IETF Logo Mail Archive

Re: [DNSOP] CloudFlare policy on ANY records changing

Florian Weimer <fw@deneb.enyo.de> Sat, 14 March 2015 20:10 UTC

Return-Path: <fw@deneb.enyo.de>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97EDC1A00DF for <dnsop@ietfa.amsl.com>; Sat, 14 Mar 2015 13:10:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.56
X-Spam-Level:
X-Spam-Status: No, score=-1.56 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, T_RP_MATCHES_RCVD=-0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YaXO2NqVJAXv for <dnsop@ietfa.amsl.com>; Sat, 14 Mar 2015 13:10:08 -0700 (PDT)
Received: from albireo.enyo.de (albireo.enyo.de [46.237.207.196]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A7AB1A0097 for <dnsop@ietf.org>; Sat, 14 Mar 2015 13:10:07 -0700 (PDT)
Received: from [172.17.203.2] (helo=deneb.enyo.de) by albireo.enyo.de with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) id 1YWsNn-0005S6-Ry; Sat, 14 Mar 2015 21:10:03 +0100
Received: from fw by deneb.enyo.de with local (Exim 4.80) (envelope-from <fw@deneb.enyo.de>) id 1YWsNn-0000Fi-JP; Sat, 14 Mar 2015 21:10:03 +0100
From: Florian Weimer <fw@deneb.enyo.de>
To: Tony Finch <dot@dotat.at>
References: <0A8D7AE0-B6FF-4B85-A42B-4EBF93A17873@verisign.com> <54FF86CB.7010705@redbarn.org> <20150311015710.GB10189@isc.org> <alpine.LSU.2.00.1503111205440.10193@hermes-1.csi.cam.ac.uk> <20150311150622.GA91255@isc.org> <alpine.LSU.2.00.1503111617130.23307@hermes-1.csi.cam.ac.uk> <20150311171535.GC91255@isc.org> <alpine.LSU.2.00.1503111723080.10193@hermes-1.csi.cam.ac.uk> <871tku18np.fsf@mid.deneb.enyo.de> <49DEE35910F1A6438E9805F4DEBBA30715CC32C0@038-CH1MPN1-041.038d.mgd.msft.net> <20150313003003.GB65353@isc.org> <alpine.LSU.2.00.1503131036040.10193@hermes-1.csi.cam.ac.uk> <alpine.LSU.2.00.1503131709330.10193@hermes-1.csi.cam.ac.uk>
Date: Sat, 14 Mar 2015 21:10:03 +0100
In-Reply-To: <alpine.LSU.2.00.1503131709330.10193@hermes-1.csi.cam.ac.uk> (Tony Finch's message of "Fri, 13 Mar 2015 17:10:43 +0000")
Message-ID: <87ioe3e3xg.fsf@mid.deneb.enyo.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <http://mailarchive.ietf.org/arch/msg/dnsop/ycQ1knBHV-g0qH_YQcJrGdYX6IQ>
Cc: Evan Hunt <each@isc.org>, dnsop <dnsop@ietf.org>
Subject: Re: [DNSOP] CloudFlare policy on ANY records changing
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 14 Mar 2015 20:10:09 -0000

* Tony Finch:

>> Evan Hunt <each@isc.org> wrote:
>> >
>> > This could be a pretty brilliant solution, actually: If you're
>> > authoritative for a signed zone and you receive a query of type ANY,
>> > return the applicable NSEC/NSEC3; if the zone is *not* signed, synthesize
>> > a response containing a single RR with a type from the "private use" range
>> > (e.g. TYPE65531 or whatever), zero length rdata, and a long TTL.
>
> Maybe this could be a use for the NULL RRtype? :-)

We'd have to be reasonably sure that no resolver treats is as a
meta-type and turns the upstream response into a FORMERR upon seeing
it in the answer section.  “NULLs are used as placeholders in some
experimental extensions of the DNS.” is not confidence-inspiring in
this regard.

v2.23.0 | Report a Bug | By Email