Re: [dnsext] draft-bellis-dnsext-dnsproxy-00

[Nicholas Weaver <[e-mail]>]

On Nov 3, 2008, at 11:00 AM, bert hubert wrote:
>
> That would be good - this also argues for not adding heaps of other  
> stuff to
> the RFC - I think everybody would like to have his pet DNS difficulty
> included, but overall that would not help achieve greater compliance.

I think the most important behavior is "Get Outta the Way!"

Namely, any such device MUST not block direct access to an arbitrary  
remote DNS server from an end-host, with the packet payload unchanged,  
and SHOULD not change the UDP SRC port selected by the end-host.

There will always be cases where the policy on any in-path device is  
incorrect.  Therefore the most important policy that a NAT or similar  
device should have with regards to DNS traffic is the ability to  
bypass any proxying or other such manipulation.

This is, IMO, absolutely essential, because everything else can be  
worked around as long as the stub resolver can access whatever  
external resources it deems necessary.


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>