Re: [dnsext] Fwd: RFC 2308 & RFC 4035

John Levine <johnl@iecc.com> Sun, 27 February 2011 20:12 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: dnsext@core3.amsl.com
Delivered-To: dnsext@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 05BC53A67E2 for <dnsext@core3.amsl.com>; Sun, 27 Feb 2011 12:12:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -110.804
X-Spam-Level:
X-Spam-Status: No, score=-110.804 tagged_above=-999 required=5 tests=[AWL=0.395, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DL+5xaUoy4Qh for <dnsext@core3.amsl.com>; Sun, 27 Feb 2011 12:12:45 -0800 (PST)
Received: from gal.iecc.com (gal.iecc.com [64.57.183.53]) by core3.amsl.com (Postfix) with ESMTP id C0F693A67FD for <dnsext@ietf.org>; Sun, 27 Feb 2011 12:12:44 -0800 (PST)
Received: (qmail 24409 invoked from network); 27 Feb 2011 20:13:43 -0000
Received: from mail1.iecc.com (64.57.183.56) by mail1.iecc.com with QMQP; 27 Feb 2011 20:13:43 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=1d03.4d6ab076.k1102; i=johnl@user.iecc.com; bh=7DYFSdddIcgQB5yBGxzuHXTZw0IBMVM2LCIK9PNQn7w=; b=pKVM7sx7dKLOvAHKYKH4DLHZIkQAtRkLCU6FZmfphcSgRXVVKztBOx8jnl+A4qbW3eVO7jW7qnxie07GQrvb6pknXeMFyVNDS+irsq9tJbGZNhgtyBT/c4cEX2YhJJ+fidFOM3Vu9+UgegowxKNtq8WSkkngnSWruxS5+5k75sk=
VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org
Date: Sun, 27 Feb 2011 20:13:42 -0000
Message-ID: <20110227201342.7426.qmail@joyce.lan>
From: John Levine <johnl@iecc.com>
To: dnsext@ietf.org
In-Reply-To: <91393.1298836460@nsa.vix.com>
Organization:
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 7bit
Subject: Re: [dnsext] Fwd: RFC 2308 & RFC 4035
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 27 Feb 2011 20:12:46 -0000

>> ... If the zone is a DNSBL, there will be a whole lot of nxdomain
>> queries, particularly in an IPv6 world where spamware hops to a new IP
>> on every message.
>
>i expect that most dnsbl's who evolve into ipv6 will also evolve a /64
>"wildcard" strategy to cope with malware-controllable low order bits.

I expect that WLs will be more important than BLs, but they both have
the same cache blasting problem if there's a different query for every
IP.

>but i also agree that the importance of negative caching and synthetic
>nxdomains is usually underestimated and will rise as the network grows.

Right.

R's,
John