Re: [DNSOP] new ANAME draft: draft-hunt-dnsop-aname-00.txt

[Florian Weimer <[e-mail]>]

On 04/07/2017 08:11 PM, Evan Hunt wrote:
> Title:		Address-specific DNS Name Redirection (ANAME)

I think the introduction should discuss why it is not possible to push 
the CNAME to the parent zone, replacing the entire zone with an alias.

Section 3 is currently written in such a way that a recursive DNS lookup 
must be performed at the authoritative server side.  I don't think it is 
necessary to require that.  A recursive DNS lookup of the target is just 
one way to implement this.

In particular, the suggested recursive DNS lookup needs some form of 
distributed loop detection.  Otherwise, a malicious customer could 
publish two zones with ANAME records and achieve significant traffic 
amplification, potentially taking down the DNS hoster.  A hop count in 
an EDNS option or an “ANAME lookup in progress” indicator would be one 
way to implement this.  Another approach would impose restrictions on 
the owner name of an ANAME record and its target, and restrict where 
CNAMEs can appear, so that a valid ANAME can never point to another 
valid ANAME.

Thanks,
Florian