I-D ACTION:draft-iab-dns-synthesis-concerns-00.txt

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.
This draft is a work item of the Internet Architecture Board Working Group of the IETF.

	Title		: Architectural Concerns on the synthesis of non-existent names in DNS.
	Author(s)	: O. Kolkman
	Filename	: draft-iab-dns-synthesis-concerns-00.txt
	Pages		: 19
	Date		: 2007-4-16

   There are many architectural assumptions regarding DNS behavior that
   are not specified in the IETF standards documents describing DNS, but
   which are deeply embedded in the behavior as expected by Internet
   protocols and applications.  These assumptions are inherent parts of
   the network architecture of which the DNS is one component.

   It has long been known that it is possible to use DNS wildcards in
   ways that violate these assumptions.  More recently there have been
   deployments of middleboxes -- in most cases recursive nameservers or
   DNS proxies at the ISP level -- that synthesize answers in ways that
   not only violate these assumptions but also violate the DNS
   architecture.

   Experience with DNS synthesis in the DNS infrastructure have show
   that the cost of violating these assumptions is significant.  In this
   document we provide an explanation of how DNS wildcards function, and
   many examples of how their injudicious use negatively impacts both
   individual Internet applications and indeed the Internet architecture
   itself.  We also explain that similar problems arise with the
   synthesis of DNS responses by middleboxes.

   We recommend that DNS wildcards should not be used in a zone unless
   the zone operator has a clear understanding of the risks, and that
   they should not be used without the informed consent of those
   entities which have been delegated below the zone.

   In addition we recommend that middleboxes do not perform DNS query
   synthesis unless (1)there are informed consents of those that use the
   forwarding name server, and (2)there exists an opt-out mechanism that
   allows them to receive the original DNS answers.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-iab-dns-synthesis-concerns-00.txt

To remove yourself from the I-D Announcement list, send a message to 
i-d-announce-request@ietf.org with the word unsubscribe in the body of 
the message. 
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 
username "anonymous" and a password of your e-mail address. After 
logging in, type "cd internet-drafts" and then 
"get draft-iab-dns-synthesis-concerns-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	mailserv@ietf.org.
In the body type:
	"FILE /internet-drafts/draft-iab-dns-synthesis-concerns-00.txt".

NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.