Subject: Re: [Add] I-D Action: draft-ietf-add-ddr-05.txt

From: Puneet Sood <[email-masked]>
Date: Tue, 15 Feb 2022 12:11:57 -0500

Hello DDR authors,

While implementing DDR for Google Public DNS, we discovered the
following detail which is not explicitly covered in the document.
Section 4.1 Discovery Using Resolver IP Addresses has this sentence:

"If the recursive resolver that receives this query has no Designated
Resolvers, it SHOULD return NODATA for queries to the "resolver.arpa"
SUDN."

A resolver that supports DDR also needs to respond to additional
queries to make the resolver.arpa zone look like other DNS zones.
- resolver.arpa/*: NODATA
- _dns.resolver.arpa/{ANY|SVCB}: SVCB record
- _dns.resolver.arpa/<other types>: NODATA

The resolver is taking ownership of resolver.arpa, so to be fully
compliant it should be answering for everything under resolver.arpa?
- *.resolver.arpa/*: NXDOMAIN

I do not think the NODATA, NXDOMAIN responses need to return any
SOA/NS records in the AUTHORITY section.
https://datatracker.ietf.org/doc/html/rfc2308#section-2.2 example 3
gives leeway to an implementation to omit the authority section. Given
the DDR responses will primarily be processed by stub resolvers which
are not performing iterative resolution, the lack of SOA/NS is not a
problem.

It will be helpful to clarify the above points in the draft.

Just as I finished writing this email, I remembered to check github
and sure enough
https://github.com/ietf-wg-add/draft-ietf-add-ddr/issues/58 covers
part of this. Prefer to send the email to keep the discussion on the
list.

Thanks,
Puneet

On Mon, Jan 31, 2022 at 5:25 PM <[email-masked]> wrote:
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Adaptive DNS Discovery WG of the IETF.
>
>         Title           : Discovery of Designated Resolvers
>         Authors         : Tommy Pauly
>                           Eric Kinnear
>                           Christopher A. Wood
>                           Patrick McManus
>                           Tommy Jensen
>         Filename        : draft-ietf-add-ddr-05.txt
>         Pages           : 15
>         Date            : 2022-01-31
>
> Abstract:
>    This document defines Discovery of Designated Resolvers (DDR), a
>    mechanism for DNS clients to use DNS records to discover a resolver's
>    encrypted DNS configuration.  This mechanism can be used to move from
>    unencrypted DNS to encrypted DNS when only the IP address of a
>    resolver is known.  This mechanism is designed to be limited to cases
>    where unencrypted resolvers and their designated resolvers are
>    operated by the same entity or cooperating entities.  It can also be
>    used to discover support for encrypted DNS protocols when the name of
>    an encrypted resolver is known.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-add-ddr/
>
> There is also an HTML version available at:
> https://www.ietf.org/archive/id/draft-ietf-add-ddr-05.html
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-add-ddr-05
>
>
> Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts
>
>
> --
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add

---

From: Tommy Pauly <[email-masked]>
Date: Wed, 16 Feb 2022 13:34:14 -0800

Hi Puneet,

Thanks for the note! We’ll definitely want to include this background in the text to address https://github.com/ietf-wg-add/draft-ietf-add-ddr/issues/58 <https://github.com/ietf-wg-add/draft-ietf-add-ddr/issues/58>.

Best,
Tommy

> On Feb 15, 2022, at 9:11 AM, Puneet Sood <puneets=[email-masked]> wrote:
> 
> Hello DDR authors,
>