Subject: Re: [DNSOP] Last Call: <draft-ietf-dnsop-root-loopback-02.txt> (Decreasing Access Time to Root Servers by Running One on Loopback) to Informational RFC

From: "John Levine" <[email-masked]>
Date: 30 Jul 2015 15:14:24 -0000

In article <[email-masked]> you write:
>The IESG has received a request from the Domain Name System Operations WG
>(dnsop) to consider the following document:
>- 'Decreasing Access Time to Root Servers by Running One on Loopback'
>  <draft-ietf-dnsop-root-loopback-02.txt> as Informational RFC

I've been using this approach on my small network for a couple of
months. with nsd and unbound and it seems to work fine.  I understand
the reservations people have about bypassing the roots, but I it's
worth documenting in an informational RFC.

R's,
John

---

From: Sunilkumar KS <[email-masked]>
Date: Wed, 29 Jul 2015 23:37:53 +0530

Hi

The content of this mailing list doesn't make any use to me.  So kindly
advise me how to unsubscribe from this mailing list?  Or if possible,
please do the same at your end.

Sorry for the inconvenience.

Thanks in advance.

On Tue, Jul 28, 2015 at 7:42 PM, The IESG <[email-masked]> wrote:

> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action. Please send substantive comments to the
> [email-masked] mailing lists by 2015-08-11. Exceptionally, comments may be
> sent to [email-masked] instead. In either case, please retain the
> beginning of the Subject line to allow automated sorting.
>
> Abstract
>
>
>    Some DNS recursive resolvers have longer-than-desired round trip
>    times to the closest DNS root server.  Some DNS recursive resolver
>    operators want to prevent snooping of requests sent to DNS root
>    servers by third parties.  Such resolvers can greatly decrease the
>    round trip time and prevent observation of requests by running a copy
>    of the full root zone on a loopback address (such as 127.0.0.1).
>    This document shows how to start and maintain such a copy of the root
>    zone that does not pose a threat to other users of the DNS, at the
>    cost of adding some operational fragility for the operator.
>
>
>
>
> The file can be obtained via
> https://datatracker.ietf.org/doc/draft-ietf-dnsop-root-loopback/
>
> IESG discussion can be tracked via
> https://datatracker.ietf.org/doc/draft-ietf-dnsop-root-loopback/ballot/
>
>
> The following IPR Declarations may be related to this I-D:
>
>    https://datatracker.ietf.org/ipr/2539/
>
>
>
>

-- 
Thank you,

Sunilkumar KS

---

From: David Mandelberg <[email-masked]>
Date: Thu, 30 Jul 2015 15:44:32 -0400

Section 2 says:

    o  The system MUST be able to run an authoritative server on one of
       the IPv4 loopback addresses (that is, an address in the range
       127/8).

Why is there a requirement for an *IPv4* loopback address? Is there any 
problem with running on the IPv6 loopback address?

-- 
David Eric Mandelberg / dseomn
http://david.mandelberg.org/

---

From: "John Levine" <[email-masked]>
Date: 30 Jul 2015 20:13:17 -0000

>problem with running on the IPv6 loopback address?

There's only one v6 loopback address, and it often has a local DNS
cache listening.

R's,
John