Re: [domainrep] At long last, some drafts and a charter

[Andrew Sullivan <[e-mail]>]

On Fri, Jun 24, 2011 at 10:45:32AM -0500, [e-mail] wrote:
> > -----Original Message-----
> > From: John Levine [mailto:[e-mail]]
> > Subject: Re: [domainrep] At long last, some drafts and a charter
> > 
> > If you're doing a DNS-based lookup which requires case sensitivity,
> > your application is pretty badly broken.  RFC 1034 said in 1987 that
> > upper and lower case ASCII characters are equivalent in DNS names, and
> > that hasn't changed.
> > 
> 
> We're not, we've moved long past that, but the lack of case
> sensitivity in DNS reduces the amount of uniqueness that you can fit
> into a single query, which should be a concern.  If this issue has
> already been raised then I apologize for bringing it up.  See
> rfc4343 for additional clarification regarding the handling of case.

Careful here.

First, RFCs 1034 and 1035 do not say exactly that upper and lower case
ASCII characters are equivalent.  DNS is supposed to be
case-preserving but case-insensitive.  (In my humble opinion, this is
one of the most broken parts of the DNS, but never mind that.)

Second, because of label compression, you have no guarantees of the
case you're going to get back anyway.  The following labels all match
one another: eXaMpLe, example, EXAMPLE.  But label compression in many
implementations will store a pointer to the first instance of the
label, which can mean that while you get one value back, it might not
be the one you expect; and the case-preservation isn't quite what you
might expect it to be, because caches are going to get a
compressed label to store.

In at least one case I observed, the label compression included a
pointer back to the label in the (echoed) question section in the
response.  This meant that the labels you saw (for compressible
RRTYPEs) were exactly the ones you sent.  AFAIK this is changed, and I
don't know of any shipping systems that do it this way, but I'm not
actually sure it was wrong under the protocol anyway.

There has been a suggestion to use case sensitivity as a kind of extra
security measure:
http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00.  This was
controversial, but at least one vendor has code shipping that does
this.

Finally, I guess it goes without saying that we're taking about (in
IDNA-speak) A-labels and not U-labels.  The latter aren't allowed to
have upper case characters, period.

A

-- 
Andrew Sullivan
[e-mail]