Re: [dnsext] Obsoleting SPF RRTYPE

[Dave Lawrence <[e-mail]>]

Andrew Sullivan writes:
>     1.  Specify that clients query first SPF, and then query TXT if
>     SPF returned NODATA.
> [...]
> We rejected (1) (in consultation with DNSOP) on the grounds that the
> evidence showed overwhelmingly that deployed systems used TXT in
> preference to SPF.  A number of systems (including, full disclosure,
> one of the services that my employer, Dyn, offers) to this day only
> support SPF using TXT records.  So, (1) would result in an increase of
> query traffic with little, if any, benefit.

In the near term.  It is unclear what the effect would be long term.

I know that, as an implementer, if I had a spec that was unambiguous
about the intended behaviour of SPF-then-TXT that I would endeavour to
make my software be part of the evolution that moved things in the
right direction.  (I currently work on a widely deployed auth server,
not a resolver, and that server supports the SPF record.)

I will not pretend to prognosticate, however, on whether similar
action by other developers would be widespread enough to eventually
noticeably mitigate the extra query hit.  I don't think anyone else
can convincingly make the case that they really know how it would work
out, either.

As an operator, both for a large organization and also one whose
personal DNS server sits behind a pretty small pipe, to me that extra
hit is hardly a worse situation than AAAA-then-A.