Re: [dane] Behavior in the face of no answer?

[Ondrej Mikle <[e-mail]>]

On 05/04/2012 06:53 PM, Andrew Sullivan wrote:
> On Fri, May 04, 2012 at 09:32:32AM -0700, Paul Hoffman wrote:
>>
>> My preference is that the spec discuss the issue, propose hard-fail
>> as an option, and explain that without hard-fail the benefits for
>> usage 0 and 1 can be circumvented but that the client is no worse
>> off than without DANE. It's important to emphasize that this is
>> about usage 0 and 1, and that a different security analysis applies
>> to types 2 and 3 (well, 3 certainly; I need to think about 2).
> 
> I agree with this.
> 
>> I would prefer that we not require hard fail while assuming some
>> implementers will not follow our requirement,
> 
> I also strongly agree with this.

I also agree with the above points.

I'll chime in with some data: we've been collecting data (with Ralph Holz) on
behavior of various authoritative NS (about 15 RR types for each domain, with
DNSSEC enabled).

>From the ongoing scan, out of 70M currently finished .com domains, SERVFAILs
appeared for ~8.6M distinct domains. My interpretation of such high percentage
is that those are forgotten/unmaintained domains (for comparison, percentage for
.cz TLD is < 1%). We'll cross-check the failing answers against lists such as
Alexa top 1M (to see how "relevant" they are) and do a rescan of the failures.

>From the preliminary data it follows that no vendor of a TLS client would honor
hard-fail if it was a "MUST" (though I don't like the possible downgrade attacks).

Another goal of the scan is to find statistics on average/maximum size of
DNSSEC-stapled structure (as Jim Schaad asked -
https://www.ietf.org/mail-archive/web/dane/current/msg04694.html), which is
heavily influenced by number of zones traversed by CNAMEs/DNAMEs (ask away if
you're interested in other stats).

Ondrej Mikle