Re: [dnsext] Re: need new flag bit in EDNS, "do me no favours" (DMNF)

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Paul Vixie writes:
> > Date: Mon, 25 Oct 2010 11:45:23 +0200
> > From: Stephane Bortzmeyer <[e-mail]>
> > 
> > > opin?  i can write a short i-d on it before beijing.
> > 
> > -1. The "Do not mess with my DNS resolution" bit is the default value of
> > the DNS from the beginning and changing this default value means breaking
> > many assumptions. I suggest instead to add a bit "I like lies" for those
> > who want to experience NXDOMAIN unauthorized replacements and so on.
> 
> while i'm not just sympathetic to that view but also passionately in love
> with that view, it's not a reasonable or practical position to take.  the
> internet economy recognizes first-mover advantage more often than not, and
> the ISP's and ASP's who do "web error redirection" today are not going to
> stop no matter what anybody says.  sometimes "web error redirection" is the
> only source of revenue for an ASP, or sometimes it's the difference between
> profitability or not for an ISP.  in practical terms, telling them they
> should not do this and that the RFC's were the first movers, is meaningless.
>
> opt-in would have been the better design choice had events not overtaken us.
> opt-out, if it's explicit and in-band, is a carve-out.  those of us who know
> that we never want "web error redirection" should be able to express this in
> unambiguous terms, so that ISP's and ASP's who perform "web error
> redirection" can be held to account for their conscious and deliberate
> choice of whether to honour our expressed preferences or not.  that's what
> we can actually still accomplish, while we wait for end-to-end DNSSEC that
> will drive nails into the lid of the coffin containing "web error
> redirection" and similar practices.

But we still can't be sure that they won't adapt to the presence
of such marked queries especially if we can get buy-in from a couple
of brower vendors along with something to help the proxies to decided
when they should should do the same thing.

Why don't we do both at once?  There is a range of address modifications
out there.  none, dns64, dns46[1], filter-aaaa, "bad" site, nxdomain.
A query may want some or all of these to be performed even in the
presence of DO or CD.  Only the querier really knows what is
acceptable.

I can see web browers setting dns64 (vendor), bad site (user control)
and nxdomain (user control).

Mark

[1] Give me a IPv4 address if the site doesn't have a IPv4 address
but has a IPv6 address.  It's the complement of dns64.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]