Re: [dbound] [dmarc-ietf] Fwd: New Version Notification for draft-dcrocker-dns-perimeter-00.txt

[Dave Crocker <[e-mail]>]

On 4/3/2019 7:14 PM, John R. Levine wrote:
> That bit in the parentheses, who does the modifying, and how does it get 
> into the running versions of BIND and NSD and PowerDNS and all the other 
> DNS servers and caches that people use?

You appear to be confusing 'adding to an implementation' with 'changing 
the protocol'.  Modifying the protocol is changing DNS.  Adding code 
might or might not be and in this case, it isn't.  It is adding a /use/ 
of /existing/ DNS mechanisms.  That's not 'changing the DNS'.


> Although now that I think about it, it won't work anyway.  For one 
> thing, if you ask for _perim.a.b.c.tld, and there is only _perim.c.tld, 
> the DNS response will be an NXDOMAIN and I don't think that DNS clients 
> expect to find additional records in an NXDOMAIN response.  Or if we 
> wave our hands some more and somehow make it a NODATA (positive response 
> with no records), the fact that there's _perim.c.tld in the additional 
> section doesn't mean that there wouldn't also be _perim.b.c.tld if you 
> asked for it.  There's another whole set of failures if there's a zone 
> cut between the name you ask for and the _perim above it.

The NXDomain looks like an interesting bit of inconvenience.  Have to 
think about it some more.

And yes, zone boundaries are always fun.  But since these are names that 
are, by definition, within a single administrative scope, I suspect 
that's solvable too.


> Don't take my word for it, ask in dnsop.  Or perhaps Tim has some opinions.
I already sent a note to dnsop, inviting them to dbound for this discussion.

d/


-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net