Subject: Re: DNAMEs

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Sun, 31 Oct 1999 22:17:27 -0500

By the way, it appears to me that DNAME has the feature that it enables
you to add brief messages to domain names you use.  You just say
	slogan.xx DNAME .

where slogan is your message and xx is some top level domain name,
perhaps .com, and then you can use
actual.domain.name.example.slogan.xx everywhere and people will see
your slogan (which could be multiple words).

Donald

From:  Alexander Krotov <[email-masked]>
Date:  Thu, 28 Oct 1999 15:05:04 +0300
To:  [email-masked]
Message-ID:  <[email-masked]>

>Hello!
>
>Few questions about DNAMEs (RFC2672):
>
>1. "The DNAME RR causes type NS additional section processing".
>What does it mean ? What RRs should be added to Additional section ?
>NS RRs for the zone DNAME refers to ? "A" RRs for these NS RRs ?
>What happens if there are multiple non-terminal redirections ?
>
>2. Non-descendant rule means that if there is DNAME RR say
>foo.bar.com DNAME foo.bar.org
>there should not be RRs with label like
>mail.foo.bar.com in the same zone. Right ?
>
>Thank you in advance,
>-- 
>Alexander Krotov	gsm: +358 40-725 7216
>Product Developer	fax: +358 9-8599 0599
>NameSurfer Ltd.		http://www.namesurfer.com

---

From: Alexander Krotov <[email-masked]>
Date: Thu, 4 Nov 1999 14:21:14 +0200

On Mon, Nov 01, 1999 at 10:40:33AM -0600, Matt Crawford wrote:
> The general nature of additional data is in RFC 1034:
> 
>    6. Using local data only, attempt to add other RRs which may be
>       useful to the additional section of the query.  Exit.
> 
> and 1035:
> 
>    The answer section contains RRs that answer the
>    question; the authority section contains RRs that point toward an
>    authoritative name server; the additional records section contains RRs
>    which relate to the query, but are not strictly answers for the
>    question.
> 
> So if you ask a question about name N1.N2, and get back a DNAME
> record which renames that to N1.M, NS records which indicate
> nameservers for the new name would be useful.

Thank you for the answer.

But, as seems to me Authority section is more natural place for
such NS records, like it is currently done for CNAME "delegations",
and A records would be useful in Additional section like in the
second example in RFC1034 section 6.2.7

---

From: Bob Halley <[email-masked]>
Date: 04 Nov 1999 09:51:46 -0800

> nameservers for the new name would be useful.

I don't think that type NS additional processing is useful in
practice, at least not without DNSSEC signatures, since servers will
have to ignore them to prevent cache poisoning.  Imagine a response
like:

	foo.example.		IN	DNAME	victim.example.
	
	victim.example.		IN	NS	ns1.attacker.example.
	victim.example.		IN	NS	ns2.attacker.example.

If the server caches these NS records, queries about "victim.example."
will be directed to the attacker's nameservers.

/Bob