Re: [DNSOP] Priming query transport selection

Jaap Akkerhuis <> Wed, 13 January 2010 23:10 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id AAE973A67AC for <>; Wed, 13 Jan 2010 15:10:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id e-4Ix8z7kc1A for <>; Wed, 13 Jan 2010 15:10:40 -0800 (PST)
Received: from ( [IPv6:2001:7b8:206:1:216:76ff:feb8:3c02]) by (Postfix) with ESMTP id 199103A67A5 for <>; Wed, 13 Jan 2010 15:10:39 -0800 (PST)
Received: from (localhost []) by (8.14.3/8.14.3) with ESMTP id o0DNAWS7070771; Thu, 14 Jan 2010 00:10:32 +0100 (CET) (envelope-from
Message-Id: <>
To: Olafur Gudmundsson <>
In-reply-to: <>
References: <> <a06240801c773e8e88485@[]> <>
Comments: In-reply-to Olafur Gudmundsson <> message dated "Wed, 13 Jan 2010 16:57:43 -0500."
Date: Thu, 14 Jan 2010 00:10:32 +0100
From: Jaap Akkerhuis <>
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.2.3 ( []); Thu, 14 Jan 2010 00:10:33 +0100 (CET)
Cc:, Edward Lewis <>
Subject: Re: [DNSOP] Priming query transport selection
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 13 Jan 2010 23:10:41 -0000

    Well having TCP used for all priming queries would make me feel better
    as TCP traffic is harder to forge.

So let's forget about dnssec an do everything over TCP?
    But seriously DNSSEC signed and validated data should protect the
    the resolver from going to the forged addresses.

So you wasn't serious? 

    Yes someone can forge the answer and DoS the resolver into believing that
    nothing works.
    The situation is "." and zones are hosted on the
    root servers, thus the same servers will get all follow-up questions
    about signed address sets as the priming query.
    Resolvers like to ask the "close" servers for information thus it
    is almost certain that over time the resolver will send a question
    to all root servers.
    Based on this I think one TCP connection is better than 14-27
    UDP ones. (Resolver that only supports one transport should never
    ask for the address records it will not use).
    We can even take this one step further and ask both priming questions
    over the same TCP connection that is NS and DNSKEY.
    Ed in my mind this is straight forward engineering question,
    which approach is better as in cheaper/faster/safer.
But then I expect some decent answers and not some handwaving and flip-flopping
between being serious and not.