Subject: [DNSOP] Fwd: New Version Notification for draft-bellis-dnsext-multi-qtypes-02.txt

From: Ray Bellis <[email-masked]>
Date: Thu, 14 Apr 2016 18:16:44 +0100

Since this seems to be of at least some interest again I've resurrected
this draft from its expired state.

The main comment I had first time around was that it appeared to be
unnecessary to include the count of the QTYPEs within the OPT wire
format since that can be intuited from the overall length of the RDATA.

It was also suggested that the QTD bit could be replaced with using one
OPT code point for requests and another for responses.  I do not favour
this approach, since no other OPT RR uses it.  Arguably there should be
a better way in EDNS to differentiate a true response from a dumb echo...

Ray

-------- Forwarded Message --------
Subject: New Version Notification for
draft-bellis-dnsext-multi-qtypes-02.txt
Date: Thu, 14 Apr 2016 10:09:47 -0700
From: [email-masked]
To: Ray Bellis <[email-masked]>

A new version of I-D, draft-bellis-dnsext-multi-qtypes-02.txt
has been successfully submitted by Ray Bellis and posted to the
IETF repository.

Name:		draft-bellis-dnsext-multi-qtypes
Revision:	02
Title:		DNS Multiple QTYPEs
Document date:	2016-04-13
Group:		Individual Submission
Pages:		6
URL:
https://www.ietf.org/internet-drafts/draft-bellis-dnsext-multi-qtypes-02.txt
Status:
https://datatracker.ietf.org/doc/draft-bellis-dnsext-multi-qtypes/
Htmlized:
https://tools.ietf.org/html/draft-bellis-dnsext-multi-qtypes-02
Diff:
https://www.ietf.org/rfcdiff?url2=draft-bellis-dnsext-multi-qtypes-02

Abstract:
   This document specifies a method for a DNS client to request
   additional DNS record types to be delivered alongside the primary
   record type specified in the question section of a DNS query.

---

From: Mark Andrews <[email-masked]>
Date: Fri, 15 Apr 2016 14:19:30 +1000

> a better way in EDNS to differentiate a true response from a dumb echo...

Or we could just complain to the operators of the servers that echo
EDNS options and request that they fix them.  It's not like it isn't
a fixable problem.  It just requires a little co-operation to find
and report broken servers to the operators and willingness to follow
through when servers are not fixed.

Below is list of servers that echo unknown EDNS options and don't
also return BADVERS / FORMERR from yesterdays EDNS compliance run.

a.ns.mtgsy.com, acerinternet.acer.edu.au, audns02.ibisworld.com.au,
aunddwgdns01.didata.com.au, azdpsdns.dps.state.az.us,
azdpsdnsii.dps.state.az.us, bloodaxe.iad.gov, bloodgem.iad.gov,
cns1.courts.state.tx.us, cns1.txcourts.gov, cns2.courts.state.tx.us,
cns2.txcourts.gov, copns3.phoenix.gov, copns4.phoenix.gov,
diamond.msha.gov, disa.tenet.ac.za, dns0.mtgsy.com, dns01.henley.com.au,
dns03.australiasoutheast.cloudapp.azure.com, dns1.chisholm.edu.au,
dns1.edmonds.wa.us, dns1.hcshostit.com, dns1.manchesterct.gov,
dns1.markum.net, dns1.netsource-one.net, dns1.springfieldcityhall.com,
dns1.uk.hub.oup.com, dns1.webstarthost.net.au, dns2.chisholm.edu.au,
dns2.hcshostit.com, dns2.jpc.qld.edu.au, dns2.manchesterct.gov,
dns2.markum.net, dns2.name-s.net, dns2.netsource-one.net,
dns2.springfieldcityhall.com, dns2.webstarthost.net.au, dns3.edmondswa.gov,
dns3.jpc.qld.edu.au, dns3.manchesterct.gov, dns3.mtgsy.com,
dns4.manchesterct.gov, dns4.mtgsy.com, dns4.perpetual.com.au,
doldns02.dol.com.tr, js2.objware.com.au, lv3ns1.ffdns.net,
lv3ns2.ffdns.net, lv3ns3.ffdns.net, lv3ns4.ffdns.net, lv4ns1.ffdns.net,
lv4ns2.ffdns.net, lv4ns3.ffdns.net, lv4ns4.ffdns.net,
name2.deloitte.com.au, name3.deloitte.com.au, ns-au1.xhostsolutions.net.au,
ns-au2.xhostsolutions.net.au, ns.acmi.net.au, ns.didata.com.au,
ns.hotelsaccommodation.com.au, ns.liturgyhelp.com.au, ns.media3.net,
ns.ouronlinecanteen.com.au, ns.studio-moderna.com, ns.trustdeed.com.au,
ns.tut.gov.tr, ns0.demysdns.net, ns0.stirling.wa.gov.au,
ns0.technique-ltd.co.uk, ns01.trademarkarea.com, ns1-03.azure-dns.com,
ns1-04.azure-dns.com, ns1.acnusa.net, ns1.aftrs.edu.au,
ns1.agfgnetwork.com, ns1.ahg.com.au, ns1.aic.gov.au,
ns1.andrewsairportpark.com.au, ns1.apra.gov.au, ns1.arlingtontx.gov,
ns1.bloggersllc.com, ns1.bupaagedcare.com.au, ns1.careerhub.com.au,
ns1.cityofnewportbeach.net, ns1.controlmyvps.com.au, ns1.cookeville-tn.org,
ns1.demysdns.net, ns1.dnsserver5.net, ns1.erie.gov, ns1.garlandtexas.net,
ns1.infoplum.com, ns1.maximumasp.com, ns1.msedge.net, ns1.mtco.com.au,
ns1.nashville.gov, ns1.newportbeachca.gov, ns1.polkcountyiowa.gov,
ns1.princegeorgescountymd.gov, ns1.rtomanager.com.au, ns1.sberbank.ru,
ns1.state.nv.us, ns1.stirling.wa.gov.au, ns1.tupperware.net,
ns1.vpsblocks.com.au, ns104.mschosting.com, ns1au.telethonkids.org.au,
ns2-03.azure-dns.net, ns2-04.azure-dns.net, ns2.acnusa.net,
ns2.ahg.com.au, ns2.alacourt.gov, ns2.andrewsairportpark.com.au,
ns2.apra.gov.au, ns2.arlingtontx.gov, ns2.aspcomputers.com.au,
ns2.auzgc.com, ns2.bloggersllc.com, ns2.careerhub.com.au,
ns2.cityofnewportbeach.net, ns2.demysdns.net, ns2.didata.com.au,
ns2.dnsserver5.net, ns2.erie.gov, ns2.ispnet.com.au,
ns2.mainroads.wa.gov.au, ns2.maximumasp.com, ns2.media3.net,
ns2.msedge.net, ns2.mtco.com.au, ns2.objware.com.au,
ns2.princegeorgescountymd.gov, ns2.sberbank.ru, ns2.state.nv.us,
ns2.studio-moderna.com, ns2.tupperware.net, ns3-03.azure-dns.org,
ns3-04.azure-dns.org, ns3-au.computershare.com, ns3.alacourt.gov,
ns3.bccdns.com, ns3.demysdns.net, ns3.elmtree.net.au, ns3.msedge.net,
ns3.rtomanager.com.au, ns3.scstatehouse.gov, ns3.tlr.net.au,
ns3.torqueit.com.au, ns3.tupperware.net, ns4-03.azure-dns.info,
ns4-04.azure-dns.info, ns4-au.computershare.com, ns4.demysdns.co.uk,
ns4.msedge.net, ns4.scstatehouse.gov, ns4.tlr.net.au, ns5.demysdns.co.uk,
ns5.elmtree.net.au, ns6.bluesoap.com.au, ns6.demysdns.co.uk,
offsite1.cmsit.com.au, otw-dns-1.gbst.com, otw-dns-2.gbst.com,
pbnedns2001.suncorpmetway.com.au, pbnedns2002.suncorpmetway.com.au,
pdcpns01.lionco.com, primary-dns.edmonds.wa.us, samappdn.samsung.com.sg,
samappdnc.samsung.com.sg, samapsdn.samsung.com.sg,
samapsdnc.samsung.com.sg, sdcpns01.lionco.com, sdns1.miamidade.gov,
sdns2.miamidade.gov, sdns3.miamidade.gov, secdns.sharp.net.au,
server01.cub.com.au, spdns2.pima.gov, spdns3.pima.gov,
storagemanager.controlmyvps.com.au, utc.utcourts.gov, vdns1.asi.com.au,
vdns2.asi.com.au, vdns3.asi.com.au, vmh18607.hosting24.com.au

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Ray Bellis <[email-masked]>
Date: Fri, 15 Apr 2016 08:07:24 +0100

> also return BADVERS / FORMERR from yesterdays EDNS compliance run.

I'm more concerned by the dumb CPE devices that do the same but aren't 
detected by your (very useful) survey.

Ray

---

From: Mark Andrews <[email-masked]>
Date: Fri, 15 Apr 2016 21:00:34 +1000

> detected by your (very useful) survey.

Most dumb CPE devices don't do EDNS at all or just proxy it from a
recursive server.  If they are broken then the owner will find out
and replace it.

If you really needed to know if a CPE device is broken send a EDNS
COOKIE.  If it is echoed back it is broken but will also let you
know the reply isn't spoofed.  If you get a SERVER COOKIE that
should be a good (not perfect) indication that EDNS options are
well handled.

Mark

> Ray
> 
> 
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop