Re: [dnsext] How well supported are unknown RRs in modern resolvers?

Nicholas Weaver <> Tue, 08 March 2011 21:56 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 50C523A66B4 for <>; Tue, 8 Mar 2011 13:56:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.544
X-Spam-Status: No, score=-2.544 tagged_above=-999 required=5 tests=[AWL=0.055, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id FPROs6PMqp7A for <>; Tue, 8 Mar 2011 13:56:32 -0800 (PST)
Received: from taffy.ICSI.Berkeley.EDU (taffy.ICSI.Berkeley.EDU []) by (Postfix) with ESMTP id 7B2653A659B for <>; Tue, 8 Mar 2011 13:56:32 -0800 (PST)
Received: from ( []) (Authenticated sender: nweaver) by taffy.ICSI.Berkeley.EDU (Postfix) with ESMTP id 2045F36A413; Tue, 8 Mar 2011 13:57:48 -0800 (PST)
References: <> <B5393963B7B95CA5927105FE@nimrod.local>
In-Reply-To: <B5393963B7B95CA5927105FE@nimrod.local>
Mime-Version: 1.0 (Apple Message framework v1082)
Content-Type: text/plain; charset=us-ascii
Message-Id: <>
Content-Transfer-Encoding: quoted-printable
From: Nicholas Weaver <>
Date: Tue, 8 Mar 2011 13:57:47 -0800
To: Alex Bligh <>
X-Mailer: Apple Mail (2.1082)
Subject: Re: [dnsext] How well supported are unknown RRs in modern resolvers?
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: DNS Extensions working group discussion list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 08 Mar 2011 21:56:33 -0000

On Mar 8, 2011, at 1:41 PM, Alex Bligh wrote:

> --On 8 March 2011 13:31:10 -0800 Doug Barton <> wrote:
>> The point Nicholas made about moving the CLONE logic to the stub is
>> something I'm interested in pursuing, but my understanding is that "a
>> lot" of resolving name servers still have problems dealing with RR types
>> they don't understand. Is this still true?
> I would expand your worry-space from resolvers to include middleboxen also.
> Nick should have / could collect some good data on this. I think this is
> going to push us into EDNS if only for signalling reasons. Ray Bellis's
> report suggests that serious SOHO CPE problems will arise if the packets
> get larger than 512 bytes, but I don't think he explicitly tested unknown
> RRs.

We probe the NAT specifically, and its bad but not as bad as you think:

OFTEN you can bypass the NAT (we check direct over the wire as well).

And if you can get TXT, you can usually get unknown RRs.  (Its either 'get both or get neither', which means 'shove data into a TXT record' is a bad idea: it doesn't help)

We also test EDNS and large responses over the wire (but not all the way to the client, need to add that in).  The 512B limit is less terrifying, fragmentation is a bigger problem really.

(we have a paper in the polish stage, we'll post it here when its done).

We don't test unknown EDNS0 options however.