Re: [dns-privacy] [[e-mail]: I-D Action: draft-bortzmeyer-dns-qname-minimisation-00.txt]

[Tony Finch <[e-mail]>]

Stephane Bortzmeyer <[e-mail]> wrote:
>
> >    Another note is that the answer to the NS query, unlike the referral
> >    sent when the question is a full qname, is in the Answer section, not
> >    in the Authoritative section.
>
> Also a poor wording since it is the Authority section, not the
> Authoritative one. (Which, by the way, answers your concern.)

I'm not worried about the spelling error: it is wrong to say that an NS
query sent to parent name servers gets an answer rather than a referral.
For example:

; <<>> DiG 9.10.0b1 <<>> +norec +noadditional ns ac.uk @nsa.nic.uk
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3480
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 7, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ac.uk.                         IN      NS

;; AUTHORITY SECTION:
ac.uk.                  172800  IN      NS      auth03.ns.uu.net.
ac.uk.                  172800  IN      NS      ns3.ja.net.
ac.uk.                  172800  IN      NS      ns2.ja.net.
ac.uk.                  172800  IN      NS      ws-fra1.win-ip.dfn.de.
ac.uk.                  172800  IN      NS      ns1.surfnet.nl.
ac.uk.                  172800  IN      NS      ns4.ja.net.
ac.uk.                  172800  IN      NS      ns0.ja.net.

;; Query time: 14 msec
;; SERVER: 2001:502:ad09::3#53(2001:502:ad09::3)
;; WHEN: Thu Mar 20 14:27:41 GMT 2014
;; MSG SIZE  rcvd: 202

; <<>> DiG 9.10.0b1 <<>> +norec +noadditional ns ac.uk @ns0.ja.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28108
;; flags: qr aa; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 13

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ac.uk.                         IN      NS

;; ANSWER SECTION:
ac.uk.                  86400   IN      NS      ns0.ja.net.
ac.uk.                  86400   IN      NS      ws-fra1.win-ip.dfn.de.
ac.uk.                  86400   IN      NS      ns3.ja.net.
ac.uk.                  86400   IN      NS      ns2.ja.net.
ac.uk.                  86400   IN      NS      ns4.ja.net.
ac.uk.                  86400   IN      NS      auth03.ns.uu.net.
ac.uk.                  86400   IN      NS      ns1.surfnet.nl.

;; Query time: 6 msec
;; SERVER: 2001:630:0:8::14#53(2001:630:0:8::14)
;; WHEN: Thu Mar 20 14:27:34 GMT 2014
;; MSG SIZE  rcvd: 466


> Following the general principle of DNS RFCs, I do not think it would
> be wise to specify an algorithm for resolution with qname
> minimisation, since there is none for traditional resolution.

RFC 1034 section 4.3.2.

> >   fr          IN NS ?
> >   ratp.fr     IN NS ?
> >   www.ratp.fr IN NS ?
> >   www.ratp.fr IN A ?
> >   www.ratp.fr IN AAAA ?
>
> You did not mention the zone which will receive the queries. The third
> query will work, even with the broken Alteon load balancers, since it
> will be sent to the NS of ratp.fr.

Right.

> > Or should you skip the third query?
>
> It MAY (RFC 2119) be skipped since a zone cut is not possible because
> there is just one label more than the previous name.

But there *is* a zone cut here.

> > Skipping the third query would improve latency in most cases (when
> > there isn't a zone cut at the leaf), but it leads to leakage. For
> > example, consider a domain like google.com: do you want the .com
> > name servers to know if you are sending mail to Google, rather than
> > just looking at their web site?
>
> I do not understand. Do you refer to gmail.com/google.com?

No, I mean, if I go to http://google.com in my browser, I will make A and
AAAA queries for google.com, but if I send mail to a Google employee I
will make MX queries for google.com.

So if you skip the NS query for google.com (because it is the whole of the
QNAME in this case) you will leak the A vs MX difference to the .com
servers.

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Viking: Southwest 7 to severe gale 9. Rough or very rough. Rain then showers.
Moderate or good.