Subject: [DNSOP] I-D Action: draft-ietf-dnsop-isp-ip6rdns-01.txt

From: [email-masked]
Date: Tue, 22 Dec 2015 11:48:20 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Domain Name System Operations Working Group of the IETF.

        Title           : Reverse DNS in IPv6 for Internet Service Providers
        Author          : Lee Howard
	Filename        : draft-ietf-dnsop-isp-ip6rdns-01.txt
	Pages           : 13
	Date            : 2015-12-22

Abstract:
   In IPv4, Internet Service Providers (ISPs) commonly provide IN-
   ADDR.ARPA information for their customers by prepopulating the zone
   with one PTR record for every available address.  This practice does
   not scale in IPv6.  This document analyzes different approaches and
   considerations for ISPs in managing the ip6.arpa zone for IPv6
   address space assigned to many customers.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-isp-ip6rdns/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-dnsop-isp-ip6rdns-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-isp-ip6rdns-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: George Michaelson <[email-masked]>
Date: Wed, 23 Dec 2015 08:39:00 +1000

I want to dispute one part of this: the "DNSSEC may not scale well" part.
With thanks to Ray Bellis, APNIC has been running an evldns webserver which
signs on the fly, and we have achieved north of 3000 signs/second from this
code on a smallish cloud node signing on demand.

Our model was unique domains (the 1x1 ad system) but Ray coded a simple
ring buffer and for the repeat queries, there was a demonstrable cache
benefit to keeping some amount of signed state live without having to
re-sign.

I think that on-the-fly DNSSEC for IPv6 is tractable.

-George

On Wed, Dec 23, 2015 at 5:48 AM, <[email-masked]> wrote:

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: "Ralf Weber" <[email-masked]>
Date: Wed, 23 Dec 2015 11:13:48 +0100

Moin!

> code on a smallish cloud node signing on demand.
While I think that online signing is feasible there always is a cost/benfit
ratio. This may be different when you do paid forward zones or when you have
to provide the reverse service for free with your already low margin internet
service.

> benefit to keeping some amount of signed state live without having to
Caching helps. When Nominum did that feature a couple of years ago we did 
measure above 10k queries or signs/second non cached and above 100k qps
when using the cache. However in an attack scenario you almost certain
have to answer without the cache and the qps numbers are easily in the
millions of quries per second. Now non DNSSEC you easily can answer 150k
qps or more, so that is quite a huge factor to consider when scaling 
your infrastructure.

> I think that on-the-fly DNSSEC for IPv6 is tractable.
I'm sure it can be done. It just might not be feasible, which why I 
think the statement in the draft that it may not scale as well as non
DNSSEC is valid in that scenario.

So long
-Ralf

---

From: "Howard, Lee" <[email-masked]>
Date: Wed, 23 Dec 2015 15:56:21 +0000

From: George Michaelson <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, December 22, 2015 at 5:39 PM
To: dnsop WG <[email-masked]<mailto:[email-masked]>>, Lee Howard <[email-masked]<mailto:[email-masked]>>
Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-isp-ip6rdns-01.txt

I want to dispute one part of this: the "DNSSEC may not scale well" part. With thanks to Ray Bellis, APNIC has been running an evldns webserver which signs on the fly, and we have achieved north of 3000 signs/second from this code on a smallish cloud node signing on demand.

Can you quantify "smallish"?  Unfortunately, the folks I know who can tell me our PTR query rate are out for a couple of weeks, but it would stand to reason that the RIRs would get a lot of qps.

Our model was unique domains (the 1x1 ad system) but Ray coded a simple ring buffer and for the repeat queries, there was a demonstrable cache benefit to keeping some amount of signed state live without having to re-sign.

Makes sense.

When this part of the text was first written, 5-6 years ago, the statement was truer than it is now.
I could rewrite to say, "Signing PTR records on the fly may be scalable, especially if records thus signed are cached, but large-scale experience is currently limited."
Ralf's additional note about DDoS scenarios is well taken, but I have a feeling APNIC is under constant attack.

In other words: more input needed.

Lee

-George

On Wed, Dec 23, 2015 at 5:48 AM, <[email-masked]<mailto:[email-masked]>> wrote:

Abstract:

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org>.

_______________________________________________
DNSOP mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dnsop

________________________________

This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.