Subject: [DNSOP] My "toxic" remark at the mic today

From: Andrew Sullivan <[email-masked]>
Date: Wed, 4 Nov 2015 23:47:29 -0500

Hi,

Today I went to the mic in response to Stéphane's question about DNAME
in the root zone.  I gather the point I was trying to make wasn't clear.

What I understood Stéphane to be saying was that the IETF ought to
take a position on whether it'd be a good idea to put a DNAME record
into the root zone.  This is the thing I think would be toxic.  I
don't believe we should have any opinion at all about what stuff
should go into the root zone (though I can imagine having an idea
about what stuff _should not_).

I don't think there's a problem with the WG saying that there isn't a
problem putting records of this or that type into the root.  If that's
all the document was intended to say, I guess I wouldn't care.  Is
there a document that says not to put such a record into the root,
however?  If not, why should DNSOP say anything about this?  It seems
like a job for SSAC to me.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: "Paul Hoffman" <[email-masked]>
Date: Thu, 05 Nov 2015 15:32:43 +0900

On 5 Nov 2015, at 13:47, Andrew Sullivan wrote:

> Is
> however?

No, but there is an RFC from the IAB about what labels should not be 
into the root without further consideration: RFC 4690. That has been 
widely interpreted as "do not put X into the root", so it is similar to 
"do not put RRtype Y into the root".

> If not, why should DNSOP say anything about this?

Because people in the DNSOP WG may have data about the security or 
stability implications of DNAME in busy zones such as the root.

--Paul Hoffman

---

From: "John Levine" <[email-masked]>
Date: 5 Nov 2015 10:50:09 -0000

>Is there a document that says not to put such a record into the root,

IANA has a variety of policies which appear to me to say that the only
things that they will put into the root are NS, DS, and glue.

On the other hand, there's at least one delegated TLD that has a DNAME
at the apex.  It's been around for several years, it seems to work OK.
I don't see a lot of operational difference between that and putting
the DNAME directly into the root zone.  Management differences, sure,
but not operational.  I realize this is not the same use case as using
DNAMEs to shed queries for special names, but it's a DNAME and its at
the top level.

I'm not sure how toxic it is, but I agree that we are unlikely to have
anything useful to say on the topic.

R's,
John

---

From: Tony Finch <[email-masked]>
Date: Thu, 5 Nov 2015 11:54:39 +0000

> at the apex.  It's been around for several years, it seems to work OK.

$ dig axfr . |
  sed -E '/^([a-z0-9-]+)[.][ 	].*/!d;s//\1/' |
  sort -u | while read d; do
  dig +noall +answer DNAME $d.; done
xn--kprw13d.            86400   IN      DNAME   xn--kpry57d.
xn--mgba3a4f16a.        1440    IN      DNAME   xn--mgba3a4f16a.ir.

Scanning the root zone is getting slow without concurrency :-) The above
takes 3 minutes from a cold cache whereas adns takes 12 seconds (though
you have to hack round its lack of support for DNAME).

$ dig axfr . |
  sed -E '/^([a-z0-9-]+)[.][ 	].*/!d;s//sladjfhkjlasdhf.\1./' |
  sort -u | adnshost --asynch --pipe --type cname | grep CNAME
sladjfhkjlasdhf.xn--kprw13d CNAME sladjfhkjlasdhf.xn--kpry57d
sladjfhkjlasdhf.xn--mgba3a4f16a CNAME sladjfhkjlasdhf.xn--mgba3a4f16a.ir

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Trafalgar: Southwesterly 4 or 5, increasing 6 or 7 in northwest. Moderate or
rough. Showers. Good, occasionally moderate.

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 5 Nov 2015 22:54:56 -0500

On Thu, Nov 05, 2015 at 03:32:43PM +0900, Paul Hoffman wrote:
> No, but there is an RFC from the IAB about what labels should not be into
> the root without further consideration: RFC 4690. That has been widely
> interpreted as "do not put X into the root", so it is similar to "do not put
> RRtype Y into the root".

With respect, labels and RRTYPEs are quite different things.  I think
perhaps conflating these two things is not super helpful.  But I don't
have a strong feeling about this, so long as we're not saying anything
that can be construed as positive advice about what should go into the
zone.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: "Patrik Fältström" <[email-masked]>
Date: Fri, 06 Nov 2015 07:07:39 +0100

SSAC wrote about DNAME in March 2006 in SAC-009 ("Alternative TLD Name Systems and Roots: Conflict, Control and Consequences"):

> Recommendation (1): ICANN and the community at large should take appropriate measures to ensure that a thorough analysis of two candidate methods for encoding strings in TLD labels - DNAME Equivalence Mappings and use of IDNA encodings – is concluded quickly. Based on the conclusions and recommendations of parties responsible for this analysis, ICANN should adopt the preferred method.

Unfortunately I can not remind myself that recommendation has been followed...

On top of this,  SAC-053 ("SSAC Report on Dotless Domains") where SSAC have the following recommendation:

> Recommendation: Dotless domains will not be universally reachable and the SSAC recommends strongly against their use. As a result, the SSAC also recommends that the use of DNS resource records such as A, AAAA, and MX in the apex of a Top- Level Domain (TLD) be contractually prohibited where appropriate and strongly discouraged in all cases.

Let me remind people SSAC recommendations do only have weight based on the quality of the report itself. There is no requirement for anyone to follow the recommendations. That said, ICANN Board must take SSAC (and other ICANN AC) advisories and recommendations into account, i.e. at least explain why the advice was not followed.

   Patrik Fältström
   SSAC Chair

---

From: "Patrik Fältström" <[email-masked]>
Date: Fri, 06 Nov 2015 07:10:11 +0100

> anything useful to say on the topic.

Speaking personally, I do not see DNAME toxic, but the question has almost always been:

- Whether clients do handle DNAME correctly
- How to resolve an interest for having DNAME "work" for the zone apex itself

I think the 2nd of these is a non-issue if "we" do have the assumption data in TLDs are "delegation only", which I do know is not true for all TLDs, but it is still what i personally think is the best to do.

   Patrik

---

From: "Patrik Fältström" <[email-masked]>
Date: Fri, 06 Nov 2015 07:11:35 +0100

> that can be construed as positive advice about what should go into the

Paul, you are sure you talk about RFC4690 and not RFC5507?

Being one of the editors of RFC5507 (and 4690!) let me emphasize what Andrew wrote here. Yes, maybe people have conflated and simplified what we wrote, but the RFC is actually trying to be very very careful with wording and it would be said if text that once was very specific once again end up being watered down.

The key message in RFC5507 is that one should minimize the RRSet size, and think carefully if the selection criteria between RR is in the RRType or owner.

   Patrik

---

From: "John R Levine" <[email-masked]>
Date: 6 Nov 2015 16:17:54 +0900

> Speaking personally, I do not see DNAME toxic, but the question has almost always been:

To clarify, it's us offering advice on what goes into the root zone that's 
toxic, not dname specifically.

> I think the 2nd of these is a non-issue if "we" do have the assumption 
> data in TLDs are "delegation only", which I do know is not true for all 
> TLDs, but it is still what i personally think is the best to do.

The dnames for the Taiwan and Iran TLDs appear to work fine.

There are TLDs with A, AAAA, and MX records (see RFC 7085) but there 
aren't many, and if they wanted to use dnames, they could deal with it.

R's,
John

PS: The dnames in .cat don't work at all, but apparently nobody cares.

---

From: "Joe Abley" <[email-masked]>
Date: Fri, 06 Nov 2015 09:44:06 -0500

On 6 Nov 2015, at 2:17, John R Levine wrote:

> To clarify, it's us offering advice on what goes into the root zone 
> that's toxic, not dname specifically.

I get the distinction.

To the tangential point of whether it's reasonable or practical to have 
DNAME in the root zone (side-stepping the issue you were talking about, 
about who should have opinions about that and who should make decisions) 
there was some work commissioned by ICANN a number of years ago and 
carried out by João Damas to evaluate the behaviour of many different 
code bases to a root zone that contained DNAME. The context of that work 
was the potential solution to use DNAME in the root zone to provision 
variant IDN TLDs (see ICANN board resolution 10 adopted on 12 March 
2010), but the report was arguably general enough to be instructive in 
this different context.

https://www.icann.org/resources/board-material/resolutions-2010-03-12-en#10
   https://www.icann.org/news/announcement-2011-05-24-en

Additionally, there was an experiment carried out to quantify the 
availability of DNAME support in the real world for AS112 by George 
Michaelson and Geoff Huston. The results are documented in an appendix 
of RFC 7535.

Joe

---

From: "John Levine" <[email-masked]>
Date: 7 Nov 2015 08:11:27 -0000

>2010), but the report was arguably general enough to be instructive in 

The only gTLDs I'm aware of that are set up to be the same are .NGO
and .ONG.  They do it with paired zones, the same except for the
DNSSEC keys.  Are there any others?

R's,
John