Re: [dnsext] WG opinion on draft : Improvements to DNS Resolvers, for Resiliency, Robustness, and Responsiveness

[Florian Weimer <[e-mail]>]

* Paul Vixie:

>> > I do not think you could enable this by default today, because very
>> old > software might still have bugs in handling empty nonterminals
>> and send > NXDOMAINs for them.
>> 
>> A lot of DNSBLs are hosted on servers which send NXDOMAIN for empty
>> non-terminals.
>
> those servers are lying and/or seriously broken/nonconformant.  i don't
> like walking as if on on eggshells to avoid offending them.  they ought
> to be fixed, not tolerated.

But there's no significant benefit from this protocol change (at least
none that I can see).  On the contrary, it adds one more case where
stub queries which are not observed regularly can result in
drastically altered resolver behavior.  That's quite an annoying
inconsistency.

> consider BIND4 4.8's odd AXFR behaviour.

I don't want to sound flippant, but I don't see how this is relevant
here and now.

> while i'd like the DNSSEC solution you propose to also be done, i note
> that RBLDNSD operators are among the most technically adept name server
> operators in the history of the internet.  a campaign to get this
> software patched and to get upgrades installed would have a very short
> tail (shorter than the BIND4 AXFR example cited earlier).

For a while, I've been sitting on another rbldnsd/resolver interaction
bug and have been given the run-around so far.  I'm not convinced that
deploying new code is simple.

> this does seem to me worth doing since i'm not expecting all zones
> to be signed and since the specification with respect to empty
> non-terminals was never unclear.

If it wasn't unclear, why did almost everyone implement the old
behavior?

-- 
Florian Weimer                <[e-mail]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: [phone]
D-76133 Karlsruhe             fax: [phone]