Subject: Query ID spoof protection document adopted

From: Ólafur Guðmundsson /DNSEXT co-chair <[email-masked]>
Date: Mon, 08 Jan 2007 15:27:30 -0500

The working group will adopt your draft as a working item.
Before the announcement we need to agree on the scope of the
document or documents:

Proposed scope:
Protection of DNS from forged answers by flooding

The document will update 1034 and make following recommendations:
	- Implementations MUST be able to send queries from ANY UDP port
	- Implementations SHOULD use good random source to
            select Query ID for next query
	- Implementations SHOULD be configurable to use one or
             multiple ports for queries.
	- Implementations MAY be configurable to use one or
             more addresses for queries
	- Implementations MUST suppress multiple identical
             outstanding queries to the SAME server.
	- Implementations MUST match answers to the following
		Remote address
		Local address
		Query port
		Query ID
		Question
  	  before applying DNS credibility rules.
	The document will also provide guidelines for resolvers on appropriate
		use of out-of-zone data in answers.

The document can not require the use of either multiple ports or addresses as
that is an operational issue and should be addressed in a separate document
in DNSOP.

Exact use of the 2119 words above should be tuned by the working group.

Draft Time line:
	Jan 08'th Chair announces document is adopted
	Jan 15'th first WG version
	Feb 15'th final WG document
	Feb 29'th WGLC
	Mar 30'th advance to IESG.

	Olafur the document shepherd for this document 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>