.

:-)

then let's leave these alone for wglc.

wfms

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 4 Dec 2007 13:23:36 -0500 (EST)

:-)

wfms

---

From: Edward Lewis <[email-masked]>
Date: Tue, 4 Dec 2007 16:34:47 -0800

At 12:57 -0800 12/3/07, Brian Dickson wrote:

>What are the pros/cons of this, other than the obvious offloading
>of junk TLD lookups?

 From http://www.nanog.org/mtg-0310/pdf/wessels.pdf:

See (unnumbered) slide "Punchline from Last Year's Talk":

Category            Percent of Total (see slide for all cat's)
Unknown TLD          12.5
...
Legitimate            2.15

Of course, that is 2002/2003 data.

6:1 "bad TLD" to "good query."  Off-loading bad TLDs from the roots 
is a big win.  As with any research citation, I encourage readers to 
look it up too - to see if you agree with what I yanked out.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Think glocally.  Act confused.

---

From: Edward Lewis <[email-masked]>
Date: Tue, 4 Dec 2007 16:34:47 -0800

---

From: Edward Lewis <[email-masked]>
Date: Tue, 4 Dec 2007 16:34:47 -0800

---

From: Mohsen Souissi <[email-masked]>
Date: Wed, 5 Dec 2007 02:28:53 +0100

On 03 Dec, Brian Dickson wrote:
 | I wonder if it is even necessary to enumerate/instantiate the junk TLDs?
 | 
 | Given that root servers have (by definition) *the* authoritative list of 
 | TLDs, everything else is junk.
 | 
 | Would not it make sense to put in wildcard delegations to AS112?
 | 
 | What are the pros/cons of this, other than the obvious offloading of 
 | junk TLD lookups?

==> If I understand correctly your suggestion:

OK for the first querie, but as the referal to AS112 NS's will lead to
a lame delegation (so no negative caching), for further queries for
those same junk TLDs, root servers will be sollicited again?

So what would you have gained at the end?

Mohsen.

---

From: Mohsen Souissi <[email-masked]>
Date: Wed, 5 Dec 2007 02:28:53 +0100

Mohsen.

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 4 Dec 2007 22:04:21 -0500 (EST)

> From http://www.nanog.org/mtg-0310/pdf/wessels.pdf:

Yes I remember that presentation.  I think John Crain's posting (thanks to 
Stephane for pointing that out) is pretty timely (in more than one way).

I'd be happy to write-up an ID describing the problem and proposing AS112 
as a potential solution - I don't want to fiddle with the current AS112 
drafts.  Further proposed delegations of anything is probably best to 
bash separately (which is what is taking place now).

Testing the waters a bit over delegations, I was told in the hallway that 
getting a junk TLD delegation is far harder than compared to a reverse 
map.  (They did not elaborate.)

All said though, it would be nice to hear from other root server operators 
just to correlate data regarding junk TLDs (unless someone like CAIDA 
might already have data like this around, just not really noted).

wfms

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 4 Dec 2007 22:04:21 -0500 (EST)

wfms

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 5 Dec 2007 09:36:08 +0100

On Wed, Dec 05, 2007 at 02:28:53AM +0100,
 Mohsen Souissi <[email-masked]> wrote 
 a message of 25 lines which said:

> OK for the first querie, but as the referal to AS112 NS's will lead
> to a lame delegation

If the AS112 servers' configuration is not modified. But if they have
some sort of wildcard themselves? (I do not think it can be done with
BIND but it is possible.)

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 5 Dec 2007 09:36:08 +0100

---

From: Joe Baptista <[email-masked]>
Date: Wed, 05 Dec 2007 10:00:31 -0500

>BIND but it is possible.)

No it can't be done with BIND.  Very lame.  It would be a big asset to 
root technology of the entire "*." wildcard TLD label could be pointed 
to AS112.  AS112 is truly the blackhole of this universe we call the 
internet.  AS112 - the internet garbage can.

I support using AS112 for that.  Great way to reduce the error traffic 
at root-servers.net.

regards
joe baptista

---

From: Joe Baptista <[email-masked]>
Date: Wed, 05 Dec 2007 10:00:31 -0500

regards
joe baptista

---

From: Paul Vixie <[email-masked]>
Date: 05 Dec 2007 15:07:40 +0000

> I support using AS112 for that.  Great way to reduce the error traffic 

wildcards can't be cname's or ns's.  (of the many important reasons why
the suggestion is terrible, that's the first/simplest that comes to mind.)
-- 
Paul Vixie

---

From: Paul Vixie <[email-masked]>
Date: 05 Dec 2007 15:07:40 +0000

---

From: Joe Baptista <[email-masked]>
Date: Wed, 05 Dec 2007 10:55:59 -0500

>the suggestion is terrible, that's the first/simplest that comes to mind.)
Actually no.  That is not correct.  I did some experimentation using 
BIND 8 and 9 as root servers.  BIND 8 does not support

*. CNAME some.host.name.

But BIND 9 does.

I know it sounds terrible to you but I think the RFC is flexible on 
that.  Your the expert - you look into it.  So it would be so nice if I 
could under BIND 9 do:

*. NS some.host.name.

Paul - make it so.  It would really cut down on root traffic and we 
could use AS112 as the garbage can of bin bucket heaven.  Be a sport - 
push the buttons and make it so.

regards
joe baptista

P.S. Alot of servers already wildcard *. NS back to the IANA servers.

---

From: Joe Baptista <[email-masked]>
Date: Wed, 05 Dec 2007 10:55:59 -0500

*. CNAME some.host.name.

But BIND 9 does.

*. NS some.host.name.

regards
joe baptista

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:02:22 +1100

> the suggestion is terrible, that's the first/simplest that comes to mind.)

	dname's or ns's

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:15:49 +1100

> This is a multi-part message in MIME format.
> --------------020009050009010201030606
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
> Content-Transfer-Encoding: 7bit
> 
> Paul Vixie wrote:
> 

	Actually all versions of BIND support "* CNAME".
 
> that.  Your the expert - you look into it.  So it would be so nice if I 

	Wildcard matching has the wrong semantics (1 vs many labels)
	for NS records.  Even if the semantics where addressed you
	then have to set up nameservers to do wildcard processing
	while looking for the relevent zone.  This implies having
	a copy of the parent zone so you can know what query names
	don't match the wildcard.
 
> push the buttons and make it so.

	Additionally the root server operators arn't worries about
	the traffic volume.  The in-addr.arpa server operators
	were worried.
 
	As a end user you should worry about information leaking
	but that can be addressed by having a local copy of the
	root zone.  There are other issues end users should also
	worry about which are also covered by having a local copy
	of the root zone.

	Mark

> --------------020009050009010201030606
> Content-Type: text/x-vcard; charset=utf-8;
>  name="baptista.vcf"
> Content-Transfer-Encoding: 7bit
> Content-Disposition: attachment;
>  filename="baptista.vcf"
> 
> begin:vcard
> fn:Joe Baptista
> n:Baptista;Joe
> org:PublicRoot Consortium
> adr:;;963 Ford Street;Peterborough;Ontario;K9J 5V5 ;Canada
> email;internet:[email-masked]
> title:PublicRoot Representative
> tel;fax:+1 (509) 479-0084 
> tel;cell:+1 (416) 912-6551
> x-mozilla-html:FALSE
> url:http://www.publicroot.org
> version:2.1
> end:vcard
> 
> 
> --------------020009050009010201030606
> Content-Type: text/plain; charset="us-ascii"
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
> 
> --------------020009050009010201030606--
>

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:00:15 +1100

> --------------080203070704010404050306

	This discussion is getting more ridiculous by the message.

	Mark

> --------------080203070704010404050306
> --------------080203070704010404050306
> --------------080203070704010404050306--
>

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:02:22 +1100

dname's or ns's

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:15:49 +1100

Mark

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:00:15 +1100

Mark

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:02:22 +1100

dname's or ns's

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:15:49 +1100

Mark

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:00:15 +1100

Mark

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:02:22 +1100

dname's or ns's

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:15:49 +1100

Mark

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 03:00:15 +1100

Mark

---

From: Joe Baptista <[email-masked]>
Date: Wed, 05 Dec 2007 11:40:44 -0500

>	Actually all versions of BIND support "* CNAME".
Sorry - your right - its DNAME it does not do.

>	don't match the wildcard.
Ya I know.  Thats the whole point behind what i'm advocating for AS112.  
Those are the servers I would wildcard too.  At least i would like to 
run the experiment.  I have found some servers that do *. NS - or so i'm 
told by their support tech community.  But not BIND.  BIND should be 
flexible and allow that.

regards
joe baptista

---

From: Joe Baptista <[email-masked]>
Date: Wed, 05 Dec 2007 11:40:44 -0500

regards
joe baptista

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 04:38:55 +1100

> --------------070503020104070709050909

	It's been done.  IT DOES NOT WORK.  named has code to prevent
	the records being added because IT DOES NOT WORK and we got
	sick and tired of telling people who ran up against sites
	that did it that IT DOES NOT WORK.  It's better to prevent than
	to spend repeated amounts of time dealing with the repercussions.

	It's easy to remove the checks but then you need to make sure
	all clients will work with the resultant mess.

	Wildcard is defined for intra-zone use.  It is not defined
	for extra-zone use.

	Mark
 
> --------------070503020104070709050909
> --------------070503020104070709050909--

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 04:38:55 +1100

Mark

---

From: Edward Lewis <[email-masked]>
Date: Wed, 5 Dec 2007 09:51:32 -0800

At 11:40 -0500 12/5/07, Joe Baptista wrote:

>experiment.  I have found some servers that do *. NS - or so i'm told...

ftp://ftp.rfc-editor.org/in-notes/rfc4592.txt

See sections 4.2 and 4.2.1. for comments on this idea.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

---

From: Edward Lewis <[email-masked]>
Date: Wed, 5 Dec 2007 09:51:32 -0800

---

From: Paul Vixie <[email-masked]>
Date: Wed, 05 Dec 2007 17:57:53 +0000

> ...  I have found some servers that do *. NS - or so i'm told by their
> support tech community.  But not BIND.  BIND should be flexible and allow
> that.

bind is following the spec.

---

From: Paul Vixie <[email-masked]>
Date: Wed, 05 Dec 2007 17:57:53 +0000

---

From: Joe Baptista <[email-masked]>
Date: Wed, 05 Dec 2007 13:41:25 -0500

>	to spend repeated amounts of time dealing with the repercussions.
Can't we make it work?  I appreciate your honesty.  But there are other 
dns packages that do allow it.  I'm looking for the flexibility to 
extra-zone so i can manage root traffic in bind.  Its obvious root get 
bugus traffic - i advocate a traffic can to send those bogus tlds too.  
I would love an AS112 stop sign.  That also eliinate the legal liability 
to me as a commercial operator of root.

>	all clients will work with the resultant mess.
It already is a mess.  has been for years.  What we are doing is fixing 
the mess using AS112.  I know alot of root operators who would welcome 
that friendly terminator for wayward traffic.  But I need bind to 
terminate *. NS.  I feel sorry it does not.

>	Wildcard is defined for intra-zone use.  It is not defined
Lets define it.  Just call it experimental.  or something convenient.  i 
think its needed for root services.  I am told it works under Dr. 
Bernstein's named daemon.  I still have not tested that myself.  But 
will eventually.  I pray it is the case.  Any root operator would 
welcome a trash can for bogus traffic.

and its christmas time.  what a wonderful gift.

regards
joe baptista

---

From: Joe Baptista <[email-masked]>
Date: Wed, 05 Dec 2007 13:41:25 -0500

regards
joe baptista

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 06:01:43 +1100

> terminate *. NS.  I feel sorry it does not.

	"*." NS will result in lookups for non-existant labels
	return NODATA rather than NXDOMAIN.  This is a BAD change.
	Lots of sites depend upon NXDOMAIN being returned.

	The AS112 delegations return NXDOMAIN for almost all queries
	directed to them as they are the result of gethostbyname().
	The times when they don't but those are when the client is
	searching for the containing zone and expect to get the other
	types of response.

	The queries to the root at a mixture of single and multi-label
	queries.  All the single lable queries (unqualified hostname for
	example) will get a DIFFERENT rcode as a result of this change.

	This does not if the AS112 usage model.
 
> --------------000503020107010809040908
> --------------000503020107010809040908
> --------------000503020107010809040908--
>

---

From: Mark Andrews <[email-masked]>
Date: Thu, 06 Dec 2007 06:01:43 +1100

---

From: Florian Weimer <[email-masked]>
Date: Wed, 05 Dec 2007 19:59:50 +0100

* Ralf Weber:

> But isn't priming only done at startup? And how often do people start
> there nameservers? This could be the cause.

I think BIND will almost inevitably learn a more authoritative version
of the l.root-servers.net/IN/A RRSET over time, which will be used for
queries.

---

From: Florian Weimer <[email-masked]>
Date: Wed, 05 Dec 2007 19:59:50 +0100

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 11 Dec 2007 12:50:42 +0100

On Tue, Dec 04, 2007 at 10:04:21PM -0500,
 William F. Maton Sotomayor <[email-masked]> wrote 
 a message of 31 lines which said:

> I'd be happy to write-up an ID describing the problem and proposing
> AS112 as a potential solution -

+1 :-)

> map.

Probably for ICANN political reasons. That's irrational but the
problem exists.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 11 Dec 2007 12:50:42 +0100

+1 :-)

---

From: Florian Weimer <[email-masked]>
Date: Thu, 13 Dec 2007 22:34:47 +0100

> ".local"), leaking through a configuration error. This looks like a

How do you prevent people from serving a non-empty .local TLD?
This change would make AS112 more attractive to miscreants, I guess.

---

From: Florian Weimer <[email-masked]>
Date: Thu, 13 Dec 2007 22:34:47 +0100

---

From: Florian Weimer <[email-masked]>
Date: Fri, 28 Dec 2007 23:42:23 +0100

* Mark Andrews:

> 	that did it that IT DOES NOT WORK.

The seem to work reasonably well for some purposes:

; <<>> DiG 9.4.2 <<>> @ns1.sedoparking.com. . any
; (3 servers found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13633
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;.                              IN      ANY

;; ANSWER SECTION:
.                       86400   IN      NS      ns2.sedoparking.com.
.                       600     IN      A       82.98.86.179
.                       86400   IN      NS      ns1.sedoparking.com.
.                       86400   IN      SOA     ns1.sedoparking.com. hostmaster.sedo.de. 2007021501 86400 7200 604800 86400

;; Query time: 173 msec
;; SERVER: 74.208.13.27#53(74.208.13.27)
;; WHEN: Fri Dec 28 23:39:19 2007
;; MSG SIZE  rcvd: 138

---

From: Florian Weimer <[email-masked]>
Date: Fri, 28 Dec 2007 23:42:23 +0100

;; QUESTION SECTION:
;.                              IN      ANY

;; ANSWER SECTION:

;; Query time: 173 msec