Subject: Re: [DNSOP] DNS Delegation Requirements

From: "Jakob Schlyter" <[email-masked]>
Date: Mon, 19 Sep 2016 12:49:43 +0200

(very very delayed reply, rebooting draft now...)

On 2016-03-17 at 22:45, John Kristoff wrote:

> The introduction lists 8 areas of interest.  All, except "7. Name
> Server" have their own section in the table of contents.  Oversight?

Yes, one section was missing. Fixed now.

> This sentence is awfully confusing:
>
>   Many requirements in this document deal with the properties of a
>   nameserver that is used as part of a delegation, therefore the
>   wording mentioning the use of a name server as part of this is
>   omitted.
>
> First there is nameserver, then name server as two words.  Which is
> it?  More importantly, I'm not quite sure what is being said here.  
> Can
> you perhaps rewrite, elaborate or provide an example?

Perhaps better?  "Many requirements in this document deal with the 
properties of a
name server that is used as part of a delegation, therefore the wording
mentioning the use - authoritative or recursive - of a name server as 
part of
this is omitted."

https://github.com/CENTRccTLDs/TRTF/commit/e55fc859d89cbf0fea00d73343ae0774e1ce9b99
https://github.com/CENTRccTLDs/TRTF/commit/283f7590ffaf3e2c6376dcc7d656e18826126e2a

> You may be interested to know that I recently submitted a draft on DNS
> over TCP operational requirements.  If that work progresses as I hope,
> it might help with section 4.2 of your draft.

Reference added.

https://github.com/CENTRccTLDs/TRTF/commit/283f7590ffaf3e2c6376dcc7d656e18826126e2a

> The consistency requirements might be too strict, since it applies all
> zone data.  While reasonable people might fret about inconsistency 
> when
> things like "views", "geo-location", client-subnet and so on are in
> use, it might be best to limit consistency requirements to the
> infrastructure records (e.g. SOA, NS).

Yes, I've added a reference to RFC 7871.

https://github.com/CENTRccTLDs/TRTF/commit/ae734c8100c2274f16b2e2a01d18383a8cb27c17

> Additionally, I could imagine an argument being made that all names
> need not respond with the same NS RRset.  While generally this
> delegation or authority list inconsistency is often indication of a
> problem, it is feasible that it might be intentional and may even
> provide some advantage.  The so-called "fast flux" invention by the
> miscreants taught us that.

Do you have any proposed text to address this?

> Suggesting that name servers be the same AS is often unnecessary.  
> More
> important is diversity in the route announcements covering the name
> server addresses.  Many might not even be able to easily satisfy this
> requirement.

Addressed in 
https://github.com/CENTRccTLDs/TRTF/commit/6a9e326208c0d1d650396850b2e654e1942c212c

> A few additional topics you may wish to consider:
>
>   * delegated name server should be authoritative only (no rd service)

https://github.com/CENTRccTLDs/TRTF/commit/05a992c2b06a410aca53b2a90f4681554fbb8b2f

>   * ptr names of NS addresses should match the associated A/AAAA names

Why is that?

>   * name server should run NTP or equivalent so time is accurate

This would be import if using TSIG, but how is it important form a 
delegation point of view?

>   * DNS TTLs of the NS and A/AAAA name servers MUST be consistent

It makes sense to me, but we need to explain why.

	jakob

(work in progress version at 
https://github.com/CENTRccTLDs/TRTF/blob/master/ietf/draft-wallstrom-dnsop-dns-delegation-requirements.md)