Subject: [DNSOP] definitions of "public DNS Service"

From: George Michaelson <[email-masked]>
Date: Fri, 22 May 2020 10:55:34 +1000

My Colleague George Kuo asked me for definitions of public DNS
service. not "public DNS" but the trigram "public DNS service"

Colloquially we understand this reasonably well. It is in the space of
what Google, quad9, CloudFlare and others do. The various clean DNS
feeds people subscribe to, it is the functional role of a recursive,
but to the public, yet somehow not the bad one of an open DNS resolver
being abused to do DDoS: its the conscious service offering of a
recursive/cache/forwarder in the public view, a declared intent.

A Google search lists (some of) them by name and IP.

I asked "Dr Johnson" (Paul Hoffman) why it was not in his dictionary,
and he said he is but the humble scribe, and words appear in the
dictionary when he is directed.

What does the WG feel? The definitions of the "elements" of a public
DNS service are of course defined. But not (I feel) the "collected
whole" which most definitely exists, out there.

(if anyone feels this is adequately defined, please correct me and share a URL)

-George

---

From: Joe Abley <[email-masked]>
Date: Thu, 21 May 2020 21:36:31 -0400

On 21 May 2020, at 20:55, George Michaelson <[email-masked]> wrote:

> what Google, quad9, CloudFlare and others do.

For what it's worth, I think those things are public DNS resolver services.

To me, public DNS resolver services are subsets of a larger "public DNS service," which is (something like) the larger facility for translating globally-unique (QNAME, QCLASS, QTYPE) tuples into resource record sets on the Internet.

I don't think that's a very good definition. Something more like Seth Briedbart's definition of "Internet"[1] would be better, but it turns out that it's late and I'm tired and also I'm not as smart as Seth.

Joe

[1] http://web.mit.edu/kolya/misc/txt/internet

---

From: Paul Vixie <[email-masked]>
Date: Fri, 22 May 2020 01:38:12 +0000

> recursive/cache/forwarder in the public view, a declared intent.

these services aren't public in any way, and should not be described as 
public. they are operated privately for private purposes, and merely used by 
some members of the public.

a county park is public. anycast RDNS is a business.

-- 
Paul

---

From: Davey Song <[email-masked]>
Date: Fri, 22 May 2020 12:01:58 +0800

IMHO, public DNS is not a technical jargon which needs a DNS terminology
RFC to record (it collects all DNS definition and terms from other DNS
RFC).

The term "Public DNS"  or "Public DNS service" belongs to the scope of how
people provide and operate DNS services to their best interests. There are
many similar terms, such as Cloud DNS,  Dynamic DNS, DNS firewall,  and
many DNS-attacking terms. BTW,  I'm happy to see there is a document to
define all DNS attacks and mitigation suggestions.

Best regards，
Davey

On Fri, 22 May 2020 at 08:56, George Michaelson <[email-masked]> wrote:

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: George Michaelson <[email-masked]>
Date: Fri, 22 May 2020 14:11:16 +1000

Thank you all for the responses. This has been very interesting. Paul
actually hinted this was the probable direction, and I think we can
say categorically the dictionary doesn't need updating because there
isn't a sense this concept needs defining in this context within this
WG.

Many thanks

-George (not Kuo. Btw, there are five georges at APNIC. hash
collisions happen all the time)

On Fri, May 22, 2020 at 2:02 PM Davey Song <[email-masked]> wrote:
>
> IMHO, public DNS is not a technical jargon which needs a DNS terminology RFC to record (it collects all DNS definition and terms from other DNS RFC).
>
> The term "Public DNS"  or "Public DNS service" belongs to the scope of how people provide and operate DNS services to their best interests. There are many similar terms, such as Cloud DNS,  Dynamic DNS, DNS firewall,  and many DNS-attacking terms. BTW,  I'm happy to see there is a document to define all DNS attacks and mitigation suggestions.
>
> Best regards，
> Davey
>

---

From: George Michaelson <[email-masked]>
Date: Fri, 22 May 2020 15:13:00 +1000

George Kuo who is not subscribed to the list said this:

>Thanks all for sharing.
>I have learned from all your input.
>
>George Kuo.

---

From: Andrew Campling <[email-masked]>
Date: Fri, 22 May 2020 15:56:41 +0000

On Friday, 22 May 2020 02:38 Paul Vixie <[email-masked]> wrote:
> these services aren't public in any way, and should not be described as public. 
> they are operated privately for private purposes, and merely used by some 
> members of the public.

I agree with Paul that the use of "public" in this context is ambiguous in meaning.  Instead of "public DNS service" I'd suggest that  "cloud-based DNS service" is a better fit, no doubt others will have their views too.

Andrew

---

From: Tony Finch <[email-masked]>
Date: Fri, 22 May 2020 17:59:19 +0100

I think despite what Paul H. said this is already covered in RFC 8499:

   Open resolver:  A full-service resolver that accepts and processes
      queries from any (or nearly any) client.  This is sometimes also
      called a "public resolver", although the term "public resolver" is
      used more with open resolvers that are meant to be open, as
      compared to the vast majority of open resolvers that are probably
      misconfigured to be open.  Open resolvers are discussed in
      [RFC5358].

Paul V. is right that "public" is not a good term in this context.
IIRC it was introduced as part of a product name to make it sound less
monopolistic. And just "DNS" is unhelpfully unclear about whether it's a
recursive or authoritative service.

Tony (whose random .sig seems to be trolling).
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
public services of the highest quality

---

From: Bill Woodcock <[email-masked]>
Date: Fri, 22 May 2020 23:59:11 +0200

> On May 22, 2020, at 3:38 AM, Paul Vixie <[email-masked]> wrote:
> 
> public. they are operated privately for private purposes

True of Google and Cloudflare, not true of Quad9.

> a county park is public. anycast RDNS is a business.

Again, true of Google and Cloudflare, but not true of Quad9.

                                -Bill

---

From: dagon <[email-masked]>
Date: Sat, 23 May 2020 01:32:12 +0000

> service. not "public DNS" but the trigram "public DNS service"

Is there room for this bike:

  1) Policy: A "public DNS service" is a full DNS speaker outside of
     the end user's network and control.

     I.e., non-local recursion crosses one or more policy
     barriers---local network, carrier, state and international---with
     implications for integrity, resolution security, and privacy.

     For some enterprises, recursion against 'public DNS services'
     creates an audit criticism.  A poorly selected public resolver
     may import censorship.  Or a well selected resolver may evade
     (older) regional media controls by suggesting false locality to a
     media server, for those services unwilling to impose policy
     regional controls in their TCP multiplex.

     Given these explicit choices and surprise outcomes, "crossing
     policy barriers" is a fair partial description.

  2) Latent RRsets requiring protocol changes.  Public DNS servers are
     the most distant commercially viable DNS iterator from the end
     user.

     Resolvers mitigate distance-induced latency via anycasting and
     robust provisioning.  Suboptimal RRset selections required
     fundamental protocol changes---e.g., exposing local octets to the
     iterative layer---accommodate what remains.  (And hats off to the
     Tor exit nodes offering on-exit recursion, and injecting RFC 1918
     addresses into the ECS payload.)

     "Distant" is a fair description.  Users pay for this distance, in
     either latency, privacy, or protocol changes.

  3) "Free with footnotes".

     No good deed goes unmonetized.  Users should understand the
     trade offs in selecting a non-local resolver.  The term "public"
     obscures stake holder interests.

I suggest: "distant resolver outside of the user's policy oversight".

-- 
David Dagon
[email-masked]
D970 6D9E E500 E877 B1E3  D3F8 5937 48DC 0FDC E717

---

From: Paul Vixie <[email-masked]>
Date: Sat, 23 May 2020 02:46:50 +0000

On Friday, 22 May 2020 21:59:11 UTC Bill Woodcock wrote:
> > ...

there may be a distinction, but not a difference. ibm and pch and the other 
backers of quad9, and the security industry partners who participate, have 
solid personal reasons, just as google and cloudflare and opendns do, for 
running an open recursive name service. open recursion is novel concept, only 
25 years or so old, and the internet functioned fine without it, and as shown 
by the PiHole project and others, the internet can still function fine without 
it. as much as the interested parties have bent the narrative toward their 
interests, open recursion remains a private service run for private reasons, 
and the name "public" would be misleading in the extreme.

-- 
Paul

---

From: Bill Woodcock <[email-masked]>
Date: Sat, 23 May 2020 22:34:57 +0200

> On May 23, 2020, at 4:46 AM, Paul Vixie <[email-masked]> wrote:
> ibm and pch and the other backers of quad9, and the security industry partners who participate, have
> running an open recursive name service.

That’s a rhetorical fallacy.  You’re conflating supporters with “runners.”  If IBM or PCH or anybody else run recursive nameservers, that’s fine.  But that doesn’t make them Quad9.  Quad9 is a public-benefit not-for-profit organization.  I like Werner Herzog's movies, and pay to see them in the theater; that doesn’t make me Werner Herzog, it doesn’t make him my puppet, and it doesn’t mean that his movies are no longer accessible by the public.  There’s no path from the A to the B that you’re attempting to argue.

Quad9 exists at the behest of European privacy regulators and data-protection officers, who are representatives of the public.  It provides service to the public.  It is a public-benefit organization, with no private beneficiaries.  It answers to the California Secretary of State for its existence, another representative of the public interest.  If you believe there’s a private interest there, point it out, specifically and unambiguously enough that people can tell what you’re trying to say.  An unfalsifiable argument is just feckless lip-flapping.

If you can’t actually make the point that you’re insinuating, then don’t try to tar Quad9 with the same brush as Cloudflare and Google.

                                -Bill

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 25 May 2020 11:06:17 +0200 (CEST)

> Il 22/05/2020 18:59 Tony Finch <[email-masked]> ha scritto:
>  

I think this definition is good - perhaps what we need is just to agree to use "open resolver" instead of "public resolver".

If you wanted to convey the nuance that it's not just open, but open on purpose and meant to attract users from the entire Internet, you could add "global": "open global resolver".

Or, as an alternative, you could use the term "platform", which is increasingly being used to identify Internet-wide global companies that provide multiple consumer services. "Platform resolver" would also convey the idea that these resolvers are going to be distributed and ubiquitously available. "Cloud resolver" could have a similar meaning.

But, as for any terminological bikeshedding effort, you cannot force others to use the "most correct" term, so it's possibly just a waste of time.

-- 
 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Paul Vixie <[email-masked]>
Date: Mon, 25 May 2020 15:34:38 +0000

On Monday, 25 May 2020 09:06:17 UTC Vittorio Bertola wrote:
> I think this definition is good - perhaps what we need is just to agree to
> use "open resolver" instead of "public resolver".
> 
> If you wanted to convey the nuance that it's not just open, but open on
> purpose and meant to attract users from the entire Internet, you could add
> "global": "open global resolver".
> 
> Or, as an alternative, you could use the term "platform", which is
> increasingly being used to identify Internet-wide global companies that
> provide multiple consumer services. "Platform resolver" would also convey
> the idea that these resolvers are going to be distributed and ubiquitously
> available. "Cloud resolver" could have a similar meaning.

not that it will matter, but i find those names unprovocative and descriptive.

> But, as for any terminological bikeshedding effort, you cannot force others
> to use the "most correct" term, so it's possibly just a waste of time.

-- 
Paul

---

From: George Michaelson <[email-masked]>
Date: Tue, 26 May 2020 08:48:45 +1000

On Mon, May 25, 2020 at 7:06 PM Vittorio Bertola
<vittorio.bertola=[email-masked]> wrote:

> But, as for any terminological bikeshedding effort, you cannot force others to use the "most correct" term, so it's possibly just a waste of time.

You make a useful important point here: an "open resolver" is the
superset of "deliberate" and "abused" ones. The concept here is that
the intent is deliberate, we need some way to say so. if the intent is
not there and is being abused we need some way to say so.

I started typing this as "good" and "bad" but we know not everyone
believes open public resolver services deliberately deployed ARE a
public good, all the time.

So I went to deliberate and abused, because there is "I do this by
intent" and "it is being done by accident"

-G