Re: [dane] Behavior in the face of no answer?

[Paul Wouters <[e-mail]>]

On Fri, 11 May 2012, Nicholas Weaver wrote:

>> Can you provide some actual names of such devices, preferably with
>> links to people complaining about their badly written DNS proxies?
>> What is the practical effect of the limitations in their DNS proxies?
>> How widely deployed are they, and where?  Are these endpoint devices
>> or routers?  Has the mfr released updated firmware for them?  Etc.
>
> Its very ubiquitous, and the biggest problem is the CPE (Customer Premesis Equipment, aka the @#)(@*#)$ NAT!).
>
> www.icir.org/christian/publications/2011-satin-netalyzr.pdf

There is also:

www.icann.org/en/groups/ssac/documents/sac-035-en.pdf
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/DNSSEC/DNSSEC_Support_by_Home_Routers.pdf
http://ripe60.ripe.net/presentations/Dietrich-DNSSEC_Support_by_Home_Routers_in_Germany.pdf
https://www.iis.se/docs/Health-Status-DNS-and-DNSSEC-20120321.pdf

etc. etc.

There are a lot of failure modes. One important one used to be the
dnsmasq software shipped with many commercial vendors, though that
one has now been fixed, though no one installs firmware updates so
it takes years for these kind of brokenness to disappear.

The Atlas probe project at RIPE will hopefully be able to tell us a lot more
in the near future as well.

Regardless, to get back on the topic, there will be devices that can
do DNSSEC but that do not handle the Generic record format.

Paul