Re: [dns-privacy] I-D Action: draft-ietf-dprive-unilateral-probing-11.txt

[Florian Obser <[e-mail]>]

On 2023-08-08 10:14 -07, [e-mail] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This Internet-Draft is a work item of the DNS PRIVate Exchange
> (DPRIVE) WG of the IETF.
>
>    Title           : Unilateral Opportunistic Deployment of Encrypted Recursive-to-Authoritative DNS
>    Authors         : Daniel Kahn Gillmor
>                      Joey Salazar
>                      Paul Hoffman
>    Filename        : draft-ietf-dprive-unilateral-probing-11.txt
>    Pages           : 33
>    Date            : 2023-08-08

This introduced at least a nit

   For example, consider an authoritative server named ns0.example.com
   that is served by two installations (with two A records), one at
   192.0.2.7 that follows this guidance, and one at 2001:db8::8 that is
   a legacy (cleartext port 53-only) deployment.

It doesn't have two A records. It has an A and AAAA record. I know
that Éric asked for a non-legacy IP example, but I don't think this makes
things better. I find it very confusing, usually the server would be
dual stacked so why would it do different things depending on the
address family? Maybe just go v6 only, thusly?

   For example, consider an authoritative server named ns0.example.com
   that is served by two installations (with two AAAA records), one at
   2001:db8::7 that follows this guidance, and one at 2001:db8::8 that is
   a legacy (cleartext port 53-only) deployment.  A recursive client who
   associates state with the NS name and reaches 2001:db8::7 first will

Same in 4.5:

   For example, if a recursive resolver can send a packet to
   authoritative servers from IP addresses 192.0.2.100 and
   2001:db8::200, it could keep two distinct sets of per-authoritative-
   IP state, one for each source address it uses, if the recursive
   resolver knows the addresses in use.  Keeping these state tables
   distinct for each source address makes it possible for a pooled
   authoritative server behind a load balancer to do a partial rollout
   while minimizing accidental timeouts (see Section 3.1).

It seems unlikely that the load balancer would do a address family
translation. Maybe:

   For example, if a recursive resolver can send a packet to
   authoritative servers from IP addresses 2001:db8::100 and
   2001:db8::200, it could keep two distinct sets of per-authoritative-

-- 
In my defence, I have been left unsupervised.