Re: [dnsext] Lame Server responses

["George Barwood" <[e-mail]>]

----- Original Message ----- 
From: "Edward Lewis" <[e-mail]>
To: <[e-mail]>
Cc: <[e-mail]>
Sent: Monday, October 11, 2010 3:33 PM
Subject: [dnsext] Lame Server responses


> It used to be that the response from a name server, in particular 
> BIND, when it determined it was lame was to send a referral to the 
> root.  In response to a network event a few years ago, this was 
> thought to be a bad thing because it was being used to amplify the 
> traffic volume for some apparently malicious intent.
> 
> At that time some software developers choose suspend the referral to 
> the root response.  Today, ISC's BIND returns a response code of 
> REFUSED.  UltraDNS code returns SERVFAIL.  There's no specification 
> for this.
> 
> One of our customers asked us what we returned when lame and we told 
> them SERVFAIL.  Paraphrasing the response "but BIND returns REFUSED".
> 
> A question to the group.  Is either SERVFAIL or REFUSED acceptable? 
> I am not pushing for one-or-the-other (because no one wants to change 
> code unnecessarily), nor am I wanting to debate whether one response 
> is better than the other.  I'll note that UltraDNS internally did 
> discuss this a long time ago and we went with SERVFAIL because we 
> felt it was the most apt response, but that doesn't mean there were 
> other choices.
> 
> The thing is - when we get a query that we are lame for, we want to 
> tell the querier something that will stop them from trying again 
> (even if just for the current query).  I think both REFUSED and 
> SERVFAIL do that.
> 
> Does it matter that there is no return code for LAME?  Would an 
> iterating resolver need to know this?  (Given lameness can be 
> fleeting, it's not a permanent state.)
> 

I agree with BIND, it seems to me that REFUSED is closest to then codes defined by the standard.
I expect either SERVERFAIL or REFUSED will work perfectly well.
I don't see any strong reason to have a specific LAME return code, so the chance of
introducing one at this stage seems practically zero, even if EDNS theoretically allows it.
Can you think of any other situation that causes REFUSED to be returned (to a normal query)?

- George

> -- 
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> Edward Lewis
> NeuStar                    You can leave a voice message at [phone]
> 
> Ever get the feeling that someday if you google for your own life story,
> you'll find that someone has already written it and it's on sale at Amazon?
>