Re: [DNSOP] CDS polling, was Re: [Ext] Re: Clarifying referrals (#35)

[Mark Elkins <[e-mail]>]

On 14/11/2017 01:37, Evan Hunt wrote:
> On Tue, Nov 14, 2017 at 09:16:43AM +1100, Mark Andrews wrote:
>> Remember the draft was designed to handle ALL record updates to the
>> parent zone after being approved by the registrar in a unified manner.
>> NS, DS, A, DNAME, AAAA, TXT, CNAME, etc. This isn’t restricted to DS
>> records.  
> In the present context, I was only suggesting this method be used for
> NOTIFY, not UPDATE -- to signal the parent that it should poll the child
> for CDS/CDNSKEY.  (I guess CSYNC could be included in the mix as well,
> though, for updating NS and glue.)
>
> I would suggest the child should be polled periodically regardless. If
> the SRV record were spoofed, causing the child to send a NOTIFY to the
> wrong address, synchronization should still occur, just not as quickly.

Getting the parent to examine the child in order to examine changes in
CDS/CDNSKEY is something I'd dearly like to see done.
With foot firmly stuck in mouth and probably breaking all protocols....

Who am I:
I'm a 'local' Registrar (Non-ICANN Accredited), running DNSSEC for
clients. I speak EPP mainly to the ZACR (South African Central Registry)
- usually for the CO.ZA Domain name space. I also speak EPP to a bunch
of other people.
I either run the DNS zone for the client - so know when to send an EPP
update to the Registry (this is totally automated) or run a
"Registration Only" service where clients run their own (DNSSEC Signed)
zones. When the latter do a KSK rollover, they are currently obliged to
login to https://vweb.co.za into their account, find their Domain and
push a [Reread Zone info] button which does a DNS Lookup over TCP using
a DNSSEC aware recursive resolver to see what NS and DNSKEY records have
changed, brings them back and presents them to the user. I automatically
generate CDS records from the DNSKEY. A short time later - these are
pushed to the Parent via EPP.

More ideally, this [Reread Zone info] button should be triggered by the
client using a well documented standard (RFC?), probably a URL and
passing to the URL the Domain Name to "check". (I like to call this the
"tickle RFC").

The same could be used directly with Registry systems...
If you want to get CO.ZA to "Poll" your Nameservers, look for a DNS
record (lets call it TCKL) in the top of the zone which should return a
web like URL which you can then "GET" with... (GET seems more simple
than POST)

co.za    IN    TCKL    "https://poll.registry.net.za?Domain="
(Most ccTLD's might do the same?)

For myself, I'd tell my clients mentioned above to look for:

vweb.co.za    IN    TCKL    "https://tickle.vweb.co.za?Domain="
(Most COM type Registrars might do the same?)

I guess one could have multiple answers for redundancy.
No "security" as in passwords should be needed.
I don't see this being used to DDOS Registries, only do something
further if the domain is one of yours, only if it is already DNSSEC
signed, and only trust the answer if the DNS Connection validates
properly, any faults - wait 5 seconds and then report an error (if so
desired).

I don't quite see how a SVR record could do this as per

https://tools.ietf.org/html/draft-andrews-dnsop-update-parent-zones-04

I also don't remember seeing any DNS record types where the RHS is a full URL.

To me, for now, this would only be used for DNSSEC updates (i.e. CDS/CDNSKEY where the Child Zone is already signed)

Anyway - that's my baby step, so just a small foot in my mouth. Please be gentle.

-- 
Mark James ELKINS  -  Posix Systems - (South) Africa
[e-mail]       Tel: [phone]  Cell: +27.826010496
For fast, reliable, low cost Internet in ZA: https://ftth.posix.co.za