Re: [DNSOP] I-D Action: draft-ietf-dnsop-server-cookies-00.txt

Philip Homburg <> Mon, 09 September 2019 16:14 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 6CA3B12080E for <>; Mon, 9 Sep 2019 09:14:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.499
X-Spam-Status: No, score=-1.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.399, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id UctOhLUTR7pn for <>; Mon, 9 Sep 2019 09:14:24 -0700 (PDT)
Received: from ( [IPv6:2001:888:1044:10:2a0:c9ff:fe9f:17a9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 0057312080C for <>; Mon, 9 Sep 2019 09:14:23 -0700 (PDT)
Received: from (localhost [::ffff:]) by with esmtp (TLS version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384) (Smail #157) id m1i7MJ4-0000K6C; Mon, 9 Sep 2019 18:14:22 +0200
Message-Id: <>
Cc: Willem Toorop <>
From: Philip Homburg <>
References: <> <>
In-reply-to: Your message of "Mon, 9 Sep 2019 14:13:01 +0200 ." <>
Date: Mon, 09 Sep 2019 18:14:22 +0200
Archived-At: <>
Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-server-cookies-00.txt
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 09 Sep 2019 16:14:26 -0000

>When implementing DNS Cookies, several DNS vendors found that
>impractical as the Client Cookie is typically computed before the Client
>IP address is known. Therefore, the requirement to put Client IP address
>as input to was removed, 

In Section 4.4, the client IP is added to the hash in the creation of the
server cookie.

I wonder what happens if a client alternates between different IP addresses,
for example, the client has multiple interfaces, the client has multiple
IPv6 prefixes on a single interface or a CGNAT device regards different DNS
requests as independent UDP flows and assigns them to different parts of
a CGNAT system.

It is possible that in those cases, a server would force a client to
retry for every request.