IETF Logo Mail Archive

Re: [dane] Behavior in the face of no answer?

Tony Finch <dot@dotat.at> Thu, 10 May 2012 09:41 UTC

Return-Path: <fanf2@hermes.cam.ac.uk>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ACD921F8620 for <dane@ietfa.amsl.com>; Thu, 10 May 2012 02:41:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.525
X-Spam-Level:
X-Spam-Status: No, score=-6.525 tagged_above=-999 required=5 tests=[AWL=0.074, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ULALzDpa7j3o for <dane@ietfa.amsl.com>; Thu, 10 May 2012 02:41:36 -0700 (PDT)
Received: from ppsw-52.csi.cam.ac.uk (ppsw-52.csi.cam.ac.uk [131.111.8.152]) by ietfa.amsl.com (Postfix) with ESMTP id 4CA1E21F8562 for <dane@ietf.org>; Thu, 10 May 2012 02:41:36 -0700 (PDT)
X-Cam-AntiVirus: no malware found
X-Cam-SpamDetails: not scanned
X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/
Received: from hermes-2.csi.cam.ac.uk ([131.111.8.54]:53549) by ppsw-52.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.159]:25) with esmtpa (EXTERNAL:fanf2) id 1SSPsL-000346-Fo (Exim 4.72) (return-path <fanf2@hermes.cam.ac.uk>); Thu, 10 May 2012 10:41:34 +0100
Received: from fanf2 (helo=localhost) by hermes-2.csi.cam.ac.uk (hermes.cam.ac.uk) with local-esmtp id 1SSPsL-0004Pe-Sj (Exim 4.67) (return-path <fanf2@hermes.cam.ac.uk>); Thu, 10 May 2012 10:41:33 +0100
Date: Thu, 10 May 2012 10:41:33 +0100
From: Tony Finch <dot@dotat.at>
X-X-Sender: fanf2@hermes-2.csi.cam.ac.uk
To: Ondrej Mikle <ondrej.mikle@nic.cz>
In-Reply-To: <4FAB6583.7080903@nic.cz>
Message-ID: <alpine.LSU.2.00.1205101035080.9038@hermes-2.csi.cam.ac.uk>
References: <20120504023602.GA4683@mail.yitter.info> <CABcZeBO93n_C5detefBcOjAoswe2inGKDj65gQPDQmREyGnhAw@mail.gmail.com> <20120504112922.GB4929@mail.yitter.info> <CABcZeBPTTa07iUHo9XL5WrHGMYHwaQzs6xYtiF25O4Jek8E3RQ@mail.gmail.com> <20120504144426.GD4929@mail.yitter.info> <CABcZeBOM_0L42Rng75AsVda9u4G=FH8=OB8Qg=nQpL-BzRoBuQ@mail.gmail.com> <3FF36EBA-F8B1-4D66-BA00-E8E36A7E449D@kumari.net> <CABcZeBP2iRLa76rSXu4A0OwFxP=tqK1ShZ6wv=6wnaEC6uad+w@mail.gmail.com> <CAMfhd9XYS=9SGotCTwa7NJU4L8WFys2rDVsQZxn4a0wz+NxS3Q@mail.gmail.com> <6015A12B-8CA9-426B-9AFF-32CD4211DAB5@vpnc.org> <20120504165311.GB7394@mail.yitter.info> <4FA5D178.8030405@nic.cz> <alpine.LSU.2.00.1205082043010.17365@hermes-2.csi.cam.ac.uk> <4FAB6583.7080903@nic.cz>
User-Agent: Alpine 2.00 (LSU 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: Tony Finch <fanf2@hermes.cam.ac.uk>
Cc: dane@ietf.org
Subject: Re: [dane] Behavior in the face of no answer?
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 May 2012 09:41:37 -0000

Ondrej Mikle <ondrej.mikle@nic.cz> wrote:
> On 05/08/2012 09:46 PM, Tony Finch wrote:
> > Ondrej Mikle <ondrej.mikle@nic.cz> wrote:
> >>
> >> From the ongoing scan, out of 70M currently finished .com domains,
> >> SERVFAILs appeared for ~8.6M distinct domains.
> >
> > We're running validating resolvers and we haven't noticed that level of
> > failure. What proportion of authoritative servers with working DNSSEC
> > return SERVFAIL for what QTYPEs?
>
> The scans finished, here is a breakdown of what those SERVFAILs represented.
> Short summary: As I expected, most of the domains are most likely
> parked/unmaintained/speculative (by some whois queries, still SERVFAIL etc.)
> Thus no reason for admin to care about them - that also means users won't ask
> for them either.

For our purposes we need a breakdown of the "other RR" cases. The fact
that 10% of domains have broken delegations is sad but it isn't going to
confuse a DANE implementation into thinking there is an attack.

Tony.
-- 
f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
Faeroes: Northerly 4 or 5, occasionally 6 later in east. Moderate, becoming
rough later in far east. Wintry showers. Good.

v2.8.7 | Report a Bug | By Email