Subject: [dns-privacy] Resolver to authoritative discussion guidance

From: Brian Haberman <[email-masked]>
Date: Thu, 19 Jul 2018 14:10:20 -0400

All,
     The chairs would like to get the WG discussion started on exploring
privacy solutions for recursive resolver to/from authoritative server
exchanges. To start, we want to focus on *use cases and requirements*.
In our view, the WG needs to consider the:

    - User perspective
    - Implementer perspective
    - 2nd-level server operator perspective
    - Recursive resolver operator perspective

     For the time being, we would like to bypass the TLD server operator
perspective. While we are in this phase of discussion, the chairs would
like everyone to follow these guidelines:

    - Focus on *what* is needed.
    - Avoid *how* to achieve it.
    - Consider both ends of DNS the exchange.
    - Scenarios will frame the discussion.

     The chairs will start a mailing list thread for each of the four
discussion points. As ideas are presented, we will start aggregating the
details in a GitHub repo.

Regards,
Brian & Tim

---

From: Tim Wicinski <[email-masked]>
Date: Thu, 19 Jul 2018 14:30:52 -0400

Also

If you feel the chairs are missing some aspect of this, please speak up and
let's make sure those are covered.

thanks
Tim

On Thu, Jul 19, 2018 at 2:10 PM, Brian Haberman <[email-masked]>
wrote:

> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy
>
>

---

From: Jim Reid <[email-masked]>
Date: Thu, 19 Jul 2018 19:56:23 +0100

>     - Focus on *what* is needed.

This seems wrong to me. Sorry.

If TLD operators are to be bypassed at this stage, how can the WG get a clear understanding of what's needed? I think operators of "important" auth servers have to be part of the discussion from the outset. If not, the WG may well come up with a solution that busy authoritative servers can't or won't deploy.

---

From: Tim Wicinski <[email-masked]>
Date: Thu, 19 Jul 2018 15:00:32 -0400

Jim

We're not ignoring TLD operators. But the TLD operator space is not 100%
technical, and we feel that the work done with the SLD space will be
applicable to the TLD space.
We also feel that working on the TLD resolver issue will rathole thinking
into non-technical issues.

If you think this is incorrect, we'd like to hear that.

Tim

On Thu, Jul 19, 2018 at 2:56 PM, Jim Reid <[email-masked]> wrote:

> If TLD operators are to be bypassed at this stage, how can the WG get a
> clear understanding of what's needed? I think operators of "important" auth
> servers have to be part of the discussion from the outset. If not, the WG
> may well come up with a solution that busy authoritative servers can't or
> won't deploy.
>
>

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Thu, 19 Jul 2018 19:28:42 +0000

From: dns-privacy <[email-masked]> On Behalf Of Tim Wicinski
Sent: Thursday, July 19, 2018 3:01 PM
To: Jim Reid <[email-masked]>
Cc: Brian Haberman <[email-masked]>; [email-masked]
Subject: [EXTERNAL] Re: [dns-privacy] Resolver to authoritative discussion guidance

Jim

We're not ignoring TLD operators. But the TLD operator space is not 100% technical, and we feel that the work done with the SLD space will be applicable to the TLD space.

We also feel that working on the TLD resolver issue will rathole thinking into non-technical issues.

[SAH] Perhaps a little “stick to the technical issues” guidance would be sufficient to allow discussion of all authoritative server operational use cases.

Scott

---

From: Tim Wicinski <[email-masked]>
Date: Thu, 19 Jul 2018 16:17:17 -0400

Scott

Valid Point.    My one thought of holding off is that they are essential a
different size (usually) of the same coin.
For example, Verisign has .com which is quite large.  My Employer has
domains at the SLD issue that 'currently' has > 100MM records.

Are the difference serving records vs serving delegations?

Tim

On Thu, Jul 19, 2018 at 3:28 PM, Hollenbeck, Scott <[email-masked]

> *From:* dns-privacy <[email-masked]> *On Behalf Of *Tim
> Wicinski
> *Sent:* Thursday, July 19, 2018 3:01 PM
> *To:* Jim Reid <[email-masked]>
> *Cc:* Brian Haberman <[email-masked]>; [email-masked]
> *Subject:* [EXTERNAL] Re: [dns-privacy] Resolver to authoritative
> discussion guidance
>
>
>
> Jim
>
>
>
> *[SAH] Perhaps a little “stick to the technical issues” guidance would be
> sufficient to allow discussion of all authoritative server operational use
> cases.*
>
>
>
> Scott
>

---

From: Jim Reid <[email-masked]>
Date: Thu, 19 Jul 2018 21:43:41 +0100

On 19 Jul 2018, at 21:17, Tim Wicinski <[email-masked]> wrote:
> 
> For example, Verisign has .com which is quite large.  My Employer has domains at the SLD issue that 'currently' has > 100MM records. 
> 

I doubt response sizes will be markedly different. Or at least not enough to matter much. What should be important is the query rate. If an authoritative server is getting thousands++ of queries per second -- most likely TLD and root servers -- what's the impact when much of that traffic goes over TLS? If I ran such a server, I'd be very reluctant to switch on DNS over TLS (or DOH or whatever). And even less likely to do that if this WG starts from a problem statement which excludes my PoV.

Some TLD operators may well be less clueful than others. However as Scott said sticking to the technical issues should mean the WG gets a more complete picture of the use cases.

An important constituency didn't engage in the development of DNSSEC-bis, refused to deploy it and that's why we got DNSSEC-ter. OK, that's an over-simplification. But it shows what might happen in this WG if some use cases and requirements get overlooked.

---

From: Tim Wicinski <[email-masked]>
Date: Thu, 19 Jul 2018 16:47:04 -0400

OK,  I'll chat with Brian since he's in charge of sending those emails for
now, and go there.

Tim

On Thu, Jul 19, 2018 at 4:43 PM, Jim Reid <[email-masked]> wrote:

> I doubt response sizes will be markedly different. Or at least not enough
> to matter much. What should be important is the query rate. If an
> authoritative server is getting thousands++ of queries per second -- most
> likely TLD and root servers -- what's the impact when much of that traffic
> goes over TLS? If I ran such a server, I'd be very reluctant to switch on
> DNS over TLS (or DOH or whatever). And even less likely to do that if this
> WG starts from a problem statement which excludes my PoV.
>
> Some TLD operators may well be less clueful than others. However as Scott
> said sticking to the technical issues should mean the WG gets a more
> complete picture of the use cases.
>
> An important constituency didn't engage in the development of DNSSEC-bis,
> refused to deploy it and that's why we got DNSSEC-ter. OK, that's an
> over-simplification. But it shows what might happen in this WG if some use
> cases and requirements get overlooked.
>
>

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Thu, 19 Jul 2018 20:48:27 +0000

From: Tim Wicinski <[email-masked]>
Sent: Thursday, July 19, 2018 4:47 PM
To: Jim Reid <[email-masked]>
Cc: Hollenbeck, Scott <[email-masked]>; [email-masked]; [email-masked]
Subject: [EXTERNAL] Re: [dns-privacy] Resolver to authoritative discussion guidance

OK,  I'll chat with Brian since he's in charge of sending those emails for now, and go there.

Thank you!

Scott