Re: Extra records in zone transfers

["D. J. Bernstein" <[e-mail]>]

Andreas Gustafsson writes:
  [ aol.com records in a zone transferred from princeton.edu ]
> it may be used as glue in referrals

No. That is completely unacceptable from a security perspective.

Consider, as an easy example, a server handling both the .net zone and
the microsoft.net zone. Suppose the microsoft.net people say

   blah.microsoft.net NS ns.slashdot.net
   ns.slashdot.net A 207.46.232.37

in an AXFR response to this server. It is essential for the server to
discard the glue A record; otherwise it will poison caches, because
caches trust ns.slashdot.net information from .net servers.

If IXFR relies on the server keeping this record, then IXFR is broken.
Furthermore, the IXFR protocol has an official status of Elective, and
my users have a better protocol (rsync), so I am not going to support
IXFR, and I object to IXFR-induced complications in the AXFR protocol.

> Records below cs.princeton.edu that were not present in
> the princeton.edu master file MUST NOT be transmitted,

My servers use a redesigned unified configuration-file format, different
from your master-file format. As I said, they automatically treat all
*.cs.princeton.edu records as non-authoritative records for the
princeton.edu zone, as a convenience for the system administrator.
Everything works.

You claim without justification that it is ``incorrect'' for the
princeton.edu zone to contain (e.g.) www.cs.princeton.edu records, even
though you say that www.aol.com records are okay. I don't see any
support for your views in the DNS specifications.

---Dan


to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.