Subject: [DNSOP] New Version Notification for draft-bortzmeyer-dname-root-02.txt

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 29 Apr 2016 15:57:27 +0200

No objection from the AS112 operators was received. Now, what do you
think of this draft? Should we continue or is it a bad idea (or a good
one, but hopeless?)

Subject: New Version Notification for draft-bortzmeyer-dname-root-02.txt
From: [email-masked]
To: "Stephane Bortzmeyer" <[email-masked]>
Date: Fri, 29 Apr 2016 06:46:59 -0700

A new version of I-D, draft-bortzmeyer-dname-root-02.txt
has been successfully submitted by Stephane Bortzmeyer and posted to the
IETF repository.

Name:		draft-bortzmeyer-dname-root
Revision:	02
Title:		Using DNAME in the DNS root zone for sinking of special-use TLDs
Document date:	2016-04-29
Group:		Individual Submission
Pages:		7
URL:            https://www.ietf.org/internet-drafts/draft-bortzmeyer-dname-root-02.txt
Status:         https://datatracker.ietf.org/doc/draft-bortzmeyer-dname-root/
Htmlized:       https://tools.ietf.org/html/draft-bortzmeyer-dname-root-02
Diff:           https://www.ietf.org/rfcdiff?url2=draft-bortzmeyer-dname-root-02

Abstract:
   This documents asks IANA to add DNAME records in the DNS root zone
   for TLDs which are in the Special-Use Domain Names registry, in order
   to ensure they receive an appropriate reply (NXDOMAIN) and that the
   root nameservers are not too bothered by them.

   REMOVE BEFORE PUBLICATION: there is no obvious place to discuss this
   document.  May be the IETF DNSOP (DNS Operations) group, through its
   mailing list (the author reads it).  Or may AS112 operators mailing
   lists?  The source of the document, as well as a list of open issues,
   is currently kept at Github [1].

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Shane Kerr <[email-masked]>
Date: Fri, 29 Apr 2016 16:31:15 +0200

Stephane,

At 2016-04-29 15:57:27 +0200

> think of this draft? Should we continue or is it a bad idea (or a good

I think I said this in person but I don't know if I ever wrote it down.

I think that there may be some decreased privacy since queries for
these zones are going to be sent to basically anonymous servers instead
of root servers. Certainly for something like .ONION this is less
desirable.

OTOH, anyone using such a zone faces operator error causing such leaks
in any case. Indeed having these queries show up at the root is also
the result of DNS administrator misconfiguration. Also, any attacker
interested in looking at such queries has alternate ways of seeing such
traffic even today (via BGP tricks at least). The actual extra leakage
is minimal.

If the proposal does go forward (I really have no feeling whether it is
useful or not), then perhaps this can be mentioned in the "Possible
issues" section?

Cheers,

--
Shane

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 29 Apr 2016 16:35:41 +0200

On Fri, Apr 29, 2016 at 04:31:15PM +0200,
 Shane Kerr <[email-masked]> wrote 

> I think I said this in person but I don't know if I ever wrote it

You did :-)

> If the proposal does go forward (I really have no feeling whether it
> is useful or not), then perhaps this can be mentioned in the
> "Possible issues" section?
 
It is in Security Considerations. Isn't it the best place?