Re: [dnsext] Fwd: New Version Notification for draft-sury-dnsext-cname-dname-00

[Ondřej Surý <[e-mail]>]

On 23.4.2010 10:58, YAO Jiankang wrote:
>
>> So it looks like those two common existing implementation are already
>> ready for CNAME+DNAME.
>>
>> And that's exacly  my point - with very simple change in CNAME semantics
>> we can get full alias in the DNS tree, which is already supported by
>> majority of DNS servers in the wild (at least those supporting DNAME).
>>
>
> the CNAME is the basic record. many protocols base on it.

That's not true.  No protocol I know except DNS rely on CNAME.  All 
other protocols asks for A,AAAA (usually via getaddrinfo via your 
resolver), MX, SRV, etc.  I am not aware of any protocol directly asking 
for CNAME records.

> if you want to break CNAME,  you are trying to shake the basis of DNS.

I am not breaking CNAME.  If you think I am breaking CNAME please prove 
it or stop saying that.  I am enhancing CNAME semantics to allow 
coexistence with DNAME.  CNAME and DNAME don't share same alias space. 
Also there is no change by default - it could only affect other party in 
case you also add DNAME.

> if you build a rule, 1000 users have followed it and you may update or modify the rule.
>
> if you build a rule, 1000,000,000 users have followed it and you should be CAUTION when you wish to update or modify the rule.
>
> if a new Record is submitted, someone may choose to follow or not.
> but if you change the basic rule, you must push each of 1000,000,000 users  to follow it.

Sorry, but no, that's not true either.  This could possibly break some 
authoritative and/or recursive DNS server.  But in a way which is 
exactly same as adding new RRTYPE - since nobody is forced to add 
CNAME+DNAME to it's zone.  And I have already proven that it doesn't 
break Bind 9 or Unbound functioning as resolvers, and that's mainly 
because there are already much worse scenarios in DNS tree - as I have 
also shown with idos.cz case.  And I am willing to retest more resolvers 
(including older versions of Bind9), I just don't have a time for it 
right now.

It will have no impact on common end user - because in normal 
circumstances CNAME is not used directly - it's handled by resolvers.

Also loosening CNAME rules will not break anything for 1.000.000.000 
users already using CNAMEs.  It will only affect:

1) users adding CNAME+DNAME to their zones
2) users using such zones

But that's not different from BNAME.

I know I am touching the very basics of DNS and I also consider RFC1034 
and RFC1034 to be sacred :-), but please let's work with facts, test 
cases, test scenarios etc.  If you feel that CNAME+DNAME proposal breaks 
anything, please provide a test case.  I would be first to say we should 
drop CNAME+DNAME if there is a serious breakage somewhere, but we should 
not reject the proposal based on Fear, Uncertainty, Doubt (tm).

Also anybody is free to use experimental dname.cz zone, I am willing to 
add any combination of records to the zone, so you can test whatever 
protocol and test case you want.  I could add simplified/mandarIDN f.e. 
if you want.

BTW let me show you something, try pasting these into your browser:

www.cnnic.测试.dname.cz
www.cnnic.測試.dname.cz

in punycode:
www.cnnic.xn--0zwm56d.dname.cz
www.cnnic.xn--g6w251d.dname.cz

And check your mail log for rejected mail sent to:

[e-mail]
and
[e-mail]

I put those two email addresses to Bcc:, so we don't keep them in next 
conversation.

Ondrej

> Jiankang Yao
>
>
>
>> I am sure that this will break something somewhere, but those place
>> would be broken with BNAME as well.  But BNAME has to be implemented
>> everywhere - authoritative DNS, resolvers, firewalls, etc.
>>
>> Don't get me wrong, I think that BNAME is fine proposal, but I think
>> that we have much simpler option right before us.  Also it not something
>> new, we did change semantics of CNAME before, because of DNSSEC, so I am
>> not proposing revolution, just merging of two existing working principles.

Ondrej
-- 
  Ondřej Surý
  vedoucí výzkumu/R&D manager
  -------------------------------------------
  CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
  Americka 23, 120 00 Praha 2, Czech Republic
  mailto:[e-mail]    http://nic.cz/
  tel:[phone]       fax:[phone]
  -------------------------------------------