Re: [dbound] NXDomain (was: Re: [dmarc-ietf] Fwd: New Version Notification for draft-dcrocker-dns-perimeter-00.txt)

["John Levine" <[e-mail]>]

In article <[e-mail]> you write:
>However from what I can tell, including Additional information in an 
>NXDomain response is entirely legal, albeit certainly unusual.

No argument there.

>My understanding is that it's likely careful use of a resolver library 
>can retrieve the Additional information.  Some calls won't get it; 
>others probably will.

As I may have said one or two times before, this hack will require
changes to DNS servers to return additional information that they
don't return now, changes to DNS caches to store and pass through
additional information that they don't store or pass through now, and
changes to DNS client libraries to retrieve the additional information
that they don't retrieve now.  I will cheerfully bet any amount of
money that none of these changes ever happen.


>The guidance for making this work is that it's seeking to emulate DNS 
>wildcard behavior, through cooperative behavior by both the resolver and 
>the authoritative server.

Don't forget the caches which also will need to be changed.

Once again, please compare this proposal to my 2016 proposal that uses
normal DNS wildcards and works right now with no changes to any DNS
server, cache, or client.  Using TXT records, a fair amount of DNS
crudware can probably provision it, too.  I'm not saying it's perfect,
but it's at least plausible.

R's,
John