Re: [dnsext] enough is enough

[Patrik Fältström <[e-mail]>]

> On 21 dec 2014, at 15:33, bert hubert <[e-mail]> wrote:
> 
> On Sun, Dec 21, 2014 at 11:33:17AM +0100, Patrik Fältström wrote:
>>> The domain x.y.z fails to resolve using our software, and we have determined
>>> that this is because the software or hardware publishing the DNS details of
>>> x.y.z is not conforming to the DNS standards.
>> As Jim says, your idea is nice as it is, and there is nothing wrong with
>> the email -- but we have no idea what so ever where to send it.
> 
> Actually, as the authors of a resolver, we know exactly where to send it. To
> the people telling me I need to fix my resolver so it works with broken
> domain X.

Ok, good. That is exactly what I claim is the most effective way of solving the issue.

> And in turn, we've found that (together with resolver operators) we can
> quickly find out what broken hardware or software is behind the issue -
> Citrix Netscalers this time round. It helps if large operators (people with
> tens of millions of customers) tell them they need to clean up their act.

Yes.

> The REAL issue right now is that we can't resist fixing a broken domain
> "because it works with Google/Unbound/Bind/Microsoft, so you must fix it".
> 
> What is needed is a pact that none of us will respect that argument on its
> own if a domain actually should be broken.
> 
>> The best path forward is I think still for you to publish clear and crisp
>> information like this on your web page so that it is found when searching
>> for help with Google and other search engines.
>> 
>> I.e. as long as no one have any issues with the brokenness, it will not be fixed.
> 
> Exactly. It should actually break therefore. If you own dodgy equipment or
> use bad software, your domain should receive lots of reports of brokenness.
> 
>> If not even TLDs are hosted correctly, and registry policies are such that
>> it encourages broken DNS configurations, I feel there is not much The
>> Protocol Police can do about it.
> 
> I'm afraid this is true. But if all big implementation decide to no longer
> play the game, the (mostly) load balancer implementations will have to clean
> up their act.
> 
> I also note that quite a lot of problems are AAAA related. This in itself is
> an impediment to IPv6 adoption!

Yes.

   Patrik