Re: [DNSOP] Proposal: Whois over DNS

[John Bambenek <[e-mail]>]

> Hello everyone,
>
> Jim Reid <[e-mail]> wrote:
>
> > BTW, whois was originally intended to provide a way to publish
> > out-of-band contact data so the domain holder could be
> > contacted whenever their DNS or email was broken. Putting this
> > info in the DNS would defeat that.
>
> Implementation details aside, I think having a technical
> specification like this would be quite interesting from the point
> of view of automatically updates to existing Whois databases,
> without requiring the registrant directly (or indirectly)
> interact with complex APIs or provider-specific web interfaces.
>
> Much like CDS for DS records, and CSYNC for NS records, having a
> well defined vocabulary for this data in DNS could be a useful
> step towards such automation. Assuming a cautious implementation,
> this need not make whois any less reliable.
>
> So, that's a potential use-case which I haven't seen mentioned
> here yet.
Good view point, will consider.
>
> That said, I agree it cannot solve GDPR or other policy concerns.
Why? GDPR applies to IP addresses, that doesn't impact DNS yet. Contact
info can be on a webpage, why not in DNS as long as I am the one putting
it there (also bear in mind, role-based information is fine, thus you
can put non-PII records there, or nothing at all).
>
> Also, I really don't see this data as meaningfully useful in
> fighting abuse, if only because it's very unlikely to see wide
> adoption in the near future, and because it will be incredibly
> easy to just create plausible looking (or maliciously
> Joe-jobbing) fake records. 

I'm genuinely curious of something. The most I've engaged in this debate
about WHOIS records and what is or is useful in fighting abuse, the
opinions of those who actually fight abuse for a living are discarded a
priori. This is WHAT I DO. I can give you hundreds of others. We are in
near unanimous consent that this information is valuable in fighting
abuse EVEN WHEN ITS FAKE. And as someone who knows a thing or two about
deception, creating plausible fake records are a harder problem than you
think.

> This will largely boil down to 2 bits
> of information: "did someone in the domain's chain of tools &
> admins decide to implement this standard?" and "did anybody
> decide to fill out the relevant forms?" - neither of which are
> meaningful when combating abuse. I am extremely skeptical of any
> claims that there's more information to be extracted here.
>
> The fact that it will be easier to programmatically look up this
> information seems to me unlikely to actually make things better,
> I see it mostly adding complexity and more GI for the GO. Just my
> opinion, obviously.
>
> But I remain vaguely excited about the potential for automation!
I harbor no illusion, it depends on adoption. Agreeing on a standard is
the first step. If there is no standard, there can be no meaningful
adoption. Putting adoption before setting a standard is to ensure
failure from the start.
>
> Cheers,
>  - Bjarni
>