Re: [DNSOP] Status of "let localhost be localhost"?

[Mike West <[e-mail]>]

On Wed, Aug 2, 2017 at 3:44 PM, Mike West <[e-mail]> wrote:

> On Wed, Aug 2, 2017 at 3:38 PM, Richard Barnes <[e-mail]> wrote:
>
>> It seems like the desired behavior for the DNS infrastructure here is the
>> same as for .onion -- return NXDOMAIN.  After all, these are queries that
>> should never leave the end host, so anything not on the host should handle
>> them as an error.
>>
>> cf. https://tools.ietf.org/html/rfc7686#section-2
>>
>
> I'm pretty sure this is what the draft we're discussing attempts to do.
> See #2 under https://tools.ietf.org/html/draft-west-let-localhost-b
> e-localhost-03#section-3. It could be more explicit about the response,
> however... I can address that in a -04 if folks agree with the approach.
>
> (I also wonder whether it would be a better idea to reframe this draft as
> something akin to the "onion" RFC: that is, defining the behavior as a
> stand-alone document rather than monkey-patching RFC 6761.)
>

I poked at the draft a bit over the weekend, reworking it into a
stand-alone document in https://tools.ietf.org/html/
draft-west-let-localhost-be-localhost-04. I think it ends up being clearer
overall, and hopefully y'all agree.

Regarding the outstanding question of DNSSEC and insecure delegations, this
new draft takes the same approach as the ".onion" RFC, as Richard
suggested. I'm willing to run with whatever the group agrees upon on this
point, but this seems like a reasonable approach that's both simple to
explain and consistent with existing recommendations.

Feedback on that new draft would be very welcome indeed!

-mike