Subject: Re: [dnsop] comments on draft-fujiwara-dnsop-bad-dns-auth-01

From: Mark Andrews <[email-masked]>
Date: Tue, 23 Nov 2004 08:58:52 +1100

> > On Fri, Nov 19, 2004 at 04:41:50PM -0500, Rob Austein wrote:
> > >2) The recommendation that name servers MUST support EDNS0 if they're
> > >   going to send back response messages larger than 512 octets seems
> > >   reasonable.  The need for name servers to support TCP as well if
> > >   the message size exceeds 1200 octets is less obvious: it seems to
> > >   me that EDNS0 is enough.
>
> 	No.  TCP support in a server should become a MUST.  I've
> 	seen too many cases of administrators thinking they can get
> 	away with just UDP and being wrong.  We need to change this
> 	mind set.
>
> 	Changing the break point from 512 to 1200 (or 4k) won't
> 	change this.  The best we can hope for is that most messages
> 	will still be UDP based asd that there won't be too many
> 	messages that fail to fit in 64k TCP response.
>
> 	Average UDP message sizes are already creeping up.  Full
> 	referrals to the COM and NET servers are now over 512 octets.
> 	People keep wanting to put bigger and bigger answers sets
> 	in.

	The other way to think of this is that we need EDNS support
	everywhere so that glue records are not dropped from
	referrals.

	We need TCP everwhere so that large answers can be returned.

> > Has anyone done any analysis of current OS'es and their supported UDP
> > fragment reassembly size? I don't expect any problems, but if there's a
> > problem here then ENDS0 won't be good enough, and the client will have
> > to fall back to TCP no matter what.
> >
> > Maybe this has already been discussed, but I joined "recently" (compared
> > to so many others of you).
>
> 	RFC 2671 say to take account of the OS's reassembly buffers when
> 	choosing the size to advertise.  Most non-embeeded platforms these
> 	days can handle 4k thanks to NFS.
>
> > --
> > Robert Martin-Legène
> > DK Hostmaster A/S
> >
> > .
> > dnsop resources:_____________________________________________________
> > web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
> > mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
>
> .
> dnsop resources:_____________________________________________________
> web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
> mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Rob Austein <[email-masked]>
Date: Tue, 23 Nov 2004 00:10:38 -0500

I don't mind a separate recommendation that TCP must be supported, but
I expect any recommendation on TCP DNS to be ignored, so I want to
decouple it from the EDNS0 recommendation, which I think has a better
chance of making headway.

Or, to put it another way: feel free to tilt at the TCP windmill, but
please put the EDNS0 recommendation somewhere safe first.
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html