Re: [dnsext] WGLC ENDS0-bis

[Florian Weimer <[e-mail]>]

* Edward Lewis:

>>I would like to see guidance to implementors how they can actually
>>detect EDNS0 support or the lack thereof.  Alternatively, a minimum
>>level of support could be made mandatory, eventually making the
>>existing detection logic obsolete.
>
> As far as declaring "a minimum level of support": an RFC cannot say
> "you must implement me, even if you were implemented last year." That
> just doesn't work.

A vendor which errors out or drops EDNS0-enabled queries would no
longer be able to claim to implement the current version of the DNS
protocol.  It worked for HTTP/0.9 and SSLv2.  It did not work for
extended label types or RIPv1.

> For backwards compatibility, we are stuck with probing for
> functionality.  This is a weakness of the DNS architecture.

It's not an architectural problem, I think.  You could implement
pretty reliable signaling, but EDNS0 doesn't do it.  (Basically, you
need two bits, the query contains 01, and the response 10, so that you
can detect stripping and dumb reflection.)

Anyway, what I'm asking for is documentation for the probing
algorithm.  Are there existing implementations which use the presence
of DNSSEC data as an indicator for EDNS0 support, as suggested in the
draft?