Subject: Re: [Add] Zone ownership in DNS server discovery

From: Tommy Jensen <[email-masked]>
Date: Thu, 10 Sep 2020 23:33:38 +0000

Hey Vinny,

Yes, but I'd say that's not a hypothetical statement and is already true today. A DNS client could implement a full recursive if they wanted to for example and cache authoritative servers they discover, an extreme example of "bypassing" a need for a recursive.

I'm just suggesting the decision of what server to query for a given name is up to individual implementors, and domains providing authoritative information about designated DNS servers would make that easier than having to be a full recursive (since you can slowly bootstrap these designations).

Thanks,
Tommy

================================================

The latest in Windows Internet Protocols:

  Native gRPC support: https://aka.ms/grpcblogpost

  DNS over HTTPS: https://aka.ms/dohblogpost

________________________________
From: Vinny Parla (vparla)
Sent: Thursday, September 10, 2020 4:18 PM
To: Tommy Jensen
Cc: ADD Mailing list; Jim Reid
Subject: [EXTERNAL] RE: Zone ownership in DNS server discovery

Hi,

So if I understand the statement below, it is entirely up to an algorithm of the implementor, which could differ from endpoint to endpoint or browser to browse, to choose either to use the authoritative vs the recursive resolver.

Did I understand this correctly?

Thanks,

-Vinny

---

From: "Vinny Parla (vparla)" <[email-masked]>
Date: Fri, 11 Sep 2020 00:44:12 +0000

Thanks for the clarification.

I concur that this divergent behavior exists today with classic DNS.  Look
no further than TTL caching behavior of Outlook or Browsers.

I don't view this as a good thing but clearly understand the guidance being
given below.

-Vinny

From: Add <[email-masked]> On Behalf Of Tommy Jensen
Sent: Thursday, September 10, 2020 7:34 PM
To: Vinny Parla (vparla) <vparla=[email-masked]>
Cc: Jim Reid <[email-masked]>; ADD Mailing list <[email-masked]>
Subject: Re: [Add] Zone ownership in DNS server discovery

Hey Vinny,

Yes, but I'd say that's not a hypothetical statement and is already true
today. A DNS client could implement a full recursive if they wanted to for
example and cache authoritative servers they discover, an extreme example of
"bypassing" a need for a recursive. 

I'm just suggesting the decision of what server to query for a given name is
up to individual implementors, and domains providing authoritative
information about designated DNS servers would make that easier than having
to be a full recursive (since you can slowly bootstrap these designations).

Thanks,

Tommy

  Native gRPC support:  <https://aka.ms/grpcblogpost>
https://aka.ms/grpcblogpost 

  DNS over HTTPS:  <https://aka.ms/dohblogpost> https://aka.ms/dohblogpost 

  _____  

Hi,

So if I understand the statement below, it is entirely up to an algorithm of
the implementor, which could differ from endpoint to endpoint or browser to
browse, to choose either to use the authoritative vs the recursive resolver.

Thanks,

-Vinny

---

From: tirumal reddy <[email-masked]>
Date: Fri, 11 Sep 2020 11:45:23 +0530

This suggested behaviour seems to adversely impact the network-provided DNS
server capability to block access to malicious domains (e.g., malware,
phishing) and identification of exfiltration of data (e.g., TXT has been
typically misused by malware to exfiltrate data and to send C&C traffic).

-Tiru

On Fri, 11 Sep 2020 at 05:04, Tommy Jensen <Jensen.Thomas=
[email-masked]> wrote:

> example and cache authoritative servers they discover, an extreme example
> of "bypassing" a need for a recursive.
>
> I'm just suggesting the decision of what server to query for a given name
> is up to individual implementors, and domains providing authoritative
> ------------------------------
> *From:* Vinny Parla (vparla)
> *Sent:* Thursday, September 10, 2020 4:18 PM
> *To:* Tommy Jensen
> *Cc:* ADD Mailing list; Jim Reid
> *Subject:* [EXTERNAL] RE: Zone ownership in DNS server discovery
>
> Hi,
>
>
>
> So if I understand the statement below, it is entirely up to an algorithm
> of the implementor, which could differ from endpoint to endpoint or browser
> to browse, to choose either to use the authoritative vs the recursive
> resolver.
>
>
>
> --
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>