[DNSOP] Question about usage of ip6.arpa and in-addr.arpa

Roland Bracewell Shoemaker <roland@letsencrypt.org> Mon, 12 March 2018 15:58 UTC

Return-Path: <roland@letsencrypt.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E333D127599 for <dnsop@ietfa.amsl.com>; Mon, 12 Mar 2018 08:58:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=letsencrypt.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w_NwwmDmYk-2 for <dnsop@ietfa.amsl.com>; Mon, 12 Mar 2018 08:58:37 -0700 (PDT)
Received: from mail-wr0-x230.google.com (mail-wr0-x230.google.com [IPv6:2a00:1450:400c:c0c::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A40E6126DED for <dnsop@ietf.org>; Mon, 12 Mar 2018 08:58:37 -0700 (PDT)
Received: by mail-wr0-x230.google.com with SMTP id f14so16219131wre.8 for <dnsop@ietf.org>; Mon, 12 Mar 2018 08:58:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=letsencrypt.org; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=JIG8svwDYPfoGBNVuQIXuUZ1X0Ud23P/a7ROAEWD+Zg=; b=NT+6lIwLNX64d3DNNOLUtUU9/Ho6yw7I58IoYz+3D37i584goOHlfcdMp+dqH574Rn vPe3tZCU8VpBpGBNbL+0WoQvMSQr/fmVNvSK48i7Z8Q/1Zx/OAUfV3FM3Da9vi9nPMyJ iuhkEgcoSlkY/43WakZG6+9Uv5hjYI8vsMTIQ=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=JIG8svwDYPfoGBNVuQIXuUZ1X0Ud23P/a7ROAEWD+Zg=; b=jRPL1IxgdFz1BiVtZZlpTucIVMgev7iGfZB6qN1ASAMEj6q396AQwh+6ePFJQSNxKl QF4kn03H3Qhsg2RpBOqzLYsys86dn7nlseWyyyHVe1GnCeLBxxh66/UJt0dyQolRdNK4 i4+3Tb7qN6yEiM8wifnu0hqbedpB7XVaPjZGKe6j41yA+sheBUQzBdRG56pgthbovxPw WWkaV4n5GhFuNa0Gjja1zAsCv7WyCR4ORs/a0rUA7h/syZysuwXMqDSzmvD1LsEycX8k hzWmhD2m434iJPayKCyHtdw+cyg3xgIr3fPy1QG02Ga0aSEZxB/2+BLFAa1uD7fk2Lzp MNaw==
X-Gm-Message-State: AElRT7FadHrAKIbB536f8/bUM7tBq/XdYmZTimOvH0u64Z1/8rhNph2b MMbWb/AMU1KYwcyBcaBJxHncpZgvNrk=
X-Google-Smtp-Source: AG47ELsmwRSZOQNvhhtZGboNKti19J7DBjpGqXn4eptBEdNKfZ1LHhYkztDg1w1McBue9R2//9UoYg==
X-Received: by 10.223.187.19 with SMTP id r19mr6551410wrg.110.1520870315530; Mon, 12 Mar 2018 08:58:35 -0700 (PDT)
Received: from [192.168.0.19] (cpc93784-hari17-2-0-cust1834.20-2.cable.virginm.net. [82.34.151.43]) by smtp.gmail.com with ESMTPSA id b185sm6405893wmb.24.2018.03.12.08.58.34 for <dnsop@ietf.org> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 12 Mar 2018 08:58:34 -0700 (PDT)
From: Roland Bracewell Shoemaker <roland@letsencrypt.org>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\))
Message-Id: <B7531E71-AC04-4D40-86B0-74F2DCA92446@letsencrypt.org>
Date: Mon, 12 Mar 2018 15:58:33 +0000
To: dnsop@ietf.org
X-Mailer: Apple Mail (2.3445.5.20)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/tTd591wjE8X_S067FIopUGDB6Cw>
Subject: [DNSOP] Question about usage of ip6.arpa and in-addr.arpa
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 12 Mar 2018 15:58:39 -0000

Hey all,

I’m working on a document in the ACME WG that concerns methods for validating control of IP addresses (draft-ietf-acme-ip) and wanted to see if anyone here could provide some input on a question I had regarding usage of the ip6.arpa and in-addr.arpa zones.

In the original incarnation of this document one outlined method revolved around requesting that a user place a TXT record containing a random token in the relevant ip6.arpa or in-addr.arpa child zone for the address being validated and then verifying that this record was present. After reading RFC 3172 there was some concern that this would not be a ‘blessed’ usage of the zones and that they should only contain records that related to mapping protocol addresses to service names. Because of this we reworked the method to require placing the TXT record at the target of a PTR record in the relevant zone instead.

After a number of discussions I’m interested in returning to the original concept as it simplifies a number of use cases that this document is intended to support but am still not sure whether or not this would be widely considered ‘ok’ by DNS folks. Obviously it’s entirely possible to do this as these child zones are delegated to users and they _can_ put whatever they want in them. Does this WG have strong opinions on whether we should/shouldn’t do this for technical reasons or we just being a bit too strict in our reading of 3172?

Thanks for the advice!
Roland