Subject: Re: [DNSOP] Fracturing the protocol - was Re: Updated cheese-shop.

From: Philip Homburg <[email-masked]>
Date: Tue, 01 Mar 2016 12:16:28 +0100

>Yes, ANC breaks using the DNS for Internet reachability testing.
>
>Named has code to return zero TTLs on negative answers to SOA queries
>to avoid polluting caches with NXDOMAIN results when searching for
>zone cuts.  Nsupdate and similar tools need to be able to find the
>containing zone of names that are about to be added and cached
>NXDOMAIN responses are a right-royal-pain-in-the-butt if you want
>to lookup the name just after you have added it to the DNS.

Did you ever consider making this work assuming more aggressive negative
caching?

It seems to me that deploying code under the assumption of only limited
caching of negative results is a good way to block all kinds of future
work, or alternatively, you may be in for a lot of pain if other people
decide that negative caching is more important.

For example, if you are about to add foo.example.com and you want to find
the zone cut, then looking up $DOES_NOT_EXIST.example.com will give you
the zone cut without revealing anything about 'foo'.

If you want to test something, create a zone that is designed to be tested,
for example, one with low ttls everywhere.

---

From: Tony Finch <[email-masked]>
Date: Tue, 1 Mar 2016 11:39:31 +0000

Mark Andrews <[email-masked]> wrote:
> In message <[email-masked]>, "John Levine" writes:
> >
> > >You could apply the technique to any signed zone where you are not
> > >worried about not having instant visibility after adding a new name
> > >to the zone.
> >
> > I don't understand this.  If I ask for foo.example and get NXDOMAIN,
> > and 10 ms later you add a record at foo.example, my negative answer is
> > cached for your SOA TTL is.
>
> For 99.999999999% of names you don't look them up unless you have
> a priori knowledge that the name exist.

Having done this myself, I think there are several situations in which it
is common to look up a name shortly before adding it to a zone. e.g. you
expect a name to exist, whoops, fix the omission, then have to wait a TTL.
Or you are trying to come up with a domain name that hasn't already been
registered and you forget to send the query to the TLD servers instead of
the local cache.

Can be quite annoying if the TTL is long. Even so, I like aggressive
negative cacheing.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Forties, Cromarty, Forth, Tyne, Dogger, Fisher, German Bight, Humber: South,
veering west, 6 to gale 8, occasionally severe gale 9 in Forties and Fisher,
decreasing 4 or 5 for a time. Moderate or rough, occasionally very rough.
Occasional rain or snow, fog patches. Moderate or poor, occasionally very
poor.

---

From: Mark Andrews <[email-masked]>
Date: Tue, 01 Mar 2016 23:16:12 +1100

> Did you ever consider making this work assuming more aggressive negative

It requires caches to not do ANC for SOA lookups or for there to
be a explict option to not do ANC.

Searching for containing zone is just a real life example of the
impact of getting a NXDOMAIN when you don't want it as a side effect
of something else.

> decide that negative caching is more important.

ANC was deliberatedly decided against when DNSSEC was being developed
to avoid all of these issues.  DNSSEC secured the DNS, it did not
change the semantics of the lookups.  ANC changes the semantics of
the DNS.

> the zone cut without revealing anything about 'foo'.

No it doesn't.  The zone cut may be foo.example.com.  You can't
avoid making a query for foo.example.com.  Looking for
$DOES_NOT_EXIST.example.com does not tell you which zone contains
foo.example.com.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mark Andrews <[email-masked]>
Date: Tue, 01 Mar 2016 23:35:53 +1100

> registered and you forget to send the query to the TLD servers instead of

Accidents vs doing it every time you add a new machine / service
is very different proposition.

---

From: "John R Levine" <[email-masked]>
Date: 1 Mar 2016 09:13:03 -0500

> registered and you forget to send the query to the TLD servers instead of

If these is the worst problems that ANC causes, I think we agree they're 
not all that bad.

> Can be quite annoying if the TTL is long. Even so, I like aggressive

Same here.  It solves real problems for things like IPv6 rDNS lookups.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

---

From: Philip Homburg <[email-masked]>
Date: Tue, 01 Mar 2016 16:00:14 +0100

>change the semantics of the lookups.  ANC changes the semantics of

So, if there is good enough motivation for ANC, then maybe NSEC could
have been invented independently.

>$DOES_NOT_EXIST.example.com does not tell you which zone contains

In the unlikely event you want to update information at an apex, instead
inserting names that are not supposed to exists at all, and you are
also not aware you are inserting at apex, you can also
use $DOES_NOT_EXIST.foo.example.com