Subject: [DNSOP] Éric Vyncke's Discuss on draft-ietf-dnsop-rfc7816bis-10: (with DISCUSS)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Tue, 24 Aug 2021 05:23:31 -0700

Éric Vyncke has entered the following ballot position for
draft-ietf-dnsop-rfc7816bis-10: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-rfc7816bis/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thank you for the work put into this document. A simple but efficient technique.

Please find below one blocking DISCUSS point (probably easy to address).

Please also address Jean-Michel Combes' INTDR review at
https://datatracker.ietf.org/doc/review-ietf-dnsop-rfc7816bis-10-intdir-telechat-combes-2021-08-20/

Special thanks to Tim Wicinski for his shepherd's write-up notably about the WG
consensus.

I hope that this helps to improve the document,

Regards,

-éric

== DISCUSS ==

-- Section 2.1 --
I support Erik Kline's COMMENT on this and am raising it to a blocking DISCUSS.

A/ in all the discussion in the last §, a AAAA would have the same benefit when
compared to a NS QTYPE. Or what did I miss ?

B/ the last two sentences "Another potential benefit...happy eyeballs query for
the A QTYPE." are puzzling as using A QTYPE will actually only cache the A
answer for the minimized request and more and more Internet users are using
IPv6 nowadays (and possibly even more recursive DNS servers).

Hence, I would welcome some discussion in the last § about the benefit of using
A QTYPE rather than AAAA QTYPE and, as suggested by Erik Kline, please remove
the last 2 sentences.

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 24 Aug 2021 22:43:37 +0000

> A QTYPE rather than AAAA QTYPE and, as suggested by Erik Kline, please remove

If we change from:

   A good candidate is to always use the "A"
   QTYPE because this is the least likely to raise issues in DNS
   software and middleboxes that do not properly support all QTYPEs.
   The QTYPE=A queries will also blend into traffic from non-minimising
   resolvers, making it in some cases harder to observe that the
   resolver is using QNAME minimisation.  Using the QTYPE that occurs
   most in incoming queries will slightly reduce the number of queries,
   as there is no extra check needed for delegations on non-apex
   records.  Another potential benefit of using QTYPE=A is that
   [RFC8305] clients that need answers for both the A and AAAA types
   will send the AAAA query first.  When minimising using QTYPE=A the
   minimised query might be useful, and now already in the cache, for
   the happy eyeballs query for the A QTYPE.

to:

   Good candidatesare to always use the "A" or "AAAA"
   QTYPE because these is the least likely to raise issues in DNS
   software and middleboxes that do not properly support all QTYPEs.
   QTYPE=A or QTYPE=AAAA queries will also blend into traffic from non-minimising
   resolvers, making it in some cases harder to observe that the
   resolver is using QNAME minimisation.  Using a QTYPE that occurs
   most in incoming queries will slightly reduce the number of queries,
   as there is no extra check needed for delegations on non-apex
   records. 

does that alleviate your concers?

--Paul Hoffman

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Wed, 25 Aug 2021 05:36:18 +0000

Paul, 

First , thank you for your reply.

Second, your proposed change actually addresses my DISCUSS and will be happy to change my ballot in a NO OBJECTION once a revised I-D is published ;-)

Regards

-éric

-----Original Message-----
From: iesg <[email-masked]> on behalf of Paul Hoffman <[email-masked]>
Date: Wednesday, 25 August 2021 at 00:44
To: Eric Vyncke <[email-masked]>
Cc: dnsop <[email-masked]>, The IESG <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [Ext] Éric Vyncke's Discuss on draft-ietf-dnsop-rfc7816bis-10: (with DISCUSS)

    If we change from:

    to:

    --Paul Hoffman

---

From: Erik Kline <[email-masked]>
Date: Wed, 25 Aug 2021 19:11:25 -0700

Works for me too.

My main observation was to consider acknowledging there might be some
nuance in this QTYPE area, and this sounds sufficiently nuance-y for me.

Thanks Paul!

On Tue, Aug 24, 2021 at 10:36 PM Eric Vyncke (evyncke) <evyncke=
[email-masked]> wrote:

> Second, your proposed change actually addresses my DISCUSS and will be
> happy to change my ballot in a NO OBJECTION once a revised I-D is published
> ;-)
>
> Regards
>
> -éric
>
> Cc: dnsop <[email-masked]>, The IESG <[email-masked]>, "
> [email-masked]" <
> [email-masked]>
> Subject: Re: [Ext] Éric Vyncke's Discuss on
> draft-ietf-dnsop-rfc7816bis-10: (with DISCUSS)
>

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 26 Aug 2021 01:24:38 -0400

> compared to a NS QTYPE. Or what did I miss ?

Actually, it might not be quite as effective in practice.  The reason is
that "AAAA" records are absent more often than "A" records, and when "A"
records are present, but "AAAA" records are not, "AAAA" queries elicit a
"denial of existence" response.

Unfortunately, broken denial of existence, though rare, is not as
infrequent as I'd like.  I see a non-negligible set of names where "A"
queries return answers, but "AAAA" queries SERVFAIL.

I am not aware of any advantage to using "AAAA" for the qname
minimisation queries, so "A" appears to me to be the better choice.

Examples:

    https://dnssec-stats.ant.isi.edu/~viktor/dnsviz/qmin.d/mail.ajsuarez.com.html
    https://dnssec-stats.ant.isi.edu/~viktor/dnsviz/qmin.d/mail.puz.de.html
    https://dnssec-stats.ant.isi.edu/~viktor/dnsviz/qmin.d/gloria.sntech.de.html
    https://dnssec-stats.ant.isi.edu/~viktor/dnsviz/qmin.d/mx1.espresso-gridpoint.net.html
    https://dnssec-stats.ant.isi.edu/~viktor/dnsviz/qmin.d/exchange.hctec.net.html
    https://dnssec-stats.ant.isi.edu/~viktor/dnsviz/qmin.d/fallback.hctec.net.html

-- 
    Viktor.

---

From: Warren Kumari <[email-masked]>
Date: Thu, 26 Aug 2021 15:46:05 -0400

> minimisation queries, so "A" appears to me to be the better choice.
<no hats>
Yah, I agree -- but, the proposed text suggests that you can use either A
or AAAA.
I'm assuming that implementations will default to QTYPE=A now, but, Real
Soon Now, once IPv6 is all deployed, will default to QTYPE=AAAA.
I'm presuming that implementers will be bright enough to choose the most
dominant / least borken QTYPE over time.
</no hats>
W

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

-- 
The computing scientist’s main challenge is not to get confused by the
complexities of his own making.
  -- E. W. Dijkstra