Subject: Re: [DNSOP] Call for Adoption: draft-pwouters-powerbind

From: Bob Harold <[email-masked]>
Date: Fri, 1 May 2020 14:02:32 -0400

On Thu, Apr 30, 2020 at 9:44 PM John Levine <[email-masked]> wrote:

> In article <[email-masked]> you write:
> >Yep, I suspect some of the bigger TLDs probably couldn't opt in to this
> >draft simply because they're full of, um, "history".  Until that history
> >is cleaned, they probably couldn't deploy it.
>
> It's not just history.  All of the nominet TLDs and many Verisign TLDs
> have signed A records that are clearly deliberate.  There's also a fair
> number of TXT records named zz--zz.<domain> that have some sort of info
> about when the zone was updated.
>
> I think it's benign to allow any sort of record as an immediate child
> of the domain, since you need to go two levels down for split zones.
> That handes the nominet and zz--zz cases.
>
> R's,
> John
>
>
Is there any chance that a user trying to reach https://example.com could
get the orphan glue A record for example.com instead of the A record in the
real zone?
(Just trying to think of cases where orphan glue might make a difference.)

-- 
Bob Harold

---

From: Joe Abley <[email-masked]>
Date: Fri, 1 May 2020 14:20:29 -0400

Hi Bob,

On 1 May 2020, at 14:02, Bob Harold <[email-masked]> wrote:

> Is there any chance that a user trying to reach https://example.com could get the orphan glue A record for example.com instead of the A record in the real zone?

If the A record is orphan glue, there is no real zone (by being orphaned, it's no longer really glue).

So there's not just a chance that the A record from the parent zone would be returned, it's expected behaviour.

Joe

---

From: "John R Levine" <[email-masked]>
Date: 1 May 2020 14:23:37 -0400

> (Just trying to think of cases where orphan glue might make a difference.)

Only if the zone had NS and A at the same name, which would be pretty 
broken.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Joe Abley <[email-masked]>
Date: Fri, 1 May 2020 14:32:19 -0400

Hi John,

On 1 May 2020, at 14:23, John R Levine <[email-masked]> wrote:

> Only if the zone had NS and A at the same name, which would be pretty broken.

Oh, interesting.

In a sense, a glue record with the same owner name as a zone cut could be equivalent to a glue record with an owner name that is subordinate to a zone cut. I don't have enough of the spec in my head to know why they would definitively be different from the protocol perspective. I realise it's not normal, but I don't know that it's prohibited.

I definitely don't know operationally how different DNS or registrar software implementations treat that case. I don't think the registry systems I'm familiar with allow host and domain objects with the same name to coexist, but I realise I could quite well be wrong.

If I had any more energy to spend at the keyboard today I might be tempted to find out :-)

Joe

---

From: "John R Levine" <[email-masked]>
Date: 1 May 2020 15:18:25 -0400

> I definitely don't know operationally how different DNS or registrar software implementations treat that case. I don't think the registry systems I'm familiar with allow host and domain objects wit…

I'm pretty sure I've never seen it in any TLD file.

Regards,

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 01 May 2020 16:51:10 -0700

Joe Abley <[email-masked]> writes:

> Anyway, I am fairly confident in saying that there are legitimate,
> normal operational processes that can result in orphan glue, and that
> it's not correct to infer that they all exist for reasons of poor
> hygiene.

For the record: I certainly (and I doubt Paul) envisioned that this
draft would be useful and deployable to every possible
TLD/registration-point.  It, hopefully, will be desired by some.

Though ones that want to "convert" hanging glue in their zone to something that this
draft could accommodate should be able to insert a new zone NS and
delegate to their own servers with a new zone (and new dnskey).  The odd
corner case someone mentioned is if the NS record was pointing to
company.example, rather than ns1.company.example or something.  Then
there is the interesting discussed question of whether company.example
can delegate an NS to its own name [curious minds want to know].

-- 
Wes Hardaker
USC/ISI

---

From: Tim Wicinski <[email-masked]>
Date: Mon, 4 May 2020 15:09:59 -0400

All

The call for adoption period has ended and there has been enough consensus
to adopt this and work on this.

thank you

tim