Subject: [dnsext] Notes on the DNS standard

From: "George Barwood" <[email-masked]>
Date: Thu, 16 Jul 2009 18:27:06 +0100

I have put together a web page documenting areas when I feel the existing 
DNS standard is problematic, or where
the proper or best way to implement DNS is unclear from the standard, etc.

I intend to maintain it until a better resource is available that renders it 
redundant.

The page is at

http://www.george-barwood.pwp.blueyonder.co.uk/DnsServer/NotesOnDNS_Standard.htm

It is intended to be public domain, you may freely copy part or all of it.

Regards,
George

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 20 Jul 2009 12:46:45 +0200

On Thu, Jul 16, 2009 at 06:27:06PM +0100,
 George Barwood <[email-masked]> wrote 

> the proper or best way to implement DNS is unclear from the

The majority of your notes are for areas where there is not one right
behaviour, when a compliant name server can choose among several
solutions. This is not always a mistake from the standard, it can be a
good thing to let things unspecified, to allow name servers to make
different trade-offs, for instance.

I'm not convinced by some of your notes because you never explain
clearly why this freedom left by the standard is a bad thing and why
it hurts interoperability and/or security.

Also, it seems that several of the changes you advocate (such as
stronger bailiwick checking) require the resolver to discover the zone
cuts. This is, in itself, a difficult subproblem, worth of its own
discussion.

---

From: "George Barwood" <[email-masked]>
Date: Mon, 20 Jul 2009 17:09:49 +0100

----- Original Message ----- 
From: "Stephane Bortzmeyer" <[email-masked]>
To: "George Barwood" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, July 20, 2009 11:46 AM
Subject: Re: Notes on the DNS standard

> different trade-offs, for instance.

I agree with your point in principle, but I believe that in each case an 
addition or change to the standard is worthy of consideration.

> it hurts interoperability and/or security.

Such explanations could be added, but I think in most cases it's fairly 
self-evident. Some of the problems are quite minor, such as [6. Truncation], 
where it's a case of mild inefficiency. On the other hand the ramifications 
of [8. Spoofing] are very complex indeed.

> cuts. This is, in itself, a difficult subproblem, worth of its own

I think it's well known that Bailiwick checking is essential, to prevent 
malicious servers issuing DNS records for which they have no authority. The 
main point I raise is that this is not, as far as I know, mentioned anywhere 
in the RFCs, which seems a significant omission. The secondary point is how 
the checking should be described if it were to be added - in fact I believe 
my suggestion is actually weaker (and thus better) than standard practice - 
although nevertheless secure. I don't however see that bailiwick checking 
requires the resolver to discover zone cuts. That would seem more applicable 
to [1. Partial delegation], but maybe I'm missing something.

Regards,
George