[DNSOP] Sending unknown / unspecified EDNS options to authoritative DNS servers

Mark Andrews <marka@isc.org> Mon, 15 November 2021 21:32 UTC

From: Mark Andrews <marka@isc.org>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.120.0.1.13\))
Message-Id: <B5C2870E-C010-4FB6-9E76-6F58D2856C86@isc.org>
Date: Tue, 16 Nov 2021 08:32:44 +1100
To: dnsop WG <dnsop@ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/61oJg7k-lpr_51TOmfRtMSS0xNQ>
Subject: [DNSOP] Sending unknown / unspecified EDNS options to authoritative DNS servers
Precedence: list

Unfortunately I fell ill right before the WG meeting or I could have answered this then.

I’ve been measuring this behaviour for years now and incorrect behaviour is almost non-existent.

Old versions of MS Windows DNS servers used to echo back unknown EDNS options.  This was fixed by MS a couple of years ago.

Old versions of Jupiter firewalls used to block unknown EDNS options.  Juniper fixed these several years ago. These have mostly been replaced.

There where servers that returned FORMERR to unknown EDNS options.  These too have mostly gone in the last couple of years.

There are servers that only return EDNS responses to specific EDNS options.

Having recursive DNS servers that are sending EDNS options by default in requests has cleared out most of the broken servers.

Anyway the time series and responses from the last daily runs are available at https://ednscomp.isc.org for a number of target populations.  The two listed below are for all the servers for .GOV zones.

https://ednscomp.isc.org/compliance/ts/govfull.optfail.html

https://ednscomp.isc.org/compliance/gov-full-report.html#eo

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka@isc.org

[DNSOP] Sending unknown / unspecified EDNS option… Mark Andrews