Re: [DNSOP] I-D Action: draft-ietf-dnsop-edns-chain-query-02.txt

[Tony Finch <[e-mail]>]

Paul Wouters <[e-mail]> wrote:
> On Mon, 9 Mar 2015, Tony Finch wrote:
> >
> > Without this extension the typical number of RTTs required is 1, so this
> > isn't a reduction.
>
> When you have nothing of nohats.ca in your cache, and you ask for the
> A record of www.nohats.ca, you will normally get back the A record
> and the RRSIG. Then you need to query for the DS, DNSKEY, etc etc. And
> then for the DS, DNSKEY et all of the parent, the parents parent, etc.
> All of those require round trips.

No they do not. Please stop repeating this falsehood.

> Yes you can blindly send a bunch of parallel udp queries on every dot
> and hope the last one you need didn't take too long or drop.

Or you can use TCP and send the whole lot in a single packet.

In most cases the number of queries required is about the same number of
packets as a TCP initial window, so if your network can't cope with that
you are not going to have a happy time.

> > With this extension you still require 2 RTT if the target is SRV or MX,
> > and maybe if it is CNAME or DNAME depending on how much the server decides
> > to return. Maybe it requires 3 RTT if the server decides it doesn't like
> > doing chain queries any more.
>
> I'm happy to add a section of recommendations for adding common "related
> records" such as IPSECKEY, TLSA, SSHFP or what not. It does mention
> CNAME/DNAME and I'm happy to add an entry about SRV and MX. Would that
> address your concerns?

Well, it would fix an omission.

There is also the question of how the server should decide whether to
include the target validation chain or not, and if that depends on whether
the target is under the last known name or not. Is it entirely at the
server's discretion?

> > It occurs to me that you could get a lot of edns-chain-query's bandwidth
> > saving with a simple "minimal responses please" query flag.
>
> This is not about bandwidth saving.

But that is all it does.

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Southeast Iceland: Northwesterly backing southerly 6 to gale 8, occasionally
severe gale 9 later. Rough or very rough, becoming high or very high. Wintry
showers, rain later. Good, occasionally poor.