Re: [DNSOP] [ietf-wg-dnsop/draft-ietf-dnsop-domain-verification-techniques] Encourage people to add to the underscore label registry (Issue #104)

Paul Wouters <paul.wouters@aiven.io> Tue, 07 November 2023 23:52 UTC

Content-Type: multipart/alternative; boundary="Apple-Mail-F4ADECC0-97ED-4A9A-8BFD-D759DC0CE252"
Content-Transfer-Encoding: 7bit
From: Paul Wouters <paul.wouters@aiven.io>
Mime-Version: 1.0 (1.0)
Date: Wed, 08 Nov 2023 00:52:28 +0100
Message-Id: <9728C132-FE50-47B7-94B7-DC432E1EF653@aiven.io>
References: <ietf-wg-dnsop/draft-ietf-dnsop-domain-verification-techniques/issues/104@github.com>
Cc: "dnsop@ietf.org WG" <dnsop@ietf.org>
In-Reply-To: <ietf-wg-dnsop/draft-ietf-dnsop-domain-verification-techniques/issues/104@github.com>
To: ietf-wg-dnsop/draft-ietf-dnsop-domain-verification-techniques <reply+AUASQ5XFVYAVXJVHEZHSJNODK6MXPEVBNHHHMH2TUQ@reply.github.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/VSwFYODtmMCO2tQ3YeaR9vFLeek>
Subject: Re: [DNSOP] [ietf-wg-dnsop/draft-ietf-dnsop-domain-verification-techniques] Encourage people to add to the underscore label registry (Issue #104)
Precedence: list

On Nov 7, 2023, at 17:34, Erik Nygren <notifications@github.com> wrote:
> 
> As discussed at the mic, we should encourage people add labels to the dns node names registry:
> 
> https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#underscored-globally-scoped-dns-node-names
> 

So I am one of the Delegated Expert on that registry. So I have some experience with its entries.

There is a use case for people registering names in that registry to avoid clashing. Eg if Company X would have something database like at _db.example.com it would be good not to conflict with Company Y that uses the same record for another type of database service on the same prefix. If both do some service discovery via dns they might make the wrong assumption about the service they are connecting too (eg wrong vendor / product protocol).

But in our use case, there is no real conflict. We are not running a service on these dns names. It’s just the dns lookup itself that has the data.

On top of that, we encourage using known vendor name and service name so that in itself avoids conflicts. Registering these names is extra effort for companies that have no IANA relationship and it will also just pollute the underscore registry with a lot of vendor names. It might cause people to need to talk to lawyers about trademarks.

It might be good to advise the readers to check the underscore registry to avoid collisions, eg for a company that happens to be called dmarc so they can use “_dmarc-llc” or something. But I see no reason to register new entries. Eg what is the value for Aiven to add _aiven there ? The chance of another company called Aiven that also is in tech that also has services they want to validate via an _aiven prefix is about zero. And if it happens, it doesn’t actually matter if there would be two _aiven records at the customer where each one verifies one vendor/service.

Paul

Re: [DNSOP] [ietf-wg-dnsop/draft-ietf-dnsop-domai… Paul Wouters