DomainKey-Signature: s=main2.dk.nominet.selector; d=nominet.org.uk; c=nofws;
 q=dns; 
 h=X-IronPort-AV:X-IPAS-Result:Received:Received:From:To:CC:
 Subject:Thread-Topic:Thread-Index:Date:Message-ID:
 References:In-Reply-To:Accept-Language:Content-Language:
 X-MS-Has-Attach:X-MS-TNEF-Correlator:x-originating-ip:
 Content-Type:Content-ID:Content-Transfer-Encoding:
 MIME-Version;
 b=IPtbp4o47H9bsWN3dKjB9p5ce69zbOi3J3u/TED02L5VCrxVE8WjyHw6
 behbIZ99Y29EdFNU4DOnb4AGfyyR9JMa+g0ONnBRiSLaMdH3f8ohKlC3l
 DBgN2zwDKX+dUqo22DsKC1K9LhHvSFCcsxQB5RilU5m3BGRJsPguVdc6j
 chYsbralX2oTUnxLEwBGwgLndLbxAh1au5Rm/mn7Za1g4+uElfEt7Gy2C
 4/zSSviiuyF+cItA/yTVWce5bgS5B;
From: Ray Bellis <Ray.Bellis@nominet.org.uk>
To: Stephane Bortzmeyer <bortzmeyer@nic.fr>
Thread-Topic: [DNSOP] Why no more meta-queries? (Was: More work for DNSOP :-)
Thread-Index: AQHQWnWJPMI5IT01dkySrOwj9GdNc50UUM6A
Date: Mon, 9 Mar 2015 16:05:29 +0000
Message-ID: <C1F43BD2-126F-4C1D-B084-A4B3A1F98ECD@nominet.org.uk>
References: <20150306145217.GA8959@nic.fr> <54F9C29E.9040408@jive.com>
 <54F9F90D.1020806@redbarn.org> <54F9FCD3.7010204@jive.com>
 <54F9FDFA.2030405@redbarn.org>
 <F25411A6-2CBD-4A76-949C-6E236FA87863@isoc.org>
 <20150306205920.GA17567@isc.org> <20150309142844.GA11602@nic.fr>
In-Reply-To: <20150309142844.GA11602@nic.fr>
Accept-Language: en-GB, en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-ID: <43A11DAAB935B647BED48D95E01F6C9D@okna.nominet.org.uk>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/dnsop/FjsNDGEEy_9vYP54s1AC_Ze0Z6s>
Cc: dnsop <dnsop@ietf.org>
Subject: Re: [DNSOP] Why no more meta-queries? (Was: More work for DNSOP :-)
Precedence: list


> On 9 Mar 2015, at 14:28, Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:
>=20
> On Fri, Mar 06, 2015 at 08:59:20PM +0000,
> Evan Hunt <each@isc.org> wrote=20
> a message of 28 lines which said:
>=20
>> (As an aside: I've often wondered why the DNS doesn't have *more*
>> meta-query types, less extensive than ANY, such as a single type
>> covering A and AAAA.
>=20
> Probably for the same reason that makes QTYPE=3DANY queries very
> difficult to understand for the beginner and counter-intuitive:
> because it is hard to specify the semantics. Imagine there is an ADDR
> meta-query covering A and AAAA. You send QTYPE=3DADDR and you get only A
> record(s). Can you be *sure* (and can you validate with DNSSEC) that
> there was no AAAA? Think of the various cases, RD=3D0, RD=3D1, caches,
> forwarders, etc.

I wrote this a few years ago:

http://tools.ietf.org/html/draft-bellis-dnsext-multi-qtypes-01

The primary stumbling block was the possibility (given DNSSEC) for multiple=
 different RCODEs for the different QTYPEs being requested.

I couldn't think of any failure modes in the non-DNSSEC case, but with sign=
ed data it's theoretically possible to have valid signatures for the owner =
name on one QTYPE and invalid signatures on another.

Ray