Subject: [DNSOP] Call for Adoption: draft-bortzmeyer-dnsop-nxdomain-cut

From: Tim Wicinski <[email-masked]>
Date: Sat, 5 Dec 2015 17:07:13 -0500

We've seen a lot of discussion on the list, and the general consensus is 
that the document should be adopted and worked on.

This starts a Call for Adoption for draft-bortzmeyer-dnsop-nxdomain-cut

The draft is available here:
https://datatracker.ietf.org/doc/draft-bortzmeyer-dnsop-nxdomain-cut/

Please review this draft to see if you think it is suitable for adoption 
by DNSOP, and comments to the list, clearly stating your view.

Please also indicate if you are willing to contribute text, review, etc.

This 2 week call for adoption ends 19 December 2015

Thanks,
tim wicinski
DNSOP co-chair

---

From: "John Levine" <[email-masked]>
Date: 6 Dec 2015 00:20:14 -0000

>Please also indicate if you are willing to contribute text, review, etc.

Yes, it's worth working on, and I'm willing to contribute the text to
replace the SOA discussions.

R's,
John

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 13 Dec 2015 22:55:37 +0100

On Sat, Dec 05, 2015 at 05:07:13PM -0500,
 Tim Wicinski <[email-masked]> wrote 

> This starts a Call for Adoption for draft-bortzmeyer-dnsop-nxdomain-cut

Funny, unlike what I wrote in the draft, there is at least a recursor
with a partial support of NXDOMAIN cut (off by default):

https://doc.powerdns.com/md/recursor/settings/#root-nx-trust

root-nx-trust

Boolean
Default: no
Available since: 3.7.0
If set, an NXDOMAIN from the root-servers will serve as a blanket
NXDOMAIN for the entire TLD the query belonged to. The effect of this
is far fewer queries to the root-servers.

---

From: Shumon Huque <[email-masked]>
Date: Sun, 13 Dec 2015 23:12:13 -0500

> is far fewer queries to the root-servers.

Indeed. I first learned of powerdns support for this feature from Bert
Hubert's remarks at the mic right after my qname minimization talk at the
Spring OARC meeting. Here's a link to the remarks:

   https://www.youtube.com/watch?v=UcAygzNSxlI&amp;t=1h27m12s

(He also said he would be willing to extend the feature to responses from
TLD servers below the root if they really meant NXDOMAIN when they
responded with it).

-- 
Shumon Huque

---

From: Tim Wicinski <[email-masked]>
Date: Sun, 20 Dec 2015 23:52:06 -0500

The call for adoption is over, and from the discussion before the 
official call, and comments, it feels this is a document DNSOP should 
adopt and work on, and possibly publish.

If the authors can upload the appropriate new version that would be great.

tim

---

From: Shumon Huque <[email-masked]>
Date: Fri, 25 Dec 2015 22:59:35 -0500

>> is far fewer queries to the root-servers.
I also recently discovered that Unbound also supports this (and more
generally, not just for the root, but only for signed NXDOMAIN responses),
via the configuration parameter "harden-below-nxdomain".

from https://www.unbound.net/documentation/unbound.conf.html

       harden-below-nxdomain: <yes or no>
              From draft-vixie-dnsext-resimprove, returns nxdomain to
 queries
              for  a name below another name that is already known to be
nxdo-
              main.  DNSSEC mandates noerror  for  empty  nonterminals,
 hence
              this  is  possible.  Very old software might return nxdomain
for
              empty nonterminals (that usually happen for reverse  IP
 address
              lookups),  and  thus  may  be incompatible with this.  To try
to
              avoid this only DNSSEC-secure nxdomains are  used,  because
 the
              old software does not have DNSSEC.  Default is off.

The signed negative response requirement probably indirectly addresses
CDN/ENT misbehavior among others. Wonder if anyone uses this knob in
production yet, and if there are experiences to report ..

-- 
Shumon Huque