Re: [dnsext] the same in old days, was making names the same NEED protocol changes?

[John Levine <[e-mail]>]

>So far as I can tell the main question is, what is the question and is
>BNAME the answer?

Looking back into the mists of history (that would be the 1980s for
you old timers), for about the first decade of the DNS, servers didn't
care what their names were.  If you want to add a new name to a TELNET
or FTP or SMTP or POP or IMAP server, just add an A or CNAME record
and you're done.  Even web servers didn't care about their names until
HTTP 1.1 and HTTPS in the mid 1990s.  Mail servers always knew what
domains they could handle mail for, but the CNAME rule pushed alias
resolution into mail clients.  For most purposes, the client handed
the name to the DNS, the DNS gave back an answer that let the client
connect to the server, and that was it.

But life now is not so simple.  We have several major protocols, mail,
http, and https, that pass domain names as part of the data stream
that are not (currently at least) resolved by DNS queries.

When I read a lot of the arguments here, particularly the ones about
what TLD operators want, it's like being in a time warp.  If it were
still 1987, and the only problem were locating the server, then
something like BNAME would probably do it.  But it's not, if we don't
also have a plan for the protocols with domain names in the data
stream, it's a cruel joke on the users.

If the question is how can we make one subtree an alias that resolves
to the same DNS results as a canonical subtree AND allows the
application servers to tell what names are aliases to a canonical
name, BTREE is pretty close.  The primary shortcoming I see is a
security issue: anyone can set a BNAME to make a random name
equivalent to one of mine.  It's possible to handle this outside the
DNS, by manually configuring the server to know what names it can
handle, or hackery, e.g., only accept BNAMEs served from specific name
servers that we trust.  But that's not great for users, since they
will see baffling error messages like "mail relay refused".

So I'd also want some way for the canonical domain to state in the DNS
what aliases it accepts.

Regards,
John Levine, [e-mail], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly