Re: [BEHAVE] Happy Eyeballs and DNS64 not sending synthetic AAAA RRs

[Andrew Sullivan <[e-mail]>]

On Fri, Aug 05, 2011 at 07:30:12AM -0600, Stephan Lagerholm wrote:
> 
> Something like wing-behave-dns64-config is needed until all hosts supports
> mif-dns-server-selection.

Well, yes, except as you point out it's still at best going to be
heuristic, because the technique in draft-wing-behave-dns64-config is
quite likely to end up hitting the dns64 anyway.

On a slightly different note, Dan, I wonder whether you want to
include discussion of a DNSSEC wrinkle.  Suppose someone uses the
techniques in draft-wing-behave-dns64-config.  If they want the
upstream resolver to do DNSSEC for them, then there will be yet
another problem.  When a resolver sets DO=1 and CD=0 and the upstream
resolver is validating, then a vaidation failure returns SERVFAIL.  A
host might reasonably query the next DNS server it has under those
circumstances (there's a nasty attack here, of course, if your host
has both validating and non-validating upstreams.  Don't Do That).  In
this case, the upstream validation failure will cause the client to
start asking the DNS64.  Of course, as long as the DNS64 is also
validating, it'll return SERVFAIL too, so it might not matter, but it
might be worth noting.

A

-- 
Andrew Sullivan
[e-mail]