Re: [dbound] [dmarc-ietf] Fwd: New Version Notification for draft-dcrocker-dns-perimeter-00.txt

["John R. Levine" <[e-mail]>]

> Or perhaps you can point to the DNS specs and registries, showing where they 
> specify the constrained set of Additional responses that I'm calling for 
> modifying?  I'm not finding such a list.

This is getting very strange.

Your draft says:

    Another approach is use of the DNS Additional section in the server
    response.  When there is a query for a Perimeter node, the server
    would include the associated Perimeter BEGIN record from earlier in
    the hierarchy, if the queried node is within that hierarchy -- that
    is, is above the actual or virtual END record.  (As for any
    information supplied through the Additional section, the responding
    server will need to be modified to provide this enhanced information
    for specific kinds of queries.)

That bit in the parentheses, who does the modifying, and how does it get 
into the running versions of BIND and NSD and PowerDNS and all the other 
DNS servers and caches that people use?

Although now that I think about it, it won't work anyway.  For one thing, 
if you ask for _perim.a.b.c.tld, and there is only _perim.c.tld, the DNS 
response will be an NXDOMAIN and I don't think that DNS clients expect to 
find additional records in an NXDOMAIN response.  Or if we wave our hands 
some more and somehow make it a NODATA (positive response with no 
records), the fact that there's _perim.c.tld in the additional section 
doesn't mean that there wouldn't also be _perim.b.c.tld if you asked for 
it.  There's another whole set of failures if there's a zone cut between 
the name you ask for and the _perim above it.

So you're back to a tree walk, which is poor form in the DNS.

Don't take my word for it, ask in dnsop.  Or perhaps Tim has some 
opinions.

Regards,
John Levine, [e-mail], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly