Re: [DNSOP] proposal: Covert in-band zone data

[Dan Mahoney <[e-mail]>]

On Thu, 25 Jul 2019, Paul Ebersman wrote:

> olafur> My suggestion is to take a step back and say we have outgrown
> olafur> AXFR and we need better mechanism to sync various servers.
> 
> olafur> Lets start work on a new "SYNC Name servers" protocol that can
> olafur> meet modern requirements
> 
> paulw> +1
> 
> +1.
> 
> I think we're allowed to replace something after 20+ years ;)
> 
> Things that might go in:
> 
>   - AXFR/IXFR/*XFR
>   - zone meta data (create/modify/delete/digital-sigs)
>   - "covert" data
> 
> My only hesitation is we seem to slow logarithmically as we increase
> scope but this sure seems like the right direction.

As far as extending/replacing the AXFR protocol, this is great, however, I 
still see an orthogonal need for the thing I'm asking for: Parseable 
metadata.  For humans.  Not as a gateway to some sort of clever signaling 
or key-transfer protocol.  Analagous more to HINFO than TXT.

I'd be fine with this data ONLY living on the master, but having it 
survive things like named-compilezone or rndc freeze/thaw, or the slew of 
DDNS updates that things like ACME DNS-01 requires.

Effectively, this would be an internal-only DNS record that had a database 
representation but NO defined wire-format, so there'd be little chance of 
snooping over the wire (absent some kind of memory leak in the DNS 
implementation).

I also envision the "presentation format" looking like a regular 
comment so non-compatible implementations that tried to load a zone with 
these simply ignored them as they do regular comments.  Similar, perhaps 
to how server-side includes work in the web world.

-Dan