Subject: Re: What are valid reasons to have wildcards in DNS?

From: Masataka Ohta <[email-masked]>
Date: Fri, 14 Nov 2003 00:26:22 +0900

Paul Vixie;

>>And when we look at the discussions in this group, wouldn't it be much
>>better to disable wildcards in DNS at all?

> no.  the protocol community has no concrete or complete idea of why a
> zone adminstrator might use wildcards.  all we know is that they are
> in wide use for many purposes, and that they are often used incorrectly
> or unnecessarily.

Both of you should read 4.3.3 of 1034, though you are free to
argue against it.

							Masataka Ohta

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Olaf M.Kolkman <[email-masked]>
Date: Thu, 13 Nov 2003 09:41:32 -0600

> Both of you should read 4.3.3 of 1034, though you are free to

Ohta San,

Could you expand; it not quite clear, to me at least, what you are 
trying to argue with providing the reference.

--Olaf Kolkman
    namedropper.

---

From: Jim Reid <[email-masked]>
Date: Thu, 13 Nov 2003 16:07:56 +0000

>>>>> "Paul" == Paul Vixie <[email-masked]> writes:

    Paul> therefore there's not only nothing we SHOULD do to restrict
    Paul> the use of wildcards, there's also nothing we COULD do to
    Paul> restrict such use.

Not even a BCP which says "Wildcard RRs are considered harmful. Don't
use them unless you really know what you're doing. Which you obviously
don't if you have to read this BCP..."?

I agree 100% there's nothing we could or should do to restrict usage
of wildcards. However we could discourage their use and so do a little
to help make the internet a better place.

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 14 Nov 2003 01:42:21 +0900

> trying to argue with providing the reference.

There is a description why a zone administrator might use wildcards.

And, my understanding is that wildcard is useful if there are many
or huge number of names sharing same properties and a zone administrator
do not want or can't modify zone everytime a new name appears.

I also think it is unlikely that the reasons are applicable to A
RR that there will be a confusion if people, ignoring the example
in 1034, think DNS is a system to retrieve addresses.

						Masataka Ohta

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Thu, 13 Nov 2003 12:12:20 -0500

> Both of you should read 4.3.3 of 1034, though you are free to

I'm looking at a .museum, which apparently uses wildcards for a purpose
not apparently described in section 4.3.3 of 1034.

Eric

---

From: Paul Vixie <[email-masked]>
Date: 13 Nov 2003 17:44:53 +0000

> Both of you should read 4.3.3 of 1034, though you are free to

i have reread it.  please point out the part that i seem not to agree with.
the only part that stands out as relevant to the original questioner is...

>> This facility is most often used to create a zone which will be used to
>> forward mail from the Internet to some other mail system.

...and while i agree with this, i also note that "most often" is nonexclusive.
-- 
Paul Vixie

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 13 Nov 2003 13:57:32 -0500 (EST)

> do not want or can't modify zone everytime a new name appears.

Synthesis would be useful in such cases, but not the standardized
wildcard.

I suggest reading draft-ietf-dnsext-wcard-clarify-02.txt, particularly
the first paragraph on page three.

-- Sam

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 14 Nov 2003 04:15:53 +0900

Samuel Weiler;

> Synthesis would be useful in such cases, but not the standardized

Wild card is the standard way of "synthesis", which means it works
over standardized zone transfer.

> the first paragraph on page three.

I checked it again but found no useful information in the paragraph.

						Masataka Ohta

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 13 Nov 2003 15:28:29 -0500 (EST)

> I checked it again but found no useful information in the paragraph.

Then perhaps I should be more plain, or you should read the paragraph
yet again.  I'll quote it here to make it easy to find:

   Note that a wild card domain name has no special impact on the search
   for a query type (QTYPE).  If a domain name is found that matches the
   QNAME (exact or a wild card) but the QTYPE is not found at that
   point, the proper response is that there is no data available.  The
   search does not continue on to seek other wild cards that might match
   the QTYPE.  To illustrate, a wild card owning an MX RR does not
   'cover' other names in the zone that own an A RR.  ...

> >>do not want or can't modify zone everytime a new name appears.

I think your understanding is incorrect.  The cited paragraph says
that if a name exists, the standard wildcard has no effect on it.  So
the standard wildcard won't be useful unless the "huge number of
names" you refer to is either every possible name in the zone or every
possible name except for explicitly instantiated ones.

-- Sam

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 14 Nov 2003 05:52:16 +0900

Samuel Weiler;

> I think your understanding is incorrect.

Why?

> The cited paragraph says
> that if a name exists, the standard wildcard has no effect on it.

Correct, so far.

> So

I never said "if and only if".

Paul wrote "no concrete or complete idea", and I gave a reference
to an idea.

Then, I'm still puzzled because I think "if a name exists, the
standard wildcard has no effect on it" has no relevance to my
point.

Just FYI, wildcard may appear anywhere in a zone not necessarily at
the top.

							Masataka Ohta