Re: [DNSOP] Fwd: New Version Notification for draft-bellis-dnsext-multi-qtypes-04.txt

[Dave Lawrence <[e-mail]>]

On 7/4/17 6:13 AM, Paul Wouters wrote:
>> Although, we should also be a bit careful not to create a new ANY
>> type query that will get abused for amplification, so it should
>> really all have source verified IP transports (DNS-COOKIES, TCP, etc)

Ray Bellis writes:
> I'd rather not constraint this to source verified transports.
> 
> There's a limit of 7 additional QTYPEs in the draft, which could be
> trivially reduced to 3 (with little effect on the functionality) if that
> would mitigate concerns about amplification.

I very much agree with Ray about not constraining it like this.

While for my own imagined use cases three is adequate, such as for
querying MX, A and AAAA simultaneously, I also don't see any
compelling reason to drop it from his proposed seven.  In my own
scheme I had planned on using a NSEC-like type bitmap, but having
spoken with Ray about this a while ago I know he's not keen on that.

To me the focus on answer size amplification is misdirected.  I am far
more concerned about packet count than packet size, and in any event
constraining this option to only verified channels makes it
immediately less useful.