Re: [dbound] NXDomain (was: Re: [dmarc-ietf] Fwd: New Version Notification for draft-dcrocker-dns-perimeter-00.txt)

[Dave Crocker <[e-mail]>]

On 4/6/2019 8:09 AM, John Levine wrote:
> In article <[e-mail]> you write:
>> My understanding is that it's likely careful use of a resolver library
>> can retrieve the Additional information.  Some calls won't get it;
>> others probably will.
> 
> As I may have said one or two times before, this hack will require
> changes to DNS servers to return additional information that they
> don't return now, 

Since that statement is in the current draft, I'm not clear what insight 
is intended by your multiple repetitions of it here.


> changes to DNS caches to store and pass through
> additional information that they don't store or pass through now, and

Oh?  You are saying that caches do not cache an entire response.   I did 
not find references that support that. Please document.


> changes to DNS client libraries to retrieve the additional information
> that they don't retrieve now.  I will cheerfully bet any amount of
> money that none of these changes ever happen.

That does not match my understanding.  My understanding from a 
knowledgeable source is: "APIs such as those in libresolv that deal in 
raw packets do tend to make the entire packet available.  Others such as 
`getaddrinfo` do not."

Since you appear to be claiming otherwise, please explain.

Worse, I even found an RFC with multiple examples of Additional 
information in an NXDomain response:

    Negative Caching of DNS Queries (DNS NCACHE)

    https://tools.ietf.org/html/rfc2308


> Once again, please compare this proposal to my 2016 proposal that uses

If you wish to do the work of a careful audit of the differences and 
similarities, and pursue a pointed review of the similarities and 
differences, perhaps that will facilitate conversation.  It would 
certainly improve the tone.

d/

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net