Subject: Re: draft-ietf-dnsext-dnssec-intro-09: EDNS0 issue

From: Mark Andrews <[email-masked]>
Date: Tue, 09 Mar 2004 10:35:24 +1100

[ Moderators note: Post by non-subscriber.  With the massive amount of
   spam, it is easy to miss and therefore delete relevant posts 
   by non-subsrcibers. Please fix your subscription addresses. ]

> Scott Rose;
> 
> > It would also be an arbitrary limit based on current underlying network
> > layers.  The 4000 byte limit is not really a bound by DNS (with DNSSEC) or
> > EDNS0.
> 
> 512 byte limit is a bound not by DNS but by the current underlying
> network and transport layers.
> 
> So?
> 
> > but not necessary to the specification.
> 
> It is necessary that DNS message size has a limit in the specification.
> 
> 							Masataka Ohta
> 
> PS
> 
> The proper limit bound by minimum reassembly buffer size, maximum
> IP header length and UDP header length is 508.

	Why are we arguing about the minimums that have to be
	supported by the architecure?

	EDNS is about letting the the other end knowing what you
	are *capable of handling*.  There is *nothing* in to stop
	a site sending *smaller* EDNS/UDP message than the receiving
	site is capable of handling.

	If the client says it can accept a 4k response but you know
	that your firewall is broken (e.g. drops DNS packets > 512)
	you are quite entitled to only send a 512 byte EDNS/UDP
	responses.  Set TC as appropriate.

	For example, named has a upper bound on the size of the
	EDNS/UDP response it will send.  You can advertise a 64k
	UDP buffer all you want but you will not get more that 4k
	EDNS/UDP response.

	Mark
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Tue, 09 Mar 2004 10:35:24 +1100

Mark