Subject: [DNSOP] draft-ietf-dnsop-refuse-any - why not NOTIMP?

From: Ray Bellis <[email-masked]>
Date: Mon, 7 Aug 2017 12:14:23 +0100

Having looked at this a few months ago when one of our partners was
(briefly) returning NOTIMP for ANY queries, I find myself wondering why
this isn't discussed in the draft?

The draft does talk about *new* RCODEs, but not existing ones.

My reading of RFC 1035 is that it would be a perfectly appropriate
response from a server that doesn't support ANY.

Unfortunately the retry semantics of DNS are not well specified and
therefore implementation differences may occur.  If as a result NOTIMP
is really not usable then IMHO this should also be documented.

Ray

---

From: Ólafur Guðmundsson <[email-masked]>
Date: Mon, 7 Aug 2017 11:44:11 -0400

This was the original proposal,
the drawback is that resolvers to not cache the answer, and to make things
worse they ask ALL NS addresses for listed domain
thus it acts as a DDoS against the domain in question.

Olafur

On Mon, Aug 7, 2017 at 7:14 AM, Ray Bellis <[email-masked]> wrote:

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Ray Bellis <[email-masked]>
Date: Mon, 7 Aug 2017 16:45:48 +0100

On 07/08/2017 16:44, Ólafur Guðmundsson wrote:

> the drawback is that resolvers to not cache the answer, and to make
> things worse they ask ALL NS addresses for listed domain 

Indeed - I've since confirmed that BIND does this.

I think my point still stands that this behaviour should be documented
in the section that talks about a possible new RCODE and why that option
was rejected.

kind regards,

Ray

---

From: Edward Lewis <[email-masked]>
Date: Mon, 7 Aug 2017 16:14:11 +0000

>    in the section that talks about a possible new RCODE and why that option

This thread is why I'd like to return "what the querier should do next" instead of "why I didn't answer". ;)

---

From: Paul Vixie <[email-masked]>
Date: Mon, 07 Aug 2017 10:26:05 -0700

Ray Bellis wrote:
> ... returning NOTIMP for ANY queries, ...
>
> ...
>

the RFC was treated as a general guideline by most implementers, and 
once the code for some client or server appeared to work, it was 
shipped. it is that code which constraints our work now, not the RFC.

> is really not usable then IMHO this should also be documented.

i think you'll find that NOTIMP causes try-next-server for many clients, 
but without poisoning, so if all servers return NOTIMP, then all those 
same servers will be tried again, without delay.

sometimes, withholding a response is the only way to keep the client out 
of this bombardment-mode. sometimes returning something poisonous like 
ANCOUNT=0 is nec'y. again, our guide today is how to get clients to do 
something constructive, ideally constructive for both them and us. it 
doesn't have to be true, and it doesn't have to be documented in an 
older RFC.

i agree that writing a new RFC whenever something like this is found to 
be necessary, and putting into that RFC more specific advice to client 
implementers so that the future might possibly improve, is a great idea.

-- 
P Vixie

---

From: Paul Vixie <[email-masked]>
Date: Mon, 07 Aug 2017 10:34:21 -0700

-- P Vixie