Re: [DNSOP] CloudFlare policy on ANY records changing

[Paul Vixie <[e-mail]>]

> Wessels, Duane <mailto:[e-mail]>
> Wednesday, March 11, 2015 6:19 AM
>
>
> As Paul suggests, I'll attempt to redirect the conversation to dnsop.
>
> Does it make sense to define an Extended RCODE for additional signaling?
> e.g. "REFUSED_BECAUSE_QTYPE_ANY"

no, because the problem is with existing clients, who only look for
rcodes they understand.
>
> If you want to respond to ANY with NOTIMP/REFUSED, would you also
> be willing to include an OPT RR in your response (when appropriate)?

as i wrote in
<http://www.circleid.com/posts/20120111_refusing_refused_for_sopa_pipa/>...

> ... So I know that we send REFUSED in response to a query when we
> don't like the client's IP address --- DNS servers do not even look at
> the question before deciding whether to send REFUSED. On the client
> side, if we hear a REFUSED we give up on that server and move on to
> the next server --- which means we assume that it was the client's IP
> address that the server is refusing, not the question we happened to
> be asking at that moment. Microsoft Windows will actually
> "de-preference" a name server if they hear too many REFUSED messages
> from it --- so BIND is not the only DNS software that interprets
> REFUSED in this way. What this boils down to is that REFUSED is all
> about the relationship between the client and the server, and has
> nothing to do with the particular question being asked. If SOPA or
> PIPA becomes law with a requirement to signal REFUSED when someone
> looks up an infringing or pirate domain name, then in the language of
> DNS we will be saying "please stop asking this server any questions at
> all." There is no signal in DNS that means "that's a bad question but
> please feel free to ask other questions." 

we are, in this case, defining a protocol. our goal is to get the client
to stop asking the ANY question. if we send is a signal that sounds
right (REFUSED, for example) but merely has the effect of "go to next
server" then we're losing.

if we're serious about redefining ANY as a meta-query, then answering
with RCODE=0/ANCOUNT=0 is correct. (as it would be for RD=0 queries
against an RA=1 server.)

but whatever we do, any new reaction to QTYPE=ANY has to ensure that the
client gives up, and stops asking.

-- 
Paul Vixie