Re: [dns-dir] Help reviewing draft-ietf-opsec-ipv6-implications-on-ipv4-nets for bad DNS advice?

[Ted Lemon <[e-mail]>]

On Jul 9, 2013, at 9:50 AM, Mark Townsley <[e-mail]> wrote:
> Safe in what sense? Are there security dangers in it?

It certainly breaks DNSSEC.   Silently ignoring queries on a name can lead to long timeouts.   They were going to return NXDOMAIN, which would have been really exciting, but they at least agreed to take that out.

> I can state a lot of reasons why I don't *like* it:
> 
> - Please just deploy IPv6 instead
> - Users that want to get around this, can (8.8.8.8)
> - Inconsistency in DNS is hard to diagnose, troubleshoot, etc....

Actually I think they want to also intercept DNS queries at the firewall, so querying against google's name service wouldn't work.

> That said, 6to4 and Teredo are as rampant as they are broken. Perhaps the focus should be on ridding these from codebases entirely rather than pussyfooting around about it as we have in the past. 

Breaking 6to4 and Teredo at the enterprise firewall is pretty easy.   This is a document about how to run enterprise networks where you aren't doing IPv6.   Personally I think it's bad because it encourages enterprises to postpone upgrading to IPv6, when in fact enterprises are one of the easiest places in the world to do IPv6, and there are substantial benefits to switching.   But my main concern about this document is that it will be read as the IETF generally supporting the techniques it describes, even though the introduction says it's specifically for corporate environments.

So if there is something about the paragraph I quoted that would cause genuine breakage, but that I have missed, that's what I'm hoping someone will tell me.   The paragraph gives me an uneasy feeling, but having gotten rid of the NXDOMAIN bug, there is nothing specific that I can point to, with my limited operational experience, as being clearly broken.