Subject: [weirds] Determining the registered domain

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 2 Apr 2012 17:56:23 +0000

This has come up in other work a few times, and I'm wondering how the names folks here might see this being handled by WEIRDS, if at all.

Suppose I am asked to evaluate the domain name foo.bar.baz.ietf.org.  It's not in the DNS directly, though related records like SOA and NS do exist.  Depending on how the DNS is set up, an SOA query on the name might return "ietf.org", which is far more useful.  But this also might not be the case (if, say, "baz" is delegated).

Do the names people think that this work could support the idea of doing a lookup in a way that requests the registration that "contains" the name being submitted?  Or are we looking at only exact matches?

Some groups have taken to using public suffix lists, but those have their own sets of problems, most notably that they are maintained by volunteers and may not be kept as current as would be desired in, say, a security-related environment.

-MSK

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 2 Apr 2012 14:23:04 -0400

> Suppose I am asked to evaluate the domain name foo.bar.baz.ietf.org.  It's not in the DNS directly, though related records like SOA and NS do exist.  Depending on how the DNS is set up, an SOA quer…

I don't understand the scenario.

If you do an SOA query for foo.bar.baz.ietf.org, then if that's not
the apex you get the SOA record in the authority section.  If it _is_
the apex you get the SOA in the answer section.

If you get the SOA for ietf.org in the authority section, then
baz.ietf.org can't possibly be delegated, because there'd be an SOA at
baz.ietf.org which would be the SOA in the authority section.

> Do the names people think that this work could support the idea of
> doing a lookup in a way that requests the registration that
> "contains" the name being submitted?  Or are we looking at only
> exact matches?
 
You're thinking something like `weirds --server authority-for-org
--target my.deep.labels.example.org`, and example.org is delegated,
and you get the answer back "ask the people at example.org", just the
way we get in the DNS?  I have no objection to this myself, but we'll
need to reproduce the label-by-label logic of STD13.

> Some groups have taken to using public suffix lists, but those have
> their own sets of problems, most notably that they are maintained by
> volunteers and may not be kept as current as would be desired in,
> say, a security-related environment.

Right.  Also, they seem to have funny ideas about things like empty
non-terminals.  I think anything that gets us away from assertions by
others about domain name policies is a good thing.

A

-- 
Andrew Sullivan
[email-masked]

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 2 Apr 2012 18:28:16 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Andrew Sullivan
> Sent: Monday, April 02, 2012 11:23 AM
> To: [email-masked]
> Subject: Re: [weirds] Determining the registered domain
> 
> If you do an SOA query for foo.bar.baz.ietf.org, then if that's not the
> apex you get the SOA record in the authority section.  If it _is_ the
> apex you get the SOA in the answer section.
> 

That's what I mean: If baz is delegated, you get baz's SOA, while "ietf.org" is the domain that's actually registered, so in DNS terms I got what I asked for but only because I'm not able to ask the right question.  So using the SOA to find out the registration point is unreliable for this purpose.

> You're thinking something like `weirds --server authority-for-org --
> target my.deep.labels.example.org`, and example.org is delegated, and
> you get the answer back "ask the people at example.org", just the way
> we get in the DNS?  I have no objection to this myself, but we'll need
> to reproduce the label-by-label logic of STD13.

I'm thinking more like:

	weirds --server=x --target=foo.bar.baz.ietf.org

...and getting back a reply of "ietf.org" with whatever other data attached to it.

-MSK

---

From: Edward Lewis <[email-masked]>
Date: Mon, 2 Apr 2012 14:47:59 -0400

>I don't understand the scenario.

Ditto.

There really isn't a difference between names and numbers.  (Maybe 
that isn't what you are asking about, but that's what I jumped to.)

Let's say you have 127.0/20, which is part of 127.0/18 at an ISP, 
127.0/17 at an NIR, and 127.0/16 at an RIR.

The question might arise, who's responsible for 127.0.223.108 and 
what can be said about them?  The best place to get information would 
be from the one with the allocation (127.0/20) or better yet the ISP. 
If not the ISP then the NIR.  In any case, there's one place that 
will have the mapping of the network (and the particular address) to 
an appropriate contact.  No matter how many times the space is 
divided, reallocated, reassigned, there's one final authority mapping 
it into people space.

As far as a delegated name like foo.bar.baz.ietf.org, it belongs to 
one and only one zone.  First, find that zone and you will get to the 
administrator responsible.  That might be the registry (a "thick" 
one) or a registrar (for a "thin" registry), or a registrant who has 
delegated a zone inside what they have registered at a TLD.

Names or numbers - there is an authority that is maintaining the 
mapping of object to person.  (Person may be an organization or 
role.)  The authority is designated through the formal channels to 
some point, where it may become informal.  In numbers it is IANA to 
RIR (to NIR) to ISP/LIR (to organization) to user.  Usually user has 
no records of themselves.  In names it is IANA to TLD to SLD to user. 
Pretty much the same.  The DNS is just reporting this.

(Also - there are many questions about "reverse DNS" and DNS.  To the 
DNS, they are both the same.   But people seem to think there's a 
difference.  There isn't.)

>	weirds --server=x --target=foo.bar.baz.ietf.org

Here you are specifying the authority (it's server x) and the mapping 
you want.  The question of knowing what server (x) to use has to be 
solved by the protocol.   WhoIs (port 43) clients have even solved 
this already.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

2012...time to reuse those 1984 calendars!

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 2 Apr 2012 19:01:27 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Edward Lewis
> Sent: Monday, April 02, 2012 11:48 AM
> To: [email-masked]
> The question might arise, who's responsible for 127.0.223.108 and what
> can be said about them?  The best place to get information would be
> from the one with the allocation (127.0/20) or better yet the ISP.
> If not the ISP then the NIR.  In any case, there's one place that will
> have the mapping of the network (and the particular address) to an
> appropriate contact.  No matter how many times the space is divided,
> reallocated, reassigned, there's one final authority mapping it into
> people space.

I want the closest/tightest/lowest/etc. assignment that's available.  In your case, that's 127.0/20.  And I should be able to walk up the chain if I want to.  (At least with the RESTful implementation at ARIN, that's what I get now, so I'm happy.)

> As far as a delegated name like foo.bar.baz.ietf.org, it belongs to one
> and only one zone.  First, find that zone and you will get to the

Right, for names, I want the closest/tightest/lowest/etc. assignment that's available.  So for "foo.bar.baz.ietf.org", I want it to give me "ietf.org", which is the registered domain name.  The DNS can't give me this unless there are no zones delegated below ietf.org, which isn't guaranteed.

To some degree, I shouldn't have to care about RIR/LIR/NIR/ISP or thick/thin/DNS.  I just want the answer.  I don't necessarily need to be able to specify that I also want the list of relationships back to the root, though I imagine that might also be useful to some applications.

> role.)  The authority is designated through the formal channels to some
> point, where it may become informal.  In numbers it is IANA to RIR (to
> NIR) to ISP/LIR (to organization) to user.  Usually user has no records
> of themselves.  In names it is IANA to TLD to SLD to user.

The DNS is not reporting it reliably.  You'd be making some assumptions about how a given organization has laid out its DNS topology.

-MSK

---

From: Edward Lewis <[email-masked]>
Date: Mon, 2 Apr 2012 15:29:25 -0400

At 19:01 +0000 4/2/12, Murray S. Kucherawy wrote:

>I want the closest/tightest/lowest/etc. assignment that's available.  In
>your case, that's 127.0/20.  And I should be able to walk up the chain if
>I want to.

Outside of adding "walk up the chain if I have to" I agree.  If the 
"tightest" binding (127.0/20) is held by an organization that is 
hiding something, you might have to start a fight up a level.  (Note, 
I'm assuming this in a hostile context.)

>To some degree, I shouldn't have to care about RIR/LIR/NIR/ISP or
>thick/thin/DNS.  I just want the answer.

Good, that's the right goal.  It's not the delegation hierarchy you 
need, it's the contact or other relevant ancillary data you need for 
the object in question.  However, the hierarchy is needed if there's 
"an obstruction."

>The DNS is not reporting it reliably.  You'd be making some assumptions
>about how a given organization has laid out its DNS topology.

Okay, I started out saying "DNS is reporting" but the DNS is not 
really reporting.  The DNS is a report of what is in the database 
(that is the heart of any registration activity) but is hardly 
complete.  (If it was, there's no WhoIs or WEIRDS work.)  The DNS is 
just publishing some data about names representing objects.

WhoIs/WEIRDS is set up to give out other kinds of information, 
chiefly the contacts (in as much as the DNS is chiefly about giving 
addresses).  The source of that isn't the DNS, but the database 
behind the DNS.

Where the DNS can play a role here is helping WhoIs/WEIRDS clients 
find the addresses of the WhoIs/WEIRDS servers.  The one weakness of 
DNS is "going up" and that is something that might be needed to get 
around a WhoIs/WEIRDS server that is trying to hide something (as in 
"start a fight up a level").

---

From: Peter Koch <[email-masked]>
Date: Fri, 13 Apr 2012 14:18:55 +0200

> Suppose I am asked to evaluate the domain name foo.bar.baz.ietf.org.  It's not in the DNS directly, though related records like SOA and NS do exist.  Depending on how the DNS is set up, an SOA quer…

registration and delegation are orthogonal concepts.  There is delegation with and
without "registration' and there is also registration with and without delegation.
The hierarchy in the DNS forward namespace does neither follow nor imply any
administrative hierarchy.  Anything that uses the DNS must not depend on the presence
or absence of zone cuts, since these are operational boundaries only that
in some cases can be created and revoked at will.

> Some groups have taken to using public suffix lists, but those have their own sets of problems, most notably that they are maintained by volunteers and may not be kept as current as would be desire…

Some groups also believe that domain names consist of three parts, the leftmost
of which is "www".   The "public suffix list" is a heuristic and, IMHO, addressing
the wrong problem.  I'd wish that nothing like this (to refer to your initial question)
will have any relevance in WEIRDS.

-Peter

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 13 Apr 2012 15:07:15 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Peter Koch
> Sent: Friday, April 13, 2012 5:19 AM
> To: [email-masked]
> the wrong problem.  I'd wish that nothing like this (to refer to your
> initial question) will have any relevance in WEIRDS.

Right, it's the use of public suffix stuff that I'm hoping that either WEIRDS or other work can obviate.

-MSK