Re: [DNSOP] abandoning ANAME and standardizing CNAME at apex

Paul Vixie <paul@redbarn.org> Mon, 25 June 2018 15:47 UTC

Return-Path: <paul@redbarn.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B02B5130DCE for <dnsop@ietfa.amsl.com>; Mon, 25 Jun 2018 08:47:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b8MC0qMcgT9b for <dnsop@ietfa.amsl.com>; Mon, 25 Jun 2018 08:47:28 -0700 (PDT)
Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53FFF130E05 for <dnsop@ietf.org>; Mon, 25 Jun 2018 08:47:28 -0700 (PDT)
Received: from [IPv6:2001:559:8000:c9:884e:32fa:afac:1c20] (unknown [IPv6:2001:559:8000:c9:884e:32fa:afac:1c20]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 357BE892A2; Mon, 25 Jun 2018 15:47:28 +0000 (UTC)
Message-ID: <5B310E8F.6060901@redbarn.org>
Date: Mon, 25 Jun 2018 08:47:27 -0700
From: Paul Vixie <paul@redbarn.org>
User-Agent: Postbox 5.0.25 (Windows/20180328)
MIME-Version: 1.0
To: Tony Finch <dot@dotat.at>
CC: Paul Wouters <paul@nohats.ca>, dnsop@ietf.org, Ray Bellis <ray@bellis.me.uk>
References: <CAJhMdTO2kj+nUqESg3ew=wwZuB9OzkJE6pST=mae7pHiEk4-Qw@mail.gmail.com> <20180619190213.B76962846E19@ary.qy> <20180622182752.GA83312@isc.org> <af9b422a-90a0-b204-70d6-12566d7b65dc@bellis.me.uk> <alpine.DEB.2.11.1806251459510.916@grey.csi.cam.ac.uk> <alpine.LRH.2.21.1806251104490.18905@bofh.nohats.ca> <alpine.DEB.2.11.1806251637060.916@grey.csi.cam.ac.uk>
In-Reply-To: <alpine.DEB.2.11.1806251637060.916@grey.csi.cam.ac.uk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/hkrrdZmzk8zDMnCWASHXqLFiY2o>
Subject: Re: [DNSOP] abandoning ANAME and standardizing CNAME at apex
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Jun 2018 15:47:30 -0000


Tony Finch wrote:
> ANAME will add two things beyond a provisioning-only setup:
>
> * a standard way to signal to dynamic auth servers where to get A/AAAA
>    records from
>
> * a way to signal to recursives that they might get a better answer if
>    they query the target themselves
>
> Even for a provisioning-only setup, ANAME will give the zone admin a
> standard way to configure the provisioning process. That's what I mostly
> want it for.

what do you expect non-dynamic servers to do in the presence of ANAME? i 
assume you'll recommend that they also host real A and AAAA RRsets at 
the same name-node, which only a dynamic authoritative would ignore?

if so, there's a third work flow available, which is to use RFC 2136 
dynamic update to periodically update those "last resort" or "static" A 
and AAAA RRsets, for a non-dynamic server.

and if so, why aren't we just specifying that, and avoiding the creation 
of a new kind of authority server ("dynamic")?

-- 
P Vixie