Subject: What are valid reasons to have wildcards in DNS?

From: Matus UHLAR - fantomas <[email-masked]>
Date: Thu, 06 Nov 2003 15:56:51 -0000

[ post by non-subscriber.  with the massive amount of spam, it is easy to miss
  and therefore delete posts by non-subscribers.  if you wish to regularly
  post from an address that is not subscribed to this mailing list, send a
  message to <listname>[email-masked] and ask to have the alternate
  address added to the list of addresses from which submissions are
  automatically accepted. ]

Hello,

for last two months there were many discussions and clarifications about
wildcards in DNS. There is a question that seems to me still unanswered:

what are legal and valid reasons to have wildcards in domains?

>From my point of view, wildcards are used:
1. by admins lazy to set up higher number of hostnames od MX records
2. for lame people not able to use some reasonable defaults (e.g. *.museum
   versus www.museum)

when we take into consideration all problems happening caused by using
wildcard domain names - all of them were named in when verisgn introduced
wildcards in .com and .net zones:

http://lists.megacity.org/pipermail/rfci-discuss/2003-September/001759.html
http://www.icann.org/announcements/advisory-03oct03.htm

And when we look at the discussions in this group, wouldn't it be much
better to disable wildcards in DNS at all?

-- 
Matus UHLAR - fantomas, [email-masked] ; http://www.fantomas.sk/
Warning: I don't wish to receive e-mail advertising to this address.
Varovanie: Nezelam si na tuto adresu dostavat akukolvek reklamnu postu.
Honk if you love peace and quiet. 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Thu, 13 Nov 2003 15:04:28 +0000

> ...

no.  the protocol community has no concrete or complete idea of why a
zone adminstrator might use wildcards.  all we know is that they are
in wide use for many purposes, and that they are often used incorrectly
or unnecessarily.

but more importantly, current dns does wildcard synthesis in the authority
server, not in the resolvers.  this means two things.  first, there's no
workload being placed on or shifted toward resolvers by the use of wildcards.
second, a zone administrator could synthesize data for their own purposes,
with or without wildcard rules, as long as she controlled all of her 
authority servers (and therefore did not depend on axfr to carry the
synthesis marker, as wildcards do.)

therefore there's not only nothing we SHOULD do to restrict the use of
wildcards, there's also nothing we COULD do to restrict such use.

the recent discussions about the *.COM and *.NET wildcards ended by pointing
up the fact that the "zone administrator" function is not singularly held
by any one entity, and that the putative zone administrator apparently lacks
the full autonomy needed to synthesize responses to nonexisting names in the
way a non-gTLD zone administrator would normally be able to do.  i hope you
will agree that this is a problem for the lawyers, not for the protocol
community, to resolve.

---

From: Paul Vixie <[email-masked]>
Date: Thu, 13 Nov 2003 17:55:52 +0000

> Not even a BCP which says "Wildcard RRs are considered harmful. Don't
> use them unless you really know what you're doing. Which you obviously
> don't if you have to read this BCP..."?

not even that, nope.

> I agree 100% there's nothing we could or should do to restrict usage
> of wildcards. However we could discourage their use and so do a little
> to help make the internet a better place.

sounds like a dnsop issue.