Re: [DNSOP] comments on draft-ietf-dnsop-serve-stale-03

Dave Lawrence <> Mon, 25 March 2019 23:29 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 7555C120151 for <>; Mon, 25 Mar 2019 16:29:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id UcOs4WC1P2l4 for <>; Mon, 25 Mar 2019 16:29:00 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 269BC12014C for <>; Mon, 25 Mar 2019 16:28:59 -0700 (PDT)
Received: by (Postfix, from userid 102) id D0FF38ED0A; Mon, 25 Mar 2019 19:28:57 -0400 (EDT)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <>
Date: Mon, 25 Mar 2019 19:28:57 -0400
From: Dave Lawrence <>
In-Reply-To: <>
References: <> <> <> <> <> <> <>
Archived-At: <>
Subject: Re: [DNSOP] comments on draft-ietf-dnsop-serve-stale-03
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 25 Mar 2019 23:29:03 -0000

Ray Bellis writes:
> Serve stael must not become a vector whereby malware can keep its C&C 
> systems artificially alive even if the parent has removed the C&C domain 
> name.

I wholeheartedly agree with this ideal, and am very open to
considering text improvements.

The document already has guidance on this point, but it is admittedly
in a considerations section and not in standards action, and is a
weaker "SHOULD" versus "MUST" right now.

Would the WG prefer that a line like this be put into the Standards
Action section?

  When no authorities for a name are able to be reached, the resolver
  MUST attempt to refresh the delegation.

I like the basic idea but am a little stuck on the wording because of
the endless loop it implies.  This is probably why it appears as
"SHOULD" already (but I honestly don't remember, so there's that).

It seems to me that the risk is very low, even as currently written in
the draft.  Not only do I have a lot of confidence in the implementers
of the most widely used resolvers in the world, as they're right here
participating too and have in the past shown good conscientiousness in
this area, but the practical attack is still hard to make meaningful.
If "the parent has removed the C&C domain name" as you said,
serve-stale shouldn't even kick in.  NxDomain, problem solved.

Various other scenarios come to mind, even with obstinate parents that
won't remove the delegation and the zone's NSs have gone dark, but
those scenarios have other possible remedies.  And fast flux using
long TTL NS RRsets are an issue no matter whether serve-stale is in
play or not.

So text regarding refreshing delegations could be given even more
words to describe backoff intervals and such, but to what end?  What's
the scenario?  And wouldn't it be handled better by reviving
resimprove to talk about the generalized problem?

(To be clear, I'm quite okay with politely being shown that I'm wrong
and there is a vector by which serve-stale becomes uniquely
interesting, and would certainly endeavour to make sure it is addressed.)