Re: [DNSOP] ALT-TLD and (insecure) delgations.

Tony Finch <dot@dotat.at> Mon, 06 February 2017 16:55 UTC

Return-Path: <dot@dotat.at>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E69F2129596 for <dnsop@ietfa.amsl.com>; Mon, 6 Feb 2017 08:55:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.221
X-Spam-Level:
X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qCW7ABSnXlO4 for <dnsop@ietfa.amsl.com>; Mon, 6 Feb 2017 08:55:21 -0800 (PST)
Received: from ppsw-33.csi.cam.ac.uk (ppsw-33.csi.cam.ac.uk [131.111.8.133]) by ietfa.amsl.com (Postfix) with ESMTP id 8EF4E129592 for <dnsop@ietf.org>; Mon, 6 Feb 2017 08:55:20 -0800 (PST)
X-Cam-AntiVirus: no malware found
X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus
Received: from grey.csi.cam.ac.uk ([131.111.57.57]:55240) by ppsw-33.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.137]:25) with esmtps (TLSv1:ECDHE-RSA-AES256-SHA:256) id 1camZT-000LjT-iH (Exim 4.88) (return-path <dot@dotat.at>); Mon, 06 Feb 2017 16:55:19 +0000
Date: Mon, 06 Feb 2017 16:55:19 +0000
From: Tony Finch <dot@dotat.at>
To: Ray Bellis <ray@bellis.me.uk>
In-Reply-To: <c1af826c-899e-db90-f592-514874660d7a@bellis.me.uk>
Message-ID: <alpine.DEB.2.11.1702061633570.23062@grey.csi.cam.ac.uk>
References: <6391B5BB-19BD-4717-B9BB-ECD145F7B4F6@fugue.com> <20170206040516.1701.qmail@ary.lan> <CAPt1N1mbzhS19G_uDA8HokVxXuHy5uA7F1c84-1yUUpqZ2ifJQ@mail.gmail.com> <alpine.OSX.2.20.1702052315130.13902@ary.qy> <CAPt1N1m2mowdCF6igU0TN-FCcjas9AaY-uGma4HgPGKx0Jg4Tw@mail.gmail.com> <4E481C14-1C2B-4A18-A4F2-582208C1DDE3@ogud.com> <6B4E9F56-1487-4E09-9245-167C4790AB3D@gmail.com> <EFFF717C-3A5A-4877-8B40-2D5DF42FD19C@ogud.com> <91527611-CBAE-4DFD-8086-5D6499594108@gmail.com> <c1af826c-899e-db90-f592-514874660d7a@bellis.me.uk>
User-Agent: Alpine 2.11 (DEB 23 2013-08-11)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/kBTFEKlgEZ-XE_fh-ES5_xcIIN0>
Cc: dnsop@ietf.org
Subject: Re: [DNSOP] ALT-TLD and (insecure) delgations.
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Feb 2017 16:55:25 -0000

Ray Bellis <ray@bellis.me.uk> wrote:
>
> Yes, that's right, with the caveat that all existing locally served
> zones are in the reverse space - there's no forward zones registered (yet).

There are several :-) RFC 6761 specifies localhost, invalid, test as
locally served zones. RFC 6762 specifies local. RFC 7686 specifies onion.

RFC 7534 says that the AS112 DNAME target zones should be locally served,
though they are not listed in the special use registry.

The example domains are special use but not locally served.

BIND currently has empty.as112.arpa as its only built-in locally-served
forward domain.

My servers have some awkwardness to sink .local mDNS queries without
making Avahi think there is a private non-multicast DNS .local domain.
This does not conform to the requirements of RFC 6762 but it is necessary
for interop :-/
	zone local {
		type master; file "/zm/null";
		allow-query { !0.0.0.0/0; !::/0; };
	};

Tony.
-- 
f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/  -  I xn--zr8h punycode
Viking, North Utsire, South Utsire, Forties, Cromarty: Southeasterly 7 to
severe gale 9, perhaps storm 10 later in Viking. Rough or very rough becoming
very rough or high. Rain or sleet. Moderate or good, occasionally poor.