Re: [DNSOP] I-D Action: draft-ietf-dnsop-server-cookies-00.txt

Philip Homburg <> Mon, 09 September 2019 14:56 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 88B9B12022D for <>; Mon, 9 Sep 2019 07:56:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.499
X-Spam-Status: No, score=-1.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.399, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id YVs_f7XorRnj for <>; Mon, 9 Sep 2019 07:56:24 -0700 (PDT)
Received: from ( [IPv6:2001:888:1044:10:2a0:c9ff:fe9f:17a9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id DE24712008B for <>; Mon, 9 Sep 2019 07:56:23 -0700 (PDT)
Received: from (localhost [::ffff:]) by with esmtp (TLS version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384) (Smail #157) id m1i7L5a-0000JaC; Mon, 9 Sep 2019 16:56:22 +0200
Message-Id: <>
Cc: Willem Toorop <>
From: Philip Homburg <>
References: <> <> <> <>
In-reply-to: Your message of "Mon, 9 Sep 2019 16:08:24 +0200 ." <>
Date: Mon, 09 Sep 2019 16:56:21 +0200
Archived-At: <>
Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-server-cookies-00.txt
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 09 Sep 2019 14:56:26 -0000

>This is true.  Including the Client IP in constructing the Client Cookie
>was intended to deal with this, but this operation is impractical with
>UDP; expensive at best and not suitable for high volume recursive to
>authoritative traffic.
>We could recommend it for stub to recursive traffic, for which the high
>volume performance requirements are less of an issue... what do you think?

Maybe high volume should be the exception.

I think it is better to specify that all code should include the Client IP
unless explicitly configured to leave it out.

A bit of testing suggests that a naive way of getting the Client IP takes 
about 2 microseconds on modern hardware. So a bit of caching on high 
performance resolvers would be enough.