Subject: Re: RFC 2182 considered harmful

From: "D. J. Bernstein" <[email-masked]>
Date: 7 Feb 2000 07:58:54 -0000

Edward Lewis writes:
> There are folks whose set of name servers each have the same IP address.

cr.yp.to is one of those. All services are provided by one computer. The
only DNS outages are physical outages that also cut off web service and
mail service.

A separate DNS server would provide zero benefits. But I've seen people
claim otherwise and point to RFC 2182. The document is wrong; it should
be fixed.

> I may have keying information or a
> certificate stored that allows someone to read my encrypted mail message
> warning of an upcoming outage.

But you don't. Neither do I. Neither does a typical department server.

RFC 2182 doesn't limit its requirements to your imaginary situation. It
says that _all_ zones must always have accessible DNS servers. That's
simply wrong.

---Dan

---

From: Olafur Gudmundsson <[email-masked]>
Date: Tue, 08 Feb 2000 17:51:30 -0500

>claim otherwise and point to RFC 2182. The document is wrong; it should
...
>says that _all_ zones must always have accessible DNS servers. That's

Different sites have different fault tolerance requirements, yours are
not typical, there is nothing wrong with the RFC and it's requirement. 

	Olafur
--------
Olafur Gudmundsson - NAI Labs 			(443)-259-2389 
The Security Research Division of Network Associates, Inc.
[email-masked]  [email-masked]  Private: [email-masked]