IETF Logo Mail Archive

[DNSOP] Re: Synchronizing caches of DNS resolvers ("poisonlicious" draft)

Ondřej Surý <ondrej@sury.org> Tue, 28 July 2026 08:53 UTC

Return-Path: <ondrej@sury.org>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id E5D6911FAEE12 for <dnsop@mail2.ietf.org>; Tue, 28 Jul 2026 01:53:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1785228807; bh=GYyhbndAJNnswkXcAXgSMc/MLlA/d5yY/HIT726/3So=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=S2JWPYLNzayNfW5twTH1t2jYy0j9d3jrL6sSsCMXTGTUiAvq6j6zNncptytIT1Ihg Dp3ODfiTZTqnQG9Eld+yshy0Mz2iE5B6aa0FfzrGD4FxRM+liJoAUhUCoWnBE2ACBi t/2Jmj2ijiwYuo4EEn+kab8+sxgEnFLgM6asKjVA=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.799
X-Spam-Level:
X-Spam-Status: No, score=-2.799 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=sury.org header.b="Ce4u/Ey6"; dkim=pass (2048-bit key) header.d=messagingengine.com header.b="Cba+5S1Z"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P9QSulQpvmJU for <dnsop@mail2.ietf.org>; Tue, 28 Jul 2026 01:53:27 -0700 (PDT)
Received: from fout-a5-smtp.messagingengine.com (fout-a5-smtp.messagingengine.com [103.168.172.148]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 6202E11FAEE0D for <dnsop@ietf.org>; Tue, 28 Jul 2026 01:53:27 -0700 (PDT)
Received: from phl-compute-04.internal (phl-compute-04.internal [10.202.2.44]) by mailfout.phl.internal (Postfix) with ESMTP id 2E8A2EC004C; Tue, 28 Jul 2026 04:53:27 -0400 (EDT)
Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-04.internal (MEProxy); Tue, 28 Jul 2026 04:53:27 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sury.org; h=cc :cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm3; t=1785228807; x=1785315207; bh=GYyhbndAJNnswkXcAXgSMc/MLlA/d5yY/HIT726/3So=; b= Ce4u/Ey6H5EkQ7dpZSYcaLVubiibfqwzUM0WauZ3ik7ePn/hyjnito07L6GAXIVt BkhzKXIkqiygl6gMCiIr6MKyzRPqQ6+c0i8oxutFJZNQ+HoD8RmpT7VoVHEkLjEf e+d7Q+ad1ogNASdKA2UeKPMIrrUeYCg36/1HtqxdWQa6iriwVbMnOK55pf9qOLUA XU9ju7Ll8d9WkXuY7TJGaNBYxW2KtEXZ2Qu2Ni9NXhQowQMaeNyMTjlO4LDeRMbF x0CMxB6l49V/FFdBd50taQQxxrGzVV7J42eTHVVCbJ1DH0w6mCIXHQ08Lw/t7JcA FU2TXZA+UFSNl8TPfPmZLQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1785228807; x= 1785315207; bh=GYyhbndAJNnswkXcAXgSMc/MLlA/d5yY/HIT726/3So=; b=C ba+5S1ZvOLLXFX8xEr+ZnLO2uvVqocuiDVuSU/H+j4hCq+7vP29he7gq/ei9DyuQ pvDIqv4Hj+LQCtOJkaYBXDKrfqc83TxWSLVh96LrDwg55qFH6PzwHZRheyz2cVHi LK5wOsDCj0G+ziOBHGwUjB7Go+ajzudYHzPydlzPV2NpRcHGluZny8uviYy9dNSN Th8a4Y4UxnR42sg/QIS0jhqpH/VZUhrXhWImLzPdhQI+dosQ0OS3pCVpaaiWzVEM SvIosTTpWfVvhDHtsRkT6QqAya8ZNoz6YJDp5BwCDf5/TzsnqCsFAEgAcEHhuLtW jdFtN8SX6c1wpBKW9W3yw==
X-ME-Sender: <xms:B25oajTLiqkYI_Z2BJY4Ifyl1fteBrp4aucP8fOAirPwXYp20W3k7A> <xme:B25oahEqRBCI46U1Dje8d41yrQhHed11THOq197znJSa1olSpB9xERGl34EBy0dub vPeLAD3R4gUOL5jxDEG_dhVNBm2c5oxGiTIX_SiwimcmMBj0Qavwjc>
X-ME-Received: <xmr:B25oark4fL9Y3TxghydSbCI7lYb-RgmghHab-z8wPf8jpbpg9d4ESXV6-w85pdYUUu8e>
X-ME-Proxy-Cause: dmFkZTEDgVRsFW6l6ma+Dfg9E4hDhrr6A5bM+Lfp7eOTTjqQby+gCPqxHLnnh02wzcjOGu sCbvkdaUoGbTHFta/DlgAaHsDU9RWK85BdJ++PjTxu/TmJFzt2WZMMX3G7vKFALMpMSkOs zoyp4chdic6crDd48Kjzks90Ggtp1gH1uGObc8zPJRBrLG1RY0Cy7iK8NfiXh5KuVUuS+j XjLczqoogauMzuFquKgr4Bgiw/vQZn/ILdBJxDT3HvzlVrmUQwRQrF94M2YOX666MmP4yX WrgXYwJK8tLvPr2T8vofuJpS6ySS8DqoUFTp7D9hhb+i9OAmveoquJOgMc61Zy2kuJhwsL JmxQWBOn30ZEE1SBBfT8WXkSAu2xbrfh5ajzhKr4BlCX4rNzET5ls0h1Yt/QPkdfEonhe0 4KdMsgiokQbHs00sgyfpQcqhUqQzL0Nq+7Wf/0OwNNvipSf+wFx8DYXh/N4gY9aHYb6p6r c5HrxG/HC/wy+eO3CzvvHAb62oOcxZfdDIf3oT9oaT0+GkFM52tVyq0MYjGeVm3meJgQ3p PnrSYWSQ5W5WZ0uG2x082CMBNsH97Cecvhb1chykjRgaRYRf0J5eLdlgGG2+IGoJWzPyFr w4leZ5S1758f9m43u2ek5lLQcRaoLTPIyuq/1JC4eKj7w2Hln6j1fSXVgoMw
X-ME-Proxy: <xmx:B25oak38-bOX-KKBlrGqhDv12lM8aujdL0iiyf9ChrZojWnholw7xQ> <xmx:B25oavSQYsvQbggtC4-OpGZH0IkV70LdgC8TaCkvn5vHTyN8MKgirw> <xmx:B25oaus4_Ydfw0uR3kPDJb-Dp7valICqtcGAaF7ZeScpQDl5u-Fe_g> <xmx:B25oasbbXpQnft9pVRz73Rgz_4bLwyCJ42fL4iAcSeI58LiF_T_hAw> <xmx:B25oagzHRkRMO9QBpF5zsS-HVVxCSMP5uPBsm5dy1_sTMLjKsNkNslhZ>
Feedback-ID: ida81469e:Fastmail
Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 28 Jul 2026 04:53:26 -0400 (EDT)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3897.100.8.1.1\))
From: Ondřej Surý <ondrej@sury.org>
In-Reply-To: <C7BA4A7F-4EB8-48B8-A45E-3CCF33F209B0@pch.net>
Date: Tue, 28 Jul 2026 10:53:14 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <90CED010-D268-45C6-973D-8791FDB6ACCB@sury.org>
References: <al4QKxmXzVPfghm9@nic.fr> <C7BA4A7F-4EB8-48B8-A45E-3CCF33F209B0@pch.net>
To: Bill Woodcock <woody@pch.net>
X-Mailer: Apple Mail (2.3897.100.8.1.1)
Message-ID-Hash: F25ALKR276DVK4XEH6SL4KDFX7R4TJZS
X-Message-ID-Hash: F25ALKR276DVK4XEH6SL4KDFX7R4TJZS
X-MailFrom: ondrej@sury.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: dnsop@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: Synchronizing caches of DNS resolvers ("poisonlicious" draft)
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/cSFwy36YH-QM_9ddCLNkTSuA7P4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

> On 27. 7. 2026, at 07:54, Bill Woodcock <woody@pch.net> wrote:
> 
> 
> 
>> On Jul 20, 2026, at 17:55, Stephane Bortzmeyer <bortzmeyer=40nic.fr@dmarc.ietf.org> wrote:
>> https://datatracker.ietf.org/doc/draft-bortzmeyer-dnsop-poisonlicious/
> 
> I strongly support the effort, but would prefer DoT to be mandatory, and DANE authentication to be preferred over TSIG, when available.

I strongly believe the security mechanism should be a matter of local policy
(and implementation defaults) rather than something enforced by the Internet
Standard.

So far, the DNS does not even enforce a secure transport and/or authentication
for XFRs, so enforcing DoT/DANE/whatever for something that is going to be
mostly used on internal networks feels over the top.

Ondrej
--
Ondřej Surý (He/Him)
ondrej@sury.org

A gentle nudge is always appreciated if I take a little longer to reply.

v2.46.0 | Report a Bug | By Email | System Status