Subject: [DNSOP] RFC 6761 discussion (“special names”)

From: Tim Wicinski <[email-masked]>
Date: Tue, 17 Mar 2015 21:39:19 +0000

All,

We have two different drafts which have asked for time in Dallas, and a 
few more that have not.   We've slotted some time for the discussion, 
but once again we have a packed agenda and limited time to discuss 
either the drafts or the implications of widening use of RFC 6761.

If anyone remembers, we began this discussion at IETF 89 (London) a 
little over a year ago. The main issue at the time was the lack of 
charter for DNSOP to tackle the problem, which we went off and solved.

The WG has several documents that we need to spend time in Dallas moving 
towards completion. But we also believe the RFC 6761 drafts should not 
be given short shrift.

Accordingly, we are tentatively planning a Virtual Interim Meeting to 
dive a little deeper on the special names drafts, including possible 
architectural implications of the apparent increase in interest in RFC 
6761, as we attempt to muddle through the questions we’ve seen and the 
ones we anticipate.

We're soliciting feedback on this idea.  The tentative date based on 
IETF guidelines would be the week of April 20th.

Thanks

tim
suzanne

---

From: hellekin <[email-masked]>
Date: Tue, 17 Mar 2015 18:51:54 -0300

On 03/17/15 18:39, Tim Wicinski wrote:
> 
> the implications of widening use of RFC 6761.
>
*** You certainly mean: the implications of using RFC 6761, given that
so far, it's only been used by its creator, Apple Inc. in RFC 6762 (if
6761 itself is not counted).

"widening use of RFC 6761" sounds to me like its use should be reserved
to some entities over others.  It does not seem fair, and implies that
RFC 6761 cannot be used like any other RFCs.  Did I read something wrong?

==
hk

---

From: Suzanne Woolf <[email-masked]>
Date: Tue, 17 Mar 2015 19:14:46 -0400

On Mar 17, 2015, at 5:51 PM, hellekin <[email-masked]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 

Sorry if this wasn't clear, perhaps a result of trying to get the idea of the interim meeting out without enough wordsmithing.

Actually we meant the increasing numbers of drafts submitted as requests under RFC 6761, in under a year since we revised our charter to include them, and the number of strings included.

Currently, there are six drafts, most appearing in the last few weeks. They request reservations of a total of about 40 strings, if I'm doing the arithmetic in draft-lewis-user-assigned-tlds correctly. Some (such as yours) are clearly intended to support new functionality, in accordance with the purpose indicated in RFC 6761; some others are less clear as to their purpose.

It seems appropriate to ask what implications, if any, might follow.

> RFC 6761 cannot be used like any other RFCs.  Did I read something wrong?

It was not anyone's intention that RFC 6761 should "be reserved to some entities over others." It, and we, are silent as to the entities who might be asking for special names. Like most RFCs, however, RFC 6761 does distinguish among requests on other attributes.

Scalability of the process in RFC 6761 and the criteria for special names seems like an appropriate concern for DNSOP and the IETF to us.

Do you have feedback on the idea of an interim meeting for DNSOP to address these drafts in more depth than we will be able to offer at the IETF meeting in Dallas?

much thanks,
Suzanne & Tim

---

From: hellekin <[email-masked]>
Date: Tue, 17 Mar 2015 20:53:52 -0300

> 
> Do you have feedback on the idea of an interim meeting for DNSOP to address 
> these drafts in more depth
>
*** Thank you Suzanne for your clarification.

My only feedback is that such meeting is very welcome.  I hope the
discussion will be fruitful and will enable DNSOP to get things done
with these drafts.

Would you please share the list of drafts for completeness?

Thank you for your attention,

==
hk

---

From: Tim Wicinski <[email-masked]>
Date: Wed, 18 Mar 2015 00:33:01 +0000

These are the drafts I have on special names, reserved TLD, etc.  I am 
sure I missed something in my list.

http://datatracker.ietf.org/doc/draft-lewis-user-assigned-tlds/

http://datatracker.ietf.org/doc/draft-chapin-additional-reserved-tlds/

http://datatracker.ietf.org/doc/draft-appelbaum-dnsop-onion-tld/

http://datatracker.ietf.org/doc/draft-wkumari-dnsop-alt-tld/

http://datatracker.ietf.org/doc/draft-grothoff-iesg-special-use-p2p-names/

http://datatracker.ietf.org/doc/draft-cheshire-homenet-dot-home/

On 3/17/15 11:53 PM, hellekin wrote:
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQJ8BAEBCgBmBQJVCL6IXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
> ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFQ0IyNkIyRTNDNzEyMTc2OUEzNEM4ODU0
> ODA2QzM2M0ZDMTg5ODNEAAoJEEgGw2P8GJg9Tk0QAJODcsSUjb4KQSdQ9C5hJOK5
> qcJzAvzifq6jUcvFNQavmc1DtWMb9uhImz4j6AENp5/YExWkNlC01qvHXnI2zo6Z
> xXggZFTndzSGQdOh79wkZLJbgqM1SwzQIzCLAymsQpLmp5OCJoZ4zR/D+46qKMMv
> rpxlXdHZ6RCYcyw9QTwUR6+nkI87HpJKJ8daj5CeZD8G0f3Q5ephC0X6OaJldoIt
> exjbg5I5lD58rSdjEn/0M2DPAy8BkgIH6DdBMLTF8r5z2GskF+HLhuNPEHb2B6Jm
> HBBFkGS7CIu7UdcO2p1ZCnh/CUm0N+BWYYASOhpqL4/pbi4zzcPoAQ8MyLYSIEZ0
> 9lEU1uqpSDm9DDJkPl1V18l8AZBdADBEPNi9byZBznuKonuIA8KmMlBWuXC/PF0B
> xsb0Lg7YZUS+sUc+KoB8bug4FS9vjDVnpVk4ZOsceXhqvdOPppRnFCMeycei/+/i
> Uy7EpU8qKoPJU+mG8zulADcWAtt1i5oJHIrAxUmRXH/ja40V3Pe4HFoNHt0Ksdf9
> WWmsQgEnEOcXXkT0nA0KQEvsK8Z42BvGu5LbVbKiLjyg0ix3EZYNGyzSIcz8Vh/l
> nhzom/HsJvjf9Jxo2w+BMUS0In5SZQwkqyoxKmsmXCaBEKQwFJs74ePhiA/A7vVe
> 57eOOK2g85HdA8vhWt15
> =lEY+
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Jaap Akkerhuis <[email-masked]>
Date: Wed, 18 Mar 2015 12:01:21 +0100

> 6761, as we attempt to muddle through the questions we’ve seen and the 

Following this discussion from a distance, I cannot help wondering
whether this is special names stuff might in violate RFC 2860 section 4.3.

	jaap

---

From: hellekin <[email-masked]>
Date: Wed, 18 Mar 2015 09:39:52 -0300

> whether this is special names stuff might in violate RFC 2860 section 4.3.
*** Assignment of special names belongs to "assignment of domain names
for technical use" according to that section.  Do you read it differently?

==
hk

---

From: Suzanne Woolf <[email-masked]>
Date: Wed, 18 Mar 2015 08:54:17 -0400

> whether this is special names stuff might in violate RFC 2860 section 4.3.

Making sure that any coordination needed is getting done seems to be a valid concern, yes. The IAB called this out in a liaison communication to ICANN last year; you can read it here: http://datatracker.ietf.org/liaison/1351/.

best,
Suzanne

---

From: Ted Lemon <[email-masked]>
Date: Wed, 18 Mar 2015 09:40:22 -0400

> whether this is special names stuff might in violate RFC 2860 section 4.3.

I don't see it.   It looks like 2860 explicitly supports what is being proposed here.   Where do you see a conflict?

---

From: Jaap Akkerhuis <[email-masked]>
Date: Wed, 18 Mar 2015 15:29:16 +0100

> I don't see it.   It looks like 2860 explicitly supports what is being proposed here.   Where do you see a conflict?

Just calling something technical doesn't make it so. But that is not
my point. I was just responding on the message about the interim
stating

    "we attempt to muddle through the questions we've seen and the
    ones we anticipate"

I hadn't seen any questions about the relation towards RFC 2860 so
given the proposed special meeting, this is something that could be
discussed.

The pointer from Suzanne to the liaison statement shows that
apparently this as been attended to in the past.

	jaap

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 18 Mar 2015 08:19:52 -0700

On Mar 17, 2015, at 2:39 PM, Tim Wicinski <[email-masked]> wrote:
> Accordingly, we are tentatively planning a Virtual Interim Meeting to dive a little deeper on the special names drafts, including possible architectural implications of the apparent increase in interest in RFC 6761, as we attempt to muddle through the questions we’ve seen and the ones we anticipate.

Yes, please. The discussion on this list so far has been more about policy, not about DNS operations. That is, there has been very little discussion of the operational aspects of RFC 6761 in the new proposals, just whether the naming policy is being followed. Therefore, separating this out from the rest of the discussion in Dallas seems like a good way to get those most interested in the topic in one place at one time.

--Paul Hoffman

---

From: Edward Lewis <[email-masked]>
Date: Wed, 18 Mar 2015 15:46:43 +0000

>apparently this as been attended to in the past.

Executive summary of my message below.  Count me as utterly confused
regarding the topic and agreeing that a deeper, focused discussion is
warranted.

The longer version:

Along the lines of agreeing with Jaap, I'm not sure I really understand
the Special-Use Domain Names registry as much as I thought anymore.

The liaison statement is something I hadn't seen before, IMHO, if just
because liaison statements aren't as accessible, searchable or well known
as RFC's.  More or less, this is a "communications" problem - publicizing
results.

Nevertheless, reading the liaison statement I came across this and
wondered if more specific material is available:

"Discussion of these requests under the process established in RFC 6761
has revealed difficulties in applying its guidelines in practice."

I'm inclined to see that RFC 6761 can be improved, but wonder what
"difficulties" were the basis of the statement's conclusion.  More detail
here would be helpful, especially is someone has already taken the time to
do the work.

Beyond the liaison statement, and back to the mission of the Special-Use
Domain Names registry, I've had in mind that there is a separation between
dotted strings that look like domain names and domain names themselves and
this separation's inconsistent treatment is where we run into questions
like whether something like .onion is a TLD or not or is deserving of
being treated as a TLD.  (I've used the term transliterated-DNS names in
probably an inappropriate way to distinguish between how the DNS writes
domain names into its master [zone] files and how the DNS protocol
transmits names in UDP.  Personally I've attached significance to dotted
strings that are also seen on the wire as opposed to names that never get
converted when it comes to whether a name is a domain name or just a
dotted string. Yes, I am in the weeds on this one.)

>From what I've read, one interpretation of a name in the Special-Use
Domain Names registry is that it shouldn't de delegated in the root
zone.[0]  Another interpretation is that DNS "surface software" (my
unqualified term for the API's and stubs) return all requests for such a
name as NXDOMAIN without consulting DNS servers[1].  Yet another
interpretation is that applications ought to consult the registry and if
the name is there, do not even think to ask the DNS "surface software"
about it.[2]  Given these interpretations from what I've read, I move my
marker to "a little confused" by the registry.

Perhaps "defense in depth" principles says all of the interpretations
ought to be applied.

So, in a way, I see the liaison statement asking the DNSOP WG to define
the criteria for treating a name (thinking mostly of dotted strings) as
qualifying for a technical reservation (perhaps via the Special-Use Domain
Names registry) and possibly defining what such a reservation means to
implementations.

[0] Raising the issue of the how a protocol like WhoIs or RDAP would
report the name.
[1] http://www.ietf.org/mail-archive/web/dnsop/current/msg13777.html
And I don't think that gethostbyname() returned the RCODE, but its been
many years since I looked.  I appreciate that the message is using some
shorthand, but this just adds to confusion.  I.e., I read the first line
as asking that the name be prevented form being in the root because it
would be in the Special-Use Domain Name registry.
[2] http://www.ietf.org/mail-archive/web/dnsop/current/msg13765.html

PS - Even just reading RFC 6761 I get a bit confused.

There's "if declaring a given name to be special would result in no change
to any implementations, then that suggests that the name may not be
special in any material way, and it may be more appropriate to use the
existing DNS mechanisms" which though it's "negative" grammar leaves me
wondering if it means that the Special-Use Domain Names are to be treated
differently in applications outside of DNS.  But later there is this
quote, "it has to be defined to return NXDOMAIN" which to me implies the
DNS "surface software" or even it's server software has to be modified.