Subject: Re: Security and suffixes (Re: Cite on DNS-related traffic.)

From: Bob Braden <[email-masked]>
Date: Fri, 2 Jun 2000 20:20:53 GMT

*> From [email-masked] Fri Jun  2 13:09:06 2000
  *> Date: Fri, 02 Jun 2000 15:41:48 -0400
  *> From: John C Klensin <[email-masked]>
  *> Subject: Re: Security and suffixes (Re: Cite on DNS-related traffic.)
  *> In-reply-to: <[email-masked]>
  *> To: Joe Touch <[email-masked]>
  *> Cc: [email-masked]
  *> MIME-version: 1.0
  *> X-Mailer: Mulberry/2.0.0 (Win32)
  *> Content-transfer-encoding: 7bit
  *> Content-disposition: inline
  *> Content-Transfer-Encoding: 7bit
  *> X-Loop: [email-masked]
  *> Content-Transfer-Encoding: 7bit
  *> X-Lines: 15
  *> 
  *> 
  *> 
  *> --On Friday, June 02, 2000 10:56 AM -0700 Joe Touch
  *> <[email-masked]> wrote:
  *> 
  *> > The use of the trailing dot (www.netscape.com.) remains
  *> > a useful way to force the resolver to avoid suffix extensions.
  *> 
  *> And a useful way to induce massive confusion, since many
  *> applications do not recognize the hack and won't pass it to a
  *> resolver (which, of course, may or may not recognize it either).
  *> 
  *>    john
  *> 

John,

Hack??  I will admit to being largely out of touch with this issue, but
I recall the discussions in the IAB while the DNS was under
development.  Far from being a hack, I believe it was an architectured
solution to the problem.  It is documented (at least) in section
6.1.4.3 of RFC 1123.

Bob Braden

---

From: Scot Mc Pherson <[email-masked]>
Date: Fri, 2 Jun 2000 16:44:11 -0400

I would think so...it would also prevent soft referencing of alternate
domain names because it would force DNS to search the root domain (.)

-Scot Mc Pherson
-N2UPA
-RF Engineer
-ClearAccess Communications
-http://www.clearaccess.net
-maito:[email-masked] 

-----Original Message-----
From: Joe Touch [mailto:[email-masked]]
Sent: Friday, June 02, 2000 4:12 PM
To: John C Klensin
Cc: [email-masked]
Subject: Re: Security and suffixes (Re: Cite on DNS-related traffic.)

John C Klensin wrote:
> 
> --On Friday, June 02, 2000 10:56 AM -0700 Joe Touch
> <[email-masked]> wrote:
> 
> > The use of the trailing dot (www.netscape.com.) remains
> > a useful way to force the resolver to avoid suffix extensions.
> 
> And a useful way to induce massive confusion, since many
> applications do not recognize the hack and won't pass it to a
> resolver (which, of course, may or may not recognize it either).

It's not a hack - it's a fully qualified domain name.
Wouldn't this be a fine way to flag the bug in those apps?

Joe