Re: [DNSOP] WGLC for draft-ietf-dnsop-let-localhost-be-localhost-02

Ted Lemon <> Fri, 26 January 2018 03:18 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 6639112EB01 for <>; Thu, 25 Jan 2018 19:18:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id sJQb6rcrLqjv for <>; Thu, 25 Jan 2018 19:18:06 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:400d:c0d::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 2C48612EAE3 for <>; Thu, 25 Jan 2018 19:18:06 -0800 (PST)
Received: by with SMTP id f4so24639534qtj.6 for <>; Thu, 25 Jan 2018 19:18:06 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=6aavDz2hrn0UTkrTT44OvigTlQ8PhSB1WS0pELkkXTk=; b=R0IpYxSjUADrpNvcl3nY8YViKop0160PahLUaHmGqpTAT6pgo/dIsqTrWTJh0zV/5b bPzTdeZWNWWy/G3U3CBzyJoDowAwoJl/0rfcefFuDHXQNdHk65/gri/liyUcRU2kc2Y6 AavpxbwGX2i5YHwU/FNRZzuM+2rlaWIJdf9CEKvrQhyOfw+uJ/heFc8jW0sQpZ7by8jk e8aTr2RVArrJXT4zjRatp/pJ4Y3/KmhCc+GJGk+/+RfbUjbIM14t7QCwb0lquHvAK0QM sFMXymWm8ui1hRaF92Obh4flHYBLgpdI51TLiNGFuWd/KnG3UjA9rjZBaedsuJST2n5C ruDQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=6aavDz2hrn0UTkrTT44OvigTlQ8PhSB1WS0pELkkXTk=; b=Ho4ZSqeZ7udGKxlEFnmNjDO3TwOTA9ATXd8LEermMnOlAuzaiq5DSZlYfkUF/T6SOQ MIcmAvM9xcoObZL/CTtuT2O+DI7tjnVMwreH7p6E0VqT5n5XPvmU/xCvuX3Bgj6ESMM6 pSfc1NyqJcjz5CQut96821sreQGrzAVeeDkpCklIRR/vNFcOdARYbgE1r2+M1PHRz8HG lkuc/bpvAXV50Q1eANN9fn6axC5sFcJmAkOhz+2gWfVwn5N+MkG0u9MKK0JLedg/iGbZ wzzxHBb6sd/fgzNBu++EEIL30qHKyq6GMdXy/yzliMylF0pCEPqr/sWg0tfYLJvAUzqY FMXQ==
X-Gm-Message-State: AKwxytevhtRLHk7J3c4Qs4ZSrJAUIPlJ7YRnOrQDAG/fOU/Yaxf/qowM lJjcjMULVWpRfKFppuSenjd4rzskreo=
X-Google-Smtp-Source: AH8x225YHJQcEDWPnYNeBLYcfN5OwIBEJw30Kgf0RY5p4WCZL3J9uI0bUpa67q5czoN1pMdK9U4M5g==
X-Received: by with SMTP id v31mr12341025qte.128.1516936685039; Thu, 25 Jan 2018 19:18:05 -0800 (PST)
Received: from [] ( []) by with ESMTPSA id i2sm2768891qkf.49.2018. for <> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 25 Jan 2018 19:18:04 -0800 (PST)
From: Ted Lemon <>
Content-Type: multipart/alternative; boundary="Apple-Mail=_4994437C-1304-4689-8BE7-D15D32C8364D"
Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\))
Date: Thu, 25 Jan 2018 22:18:01 -0500
References: <> <> <> <> <> <> <> <> <> <> <>
In-Reply-To: <>
Message-Id: <>
X-Mailer: Apple Mail (2.3445.5.20)
Archived-At: <>
Subject: Re: [DNSOP] WGLC for draft-ietf-dnsop-let-localhost-be-localhost-02
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 26 Jan 2018 03:18:08 -0000

On Jan 25, 2018, at 8:37 PM, Viktor Dukhovni <> wrote:
> I showed examples, of uses of "localhost".  Some use the TLD itself
> for the usual local IPs, others employ subdomains of "localhost"
> as a sensibly convenient place to park "for my eyes only" local
> DNS data.  These examples are not exhaustive.

That's not what I'm getting at.   What I'm getting at is that you are a consenting adult, and you are using localhost as a hack.   What you are doing is not the right way to do the hack—it's the expedient way to do the hack.   The right way to do the hack is with a real domain name.   You could for example use .homenet or something like it to address the problem.   Localhost is just a convenient top-level domain that you know you can safely use.

If it were the case that some end user who is not a consenting adult were going to have a problem as a result of this text, then I think that would be something we'd need to consider.   But in this case there's no problem.   If you want to do the hack, do the hack.   It's a hack.   It wasn't kosher to begin with, and this doesn't make it any less kosher.

> I also note that the draft does not adequately discuss what to do
> with queries with the DO bit set[1].  Presumably a forged NXDOMAIN
> without appropriate root-zone NSEC records may not be adequate in
> that case.  It probably (my opionion) makes more sense to obtain,
> and cache the NSEC and RRSIG records from the root servers, than
> to return a "bogus" reply.

The draft already addresses the DNSSEC use case.   What is the failure mode that you are concerned about here?   What would go wrong?