Re: [DNSOP] [homenet] My assessment of .homenet as described during the WG session yesterday.

[Paul Vixie <[e-mail]>]

On Thursday, March 30, 2017 6:11:00 PM GMT Steve Crocker wrote:
> On the other hand, might there be value in seeing how much errant traffic
> goes to the root so it can be reported and used to inform vendors, network
> architects, network administrators, et al?

it seems unlikely to me that any of them would care. they didn't for RFC 1918, 
and i did try, for years, before DNS-OARC existed, using f-root trace data.

> Given the amount of bogus traffic already goes to the root, I’m not
> immediately worried this will increase the traffic level to a point of
> concern.

that's what we've said about every other incremental increase. some day we 
will reach a tipping point and be wrong. i think if we know that dreck is 
coming, we should prepare for it, perhaps with an NS RR pointing to the AS112 
project, whose operators are ready to share data with researchers on request.

perversely, the ~90+% garbage we receive helps motivate overprovisioning, and 
helps ensure that when some server is down, its impact (less than 10% of load 
that should be answered) is statistically spread out across a large amount of 
dreck. if only good queries made it to the roots, then the statisticaly 
likelihood of not being able to answer one that mattered, would be higher. 
it's a congestion-based form of forward error correction, i suppose.

> And I remain puzzled as to why a simple NXDOMAIN response from the root
> isn’t exactly the right thing and why it matters whether it’s signed or
> not.

nxdomain isn't cached by everyone who should, and of those who cache it, 
nxdomain doesn't stop downward cache traversal everywhere (which it should), 
and in any case nxdomain covers the full qname and so would only stop 
traversals through a full (foo.bar.<homenetlabel>) qname, which is why we need 
query-minimization (which would permit queries for just <homenetlabel> or 
perhaps <onelabel>.<homenetlabel>) whose cached nxdomains would have a broader 
impact (if they stopped traversal and if they are cached at all.)

executive summary: the dns works at all, and we love that, but it's not happy 
and it's not healthy and it's never going to be.

vixie