Re: [dnsext] How well supported are unknown RRs in modern resolvers?

[Nicholas Weaver <[e-mail]>]

On Mar 8, 2011, at 1:41 PM, Alex Bligh wrote:

> 
> 
> --On 8 March 2011 13:31:10 -0800 Doug Barton <[e-mail]> wrote:
> 
>> The point Nicholas made about moving the CLONE logic to the stub is
>> something I'm interested in pursuing, but my understanding is that "a
>> lot" of resolving name servers still have problems dealing with RR types
>> they don't understand. Is this still true?
> 
> I would expand your worry-space from resolvers to include middleboxen also.
> 
> Nick should have / could collect some good data on this. I think this is
> going to push us into EDNS if only for signalling reasons. Ray Bellis's
> report suggests that serious SOHO CPE problems will arise if the packets
> get larger than 512 bytes, but I don't think he explicitly tested unknown
> RRs.

We probe the NAT specifically, and its bad but not as bad as you think:

OFTEN you can bypass the NAT (we check direct over the wire as well).

And if you can get TXT, you can usually get unknown RRs.  (Its either 'get both or get neither', which means 'shove data into a TXT record' is a bad idea: it doesn't help)


We also test EDNS and large responses over the wire (but not all the way to the client, need to add that in).  The 512B limit is less terrifying, fragmentation is a bigger problem really.


(we have a paper in the polish stage, we'll post it here when its done).

We don't test unknown EDNS0 options however.