Re: [DNSOP] draft-koch-dns-unsolicited-queries-03

[Alfred Hönes <[e-mail]>]

Below are some thoughts continuing previous off-list discussion on
    draft-koch-dns-unsolicited-queries-03 .
(The author has indicated interest in reviving that memo.)


(1) "unsolicited"  ?

I had raised concerns regarding the use of "unsolicited" in the
document title and the body of the draft.

"Unsolicited" is generally used in communication context where
there's also a "solicited" mode, for instance in routing or resource
discovery protocols (classical examples: ARP, RIP).  In the (normal)
DNS only responses are solicited (by the releted queries), and
queries are never solicited by the receiving node (authority/cache),
thus from the PoV of an authority / caching resolver, *all* queries
are unsolicited.  (Arguably, there's one exception: if a response
with TC is sent over UDP, the same query repeated immediately over
TCP might be regarded as "solicited" from the PoV of the answerer
-- but that is not the topic of interest here.)
Therefore, the word "unsolicited" seems unsuitable to distinguish
among queries, at least in the sense intended in the draft.

In email, "unsolicited" also primarily means "not prompted by a
pre-existing (commercial or private) relationship or dialogue".
Such 'context' is never present in DNS transactions (perhaps with
the exception of zone transfer traffic retricted by policy to
specific nodes).

Thus, I am concerned with using "unsolicited" for classifying DNS
queries that might better be denoted as "improper" or "misdirected".
"unexpected" would apply from a DNS database PoV of the authority,
but it has been argued that, given the frequency of such queries,
they merely can be attributed that property from the operator's PoV.
That's correct.  The main objective of the draft is to identify
frequent types of such improper queries in order to allow measures
to be taken to *redirect* these queries to the proper entities.
Hence, since the desired action is "redirect", the term "misdirected"
seems to be rather suitable in this context.

I'd welcome a proposal for another, yet more suitable term, but
for the moment, "misdirected" might be the best-matching term.

Please note that "misdirected" does not apply to the email scenario;
thaty seems to be another hint that the nature of the distinction
made is quite different, and hence another term than "unsolicited"
is needed.

(2)  Response variants

Variant 1 (No Response) has further drawbacks, in that it will
trigger additional traffic: retries, trying the same query on
sibling authorities.

Variant 2 (Sink delegations) also will trigger more traffic,
however directed to blackholes; the resulting degree of spilled
network resources depends on the addresses chosen and the routing
system.  Should certain "Special Purpose" IP addresses be used
for this purpose?


Kind regards,
  Alfred Hönes.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: [phone], Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [e-mail]                     |
+------------------------+--------------------------------------------+