Re: [dnsext] WG opinion on draft : Improvements to DNS Resolvers, for Resiliency, Robustness, and Responsiveness

[Paul Vixie <[e-mail]>]

> From: Florian Weimer <[e-mail]>
> Date: Wed, 23 Feb 2011 09:53:36 +0000
> 
> > I do not think you could enable this by default today, because very
> old > software might still have bugs in handling empty nonterminals
> and send > NXDOMAINs for them.
> 
> A lot of DNSBLs are hosted on servers which send NXDOMAIN for empty
> non-terminals.

those servers are lying and/or seriously broken/nonconformant.  i don't
like walking as if on on eggshells to avoid offending them.  they ought
to be fixed, not tolerated.

consider BIND4 4.8's odd AXFR behaviour. it only looked at the first
answer in each message, and only sent one answer per message. it had a
100% market share. we fixed the problem in 4.9.3 and added configuration
knobs defaulting to sending single-answer output (to avoid causing older
noncompliant initiators to reject the transfers) but allowing this to be
overridden. eventually we just changed the default. microsoft, whose
correct DNS implementation was not compatible with BIND, had to do the
same thing. they deserved an apology from me, which they got, not excuses.
the standards weren't changed as a result. again, at the beginning of
this debacle the offending DNS implementation had a 100% market share.

> I don't think this change is worth the effort.  I would rather prefer
> official blessing of NXDOMAIN synthesis from NSEC/NSEC3 records.  This
> would be both more deterministic and more effective.

while i'd like the DNSSEC solution you propose to also be done, i note
that RBLDNSD operators are among the most technically adept name server
operators in the history of the internet.  a campaign to get this
software patched and to get upgrades installed would have a very short
tail (shorter than the BIND4 AXFR example cited earlier).  this does seem
to me worth doing since i'm not expecting all zones to be signed and since
the specification with respect to empty non-terminals was never unclear.