Re: [DNSOP] [Ext] Re: Clarifying referrals (#35)

Edward Lewis <> Mon, 13 November 2017 14:53 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 6FDF7129744 for <>; Mon, 13 Nov 2017 06:53:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.201
X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id h7eXAEzsWE7P for <>; Mon, 13 Nov 2017 06:53:41 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 31A3E127B52 for <>; Mon, 13 Nov 2017 06:53:41 -0800 (PST)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1178.4; Mon, 13 Nov 2017 06:53:39 -0800
Received: from ([]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([]) with mapi id 15.00.1178.000; Mon, 13 Nov 2017 06:53:39 -0800
From: Edward Lewis <>
To: Andrew Sullivan <>, "" <>
Thread-Topic: [Ext] Re: [DNSOP] Clarifying referrals (#35)
Date: Mon, 13 Nov 2017 14:53:38 +0000
Message-ID: <>
References: <> <> <> <> <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
user-agent: Microsoft-MacOutlook/f.27.0.171010
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: []
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha1"; boundary="B_3593411618_464944154"
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [DNSOP] [Ext] Re: Clarifying referrals (#35)
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 13 Nov 2017 14:53:42 -0000

At the tail of this thread, I'll add my (random) thoughts.

1) Upward referrals are an example of something that started out as a good idea, good intention, but ran into operational problems as the DNS setting changed.  Early, in the late 90's, a popular DNS implementation would chase an upward referral meant to indicate a lame delegation, resulting in an infinite loop in iteration.  (Better coding stopped that.  See also ARIN Policy [proposal] 2002-01 as an artifact of that time.)  Later, upward referrals were seen as a tool in building a flood attack, which is what cause implementations to stop using them as lame delegation notices.

2) I learned this long ago (while implementing ancient DNSSEC code) - the DNS tree is inherently unidirectional.  A parent knows about its children and not vice versa.  DNSSEC wanted to have arbitrary security chains but had to settle for on-tree ("Domain Name System Security (DNSSEC) Signing Authority" aka RFC 3008).  The same issue came into play when trying to design the "Automating DNSSEC Delegation Trust Maintenance" - related to scaling (the parent has to poll the children, not the other way around).  (In "Detecting a Changed CDS/CDNSKEY", the parent either polls or has to have something out-of-DNS-band: " The delegation user interface has a button".)

I.e., trying to see referrals as going anyway but down is an uphill battle.