Re: [DNSOP] additional special names Fwd: I-D Action: draft-chapin-additional-reserved-tlds-00.txt

[Stephane Bortzmeyer <[e-mail]>]

On Wed, Jan 08, 2014 at 01:18:09PM -0500,
 Suzanne Woolf <[e-mail]> wrote 
 a message of 215 lines which said:

> This new internet-draft is another request for additions to the RFC
> 6761 special names registry, this time motivated by an interest in
> reserving the names most commonly found in recent analysis of TLDs
> in private name spaces. The special names registration would serve
> to minimize the chances of collision between private and public DNS
> namespaces by keeping these names unassigned in the public
> namespace.

I have two technical remarks about this draft (at the end of this
message) and important policy remarks.

1) During the discussion about .onion, .bit and so on, many people on
dnsop were apparently opposed to RFC 6761 (unless the requester was
Apple) and suggested we (the IETF) should not step on ICANN shoes and
do not make an actual use of RFC 6761. What do they think about this
draft?

2) I find no mention of the risk of "reservation through abuse". I
send many requests to many resolvers for "$random.example", then the
root sees a lot of traffic for this TLD, then Interisle flags it as
"hish risk of collisions" then the TLD is added in the special
registry and no longer available. There is nothing about this risk of
"denial of service" in the draft (no Security Considerations) and
nothing about how to prevent it.

3) The suggested behaviour is very demanding: for all the TLD
mentioned, the draft requests that libraries and resolvers treat them
as special. It will mean the modification of a lot of software. If the
goal is only to prevent name collision, delegating these TLD at the
root to AS112 could be sufficient. There is no discussion in the draft
about alternative approaches.

Now the technical remarks:

4) The draft says that libraries and resolvers SHOULD "restrict these
names to local resolution". "Local resolution" is not defined
anywhere. What does it mean? If it means the resolver SHOULD be inside
the organization, how could a library know that 192.0.2.3 is local or
not? Same thing for forwarders of resolvers.

5) The draft says "authoritative domain name server software SHOULD restrict
these names to local resolution and SHOULD NOT allow queries for
strings that use these Special-Use Domain Names to be forwarded to
the public DNS for resolution" I do not understand it at
all. Authoritative name servers are... authoritative, they do not
forward to other servers.