Re: [DNSOP] [Ext] I-D Action: draft-ietf-dnsop-svcb-https-05.txt

Eric Orth <> Wed, 12 May 2021 19:27 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 859E13A0DED for <>; Wed, 12 May 2021 12:27:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -17.599
X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 5EYrcb5j0nkb for <>; Wed, 12 May 2021 12:27:27 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4864:20::b2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id C860B3A0E25 for <>; Wed, 12 May 2021 12:27:27 -0700 (PDT)
Received: by with SMTP id y2so32043077ybq.13 for <>; Wed, 12 May 2021 12:27:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=fcG0uyZ6w4QnYxwpK0tpp8KVtKSsJdaVT2P6Nhev2uQ=; b=swHCmzKR7GEj0D5R/Lz7ZtIvg/8B0ZK/0mRP38ru9eKepX3ulHAkAU+HIKMrujFvfD Yxr0LJWZUsrkij7nYgFJZVOfV4uQItgXPdMUiC3zPAxsbItJKj1g2aSU6TE9g1sRXCP4 dGRzP8ctKkrBxCrc7fv4fOxaczT7tG6QYEkM8RB6j6yfFmU/RIV88NZHiY6mMo+8oM1+ NuwYPmhTYidn+xkv7sCLeLIE4NpozrhSNSxG4z38wcC7dJNZKsq0KEZoBdV1kZfSvpN3 5jAl4brFjcxZdJaVgl8ePzAC0adsNn3SKO+W7plzG0UwY0NhrSYBiHb9SZ2knpZCXqoV cWOg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=fcG0uyZ6w4QnYxwpK0tpp8KVtKSsJdaVT2P6Nhev2uQ=; b=bCzh510y5SC9mI60CkXcqz2EG4/9oCekP8XIXH9Ec5ZppJXholpa7qdSrZ1SEBc5+1 Z6HwphYkGAbonMYFNWVlxtjnYfwWD/TG9HCg3wygf4OAJXuqGAxfxPXeJUJEQ4CwO7tl HgPCTrbN1+nyBRXyNm9g6mA8aYDbOIHfo1tQ+zKWimPEdfj2SgRG33P6R4Lxpu6/CKdS VAzNAA3fxEI+7EOE1qcxrnozwFR0c22UhBh+UMpMF+r+GL9y4RKfG8u68T0aXaX06N4u 1E/7D5mtyNtjcU8WyddmIDD4agd6JrnCbFGNCL9yCkuHYye5T8MQxwWI7zimM46Zbhl+ Kd8w==
X-Gm-Message-State: AOAM533eoWXfq2uasRaDEgHknbYGKXtcQFS9aJbBXBoCJaKQk/HYGonR dUEsp9MF+ORNqM6YLkQeDMvlU1UZ4Ye1vn5VWFf9QjfbTDgiDQ==
X-Google-Smtp-Source: ABdhPJyy5TbecYtIRQXi55FGhQNTtfjaiP5gjyOUA0em9lGvq75gtWMNoW4k291knCgMAmiajsOooROAg3z9nQgkc9M=
X-Received: by 2002:a25:fc0c:: with SMTP id v12mr16673644ybd.490.1620847645630; Wed, 12 May 2021 12:27:25 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <> <> <> <> <> <> <> <>
In-Reply-To: <>
From: Eric Orth <>
Date: Wed, 12 May 2021 15:27:13 -0400
Message-ID: <>
To: dnsop <>
Content-Type: multipart/alternative; boundary="000000000000277b7d05c227001d"
Archived-At: <>
Subject: Re: [DNSOP] [Ext] I-D Action: draft-ietf-dnsop-svcb-https-05.txt
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 12 May 2021 19:27:33 -0000

I have no strong opinions on any of the discussions regarding escaping in
presentation mode because I don't have much involvement in dealing with
presentation mode of DNS records.  The client I work with parses wire
format directly into its internal structures.

>From my wire-format-only perspective...

I strongly oppose breaking out the key/value pairs of the current proposal
into separate records within an RRSet.  The "independently meaningful"
records argument in favor of per-endpoint records isn't just some small
nice-to-have but is actually rather crucial to avoiding
inconsistent/missing-data issues that could easily become security issues.
Per-key/value records opens things up to too much error-proneness where the
separate records get cached separately (with potentially differing TTLs),
so there's a lot more room for clients to end up receiving/handling only
some parts of endpoint data without a clear indication that other parts are
missing.  Could be much more problematic than just getting a partial view
of the endpoint options.  Easily becomes a security issue, e.g. when a
client gets most of the records for an endpoint but misses the record
containing the ECH config.

I also oppose allowing multiple aliases within an RRSet.  This would allow
aliasing trees, unreasonably exploding the complexity/performance scope of
query followup logic in stubs and recursives.  In practice, I don't think
this would actually make multiple aliases useful because I would then
expect many stub/recursive implementations (including mine) to only make
followup queries down a single branch of the alias tree.

On Wed, May 12, 2021 at 3:42 AM Peter van Dijk <>

> On Tue, 2021-05-11 at 18:26 +0200, libor.peltan wrote:
> >
> > May I be wrong, but I think that name, type, class and TTL are not
> repeated in one RRSet with multiple RData. Not in wire format and not
> necessarily even in zonefile. (?)
> Zone files allow you to leave some of those out on subsequent records. The
> wire format does not:
> Kind regards,
> --
> Peter van Dijk
> PowerDNS.COM BV -
> _______________________________________________
> DNSOP mailing list