Subject: [dnsop] comments on draft-fujiwara-dnsop-bad-dns-auth-01

From: Rob Austein <[email-masked]>
Date: Fri, 19 Nov 2004 16:41:50 -0500

I had a couple of comments on Fujiwara-san's presentation at the DNSOP
meeting at IETF61, and promised that I would send them to the list.

1) Regarding the reported problem with the five minute timeout on RFC
   2308 SERVFAIL caching and the suggestion to fix this problem by
   increasing the cache timeout to several hours: it might be better
   to treat this as a polling problem.  That is, leave the five minute
   timer in place, and when the five minute timer expires, it's time
   to consider the possibility that the server has recovered, so one
   should send it a packet or three to see what it does, while
   continuing to answer queries as if the server were still known to
   be bad until results from the poll become available.  This is
   similar in concept to the way that TCP zero-window probes work.

2) The recommendation that name servers MUST support EDNS0 if they're
   going to send back response messages larger than 512 octets seems
   reasonable.  The need for name servers to support TCP as well if
   the message size exceeds 1200 octets is less obvious: it seems to
   me that EDNS0 is enough.

   Part of the reason why the TCP requirement concerns me is that I
   suspect that such a requirement would simply be ignored, so if TCP
   support really is a requirement, we're going to have to make a very
   compelling case for why TCP is the only solution.  Since I'm pretty
   sure that EDNS0 is enough, I suspect that we cannot make that
   strong a case for TCP.
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Robert Martin-Legene <[email-masked]>
Date: Sun, 21 Nov 2004 02:05:49 +0100

>   the message size exceeds 1200 octets is less obvious: it seems to

Has anyone done any analysis of current OS'es and their supported UDP
fragment reassembly size? I don't expect any problems, but if there's a
problem here then ENDS0 won't be good enough, and the client will have
to fall back to TCP no matter what.

Maybe this has already been discussed, but I joined "recently" (compared
to so many others of you).

-- 
Robert Martin-Legène
DK Hostmaster A/S

.