Subject: [DNSOP] dns interface to whois? (Re: Taking Back the DNS )

From: Paul Vixie <[email-masked]>
Date: Sun, 21 Nov 2010 17:33:12 +0000

here's something interesting.

> You have just received a comment for:
> 
> Taking Back the DNS
> http://www.circleid.com/posts/20100728_taking_back_the_dns/#7331
> By Marc Perkel
> ...
> Also - I would like to see some sort of DNS lookup to determine the
> age of a domain and the expiration date through DNS (high speed) as
> opposed to whois. That way domains that are very new can be
> distinguished for those who are established. 

how would the registry system implement something like this?  could we
define another SRV-like schema like:

vix._domain._whois._registry.com TXT "admin-c:pv15"
                                 TXT "tech-c:pv15"
                                 TXT "updated:25-Feb-2009"
                                 TXT "created:20-Jun-1995"
                                 TXT "expires:19-Jun-2011"
                                 TXT "registrar:http://tucowsdomains.com"

pv15._contact._whois._registry.com TXT "name:Vixie, Paul"
                                   TXT "email:[email-masked]"
                                   TXT "postal:Star Route Box 159A, \
                                        Woodside, CA 94062, US"
                                   TXT "pstn:+1.6504231383"

...and then leave it up to each registry (and maybe icann if they are a
regulated registry) to decide whether to implement it and to decide what
kind of rate limiting to perform?

i know there are a lot of related proposals in XML.  that's another topic.

---

From: Andrew Sullivan <[email-masked]>
Date: Sun, 21 Nov 2010 12:41:57 -0500

On Sun, Nov 21, 2010 at 05:33:12PM +0000, Paul Vixie wrote:
> how would the registry system implement something like this?  

I would argue that they shouldn't.

> i know there are a lot of related proposals in XML.  that's another topic.

No, it isn't.  It's one thing to say, "Go look over here for IRIS."
It's quite another to try to duplicate all that in the DNS itself.
Why do that?

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: "John L. Crain" <[email-masked]>
Date: Sun, 21 Nov 2010 09:51:45 -0800

Hi Paul,

>define another SRV-like schema like:

Why would we do this, who gains by adding this?

I don't see the benefit.

As a registrant, registrar or registry I have access to that data. As a
person (or client) resolving a name at a specific point in time I don't
see how this data would be relevant.

Even as a third party if I want the expiration data then there are
existing protocols for doing that.

Was the use case outlined?

John

>_______________________________________________
>DNSOP mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/dnsop

---

From: Eric Brunner-Williams <[email-masked]>
Date: Sun, 21 Nov 2010 12:52:24 -0500

yeah, i saw marc's comment too.

in the ecology of tasted domains who's seo value is tending towards 
the do-not-renew cost point, there exists a reservoir of "aged" domains.

ergo, any scheme to use domain age to differentiate domains acquired 
for spam, maleware, ... purposes, if effective, will result in the use 
of marginal seo assets as spam, maleware, ... assets, limiting the 
utility of an age-aware spam, maleware, ... mitigation scheme.

a closer correlation to seo assets is the registrar and name server 
association, and where slower-than-real-time and cached responses are 
of use, the automated detection of type of value capture at the 
resolved resource, e.g., ppc.

there are other reasons for attempting, as policy, of avoiding 
delivering to the end user a resolution that has some property known 
in advance.

-e

---

From: Lawrence Conroy <[email-masked]>
Date: Sun, 21 Nov 2010 18:13:04 +0000

Hi Andrew, folks,
 Does anyone actually use IRIS?
Telling someone to "go look over here for IRIS" seems like telling them everything has to be in XML (only squared).
DNS provisioning and lookup for TXT in "srv-like" sub-domains is easy and cheap (for implementers).
Provisioning, querying and parsing and IRIS data is not, I'd venture.

So ... is your comment "Why do that?" really meant as "Why make life easier for malcontents and spammers"?

all the best,
  Lawrence

---

From: Paul Vixie <[email-masked]>
Date: Sun, 21 Nov 2010 18:40:09 +0000

> From: "John L. Crain" <[email-masked]>
> Date: Sun, 21 Nov 2010 09:51:45 -0800
> 

i think it's so that folks can refuse e-mail from domains under N days
old where N is a local policy decision.  i have no direct use for it so
i'm sort of guessing here.

> Was the use case outlined?

no.  i'm guessing it's a way to do <http://www.support-intelligence.com/dob/>
that does not require downloading TLD zone files every day and diffing them.

---

noting that the race to register domains as fast as possible and as many
of them as possible has primarily benefitted spammers not their victims, the
good guys have built a magnificient system whose highest and best use is
against our own interests, and that kind of folly produces requests such as
this one -- stuff that in a better overall system would not be asked for.

less controversially, the data is already public, the question is
whether a standard dns schema as another interface into this public data
would be useful to enough people.  as to whether some registries might be
forced to support it when they don't see a need, that's a governance
question not a technology question, and it is: is more transparency better?

re: http://www.circleid.com/posts/20100728_taking_back_the_dns/#7331

---

From: Andrew Sullivan <[email-masked]>
Date: Sun, 21 Nov 2010 16:27:42 -0500

No, iris has not been widely deployed. My point is that if there were some reason to have this data available in a convenient machine readable format, then iris would already be deployed. That there's no uptake seems to me to be an indication that registries don't want additional costs. So they won't sign up to expand their dns operation costs for these purposes either. 

If they _will_ spend on this, then it seems to me the deployment cost for an existing protocol will be lower than for one we still have to invent. 

A

-- 
Andrew Sullivan
<[email-masked]>

---

From: David Conrad <[email-masked]>
Date: Sun, 21 Nov 2010 11:39:04 -1000

An interesting idea -- just thinking out loud...

>> define another SRV-like schema like:

If we were go to this route, I'd think defining RRs for each tag would be the way to go instead of using TXT.

> Why would we do this, who gains by adding this?

If it allows us to finally kill off whois, everyone in the universe (:-)). For example, as part of the RR definition process, the encoding of the value part of the tag/value pair could be explicitly defined.

> As a registrant, registrar or registry I have access to that data.

True, if you can figure out which whois server to query, that whois server is actually up, and the data is actually fetchable from the whois server.  The advantage of binding the registration information into the DNS along with the name being registered is the removal of a notoriously broken part of the name registration system and simplification of deriving from where you actually get the registration data.

> As a

What do people use registration data for now?

Oh, and if the data is DNSSEC-signed, you could actually verify it hadn't been altered by a MITM attack (if that actually occurs).

Regards,
-drc

---

From: David Conrad <[email-masked]>
Date: Sun, 21 Nov 2010 11:43:58 -1000

On Nov 21, 2010, at 11:27 AM, Andrew Sullivan wrote:
> No, iris has not been widely deployed.

The only folks I'm aware of who have deployed IRIS are DENIC and they only deployed DCHK.

> My point is that if there were some reason to have this data available in a convenient machine readable format, then iris would already be deployed.

Unless the idea of deploying a new, untested, and quite heavyweight solution discouraged people from actually doing so.

> That there's no uptake seems to me to be an indication that registries don't want additional costs.

Always true. 

> So they won't sign up to expand their dns operation costs for these purposes either. 

They would if it allows them to reduce costs.  I'm told that the query load on whois servers is non-trivial even today.  And then there is the fact that whois doesn't really deal very well with internationalization...

Regards,
-drc

---

From: Patrik Fältström <[email-masked]>
Date: Sun, 21 Nov 2010 23:20:38 +0100

> My point is that if there were some reason to have this data available in a convenient machine readable format, then iris would already be deployed.

There is no reason. Noone is asking strong enough to get correct data from the whois service. Instead, ICANN is asking to have the whois protocol available, and on top of that money is spent on anonymous registration (2nd hand registration) etc.

So as long as that is what people ask for, you will not see iris.

> That there's no uptake seems to me to be an indication that registries don't want additional costs.

Registries do only implement what people ask for.

   Patrik

---

From: Jim Reid <[email-masked]>
Date: Sun, 21 Nov 2010 22:56:07 +0000

On 21 Nov 2010, at 22:20, Patrik Fältström wrote:

> Noone is asking strong enough to get correct data from the whois  
> service. Instead, ICANN is asking to have the whois protocol  
> available, and on top of that money is spent on anonymous  
> registration (2nd hand registration) etc.
>

I'm not sure anyone is actually asking for the current horror story  
that is whois. We've just hit a stalemate in this trench warfare where  
no progress can ever be made because everyone has settled for the  
status quo: the least worst option that the majority of players will  
grudgingly accept.

> Registries do only implement what people ask for.

Or what they're compelled to implement. In theory ICANN could get  
every gTLD to use IRIS overnight by the stroke of a pen. It's just a  
teeny change to the registry contracts, right? :-)

---

From: Eric Brunner-Williams <[email-masked]>
Date: Sun, 21 Nov 2010 18:17:21 -0500

I wrote a 954 to historic ID a long time ago. Bob Braden didn't think 
much of the idea, and the caste system being what it was, and is, that 
kept 954 alive until Leslie took a swing at it.

And of course, it is alive and doing fine, or at least undead and 
eating brains, today and for the foreseeable future.

There has been little movement in the GNSO for most of a decade on the 
issue. The Law and Order people can't be informed that there are 
better approaches than the assumption that every registrant, new and 
old, is a pedophile or Islamo-Communist. The IP people can't be 
informed similarly, that every registrant, new and old, is a pedophile 
and a trademark infringer. Registrars, Registries, and neither of the 
above people can't bring themselves to agree that the presumption of 
universal criminal or tortuous use is correct.

> every gTLD to use IRIS overnight by the stroke of a pen.

Well, that theory would require ICANN to dump the "public-private, 
bottom-up, multi-stakeholder" model for a streamlined authoritarian model.

Some people like streamlined authoritarian models. The PRC has 
pervasive interposition. The USA has pervasive intercept. I think the 
value claims of both are overstated.

Mind, the WHOIS drama plays only in the CNOBI theaters. In .coop and 
.museum and .cat and any registry with a non-trivial admission policy 
the issue is moot.

Eric

---

From: Joe Abley <[email-masked]>
Date: Mon, 22 Nov 2010 09:47:52 -0500

Hi Jim,

On 2010-11-21, at 17:56, Jim Reid wrote:

>> Noone is asking strong enough to get correct data from the whois service. Instead, ICANN is asking to have the whois protocol available, and on top of that money is spent on anonymous registration (2nd hand registration) etc.
>> 
> I'm not sure anyone is actually asking for the current horror story that is whois. We've just hit a stalemate in this trench warfare where no progress can ever be made because everyone has settled for the status quo: the least worst option that the majority of players will grudgingly accept.

A few people interested in this general subject area met in Beijing and discussed a RESTful XML schema for the data commonly served by whois. This style of answer has also been deployed by ARIN, e.g. see <http://whoisrws-demo.arin.net/ui>.

At a high level it seems like it shares the benefits of syntactic constraints on registry data seen in EPP and IRIS, but simplifies the transport and query syntax to something modern and easy to code against.

I mention this just because it seems to be active work, not because I have money on any particular horse, if indeed this is a race (if it is, it's not a very exciting one :-)

Joe

---

From: Tony Finch <[email-masked]>
Date: Mon, 22 Nov 2010 15:11:53 +0000

> > distinguished for those who are established.

This service has been available from a third party supplier for years now.
http://www.support-intelligence.com/dob/ SpamAssassin uses it, for example.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST, 5 TO 7,
DECREASING 4 OR 5, OCCASIONALLY 6 LATER IN HUMBER AND THAMES. MODERATE OR
ROUGH. RAIN THEN FAIR. GOOD.

---

From: Tony Finch <[email-masked]>
Date: Mon, 22 Nov 2010 15:18:59 +0000

On Sun, 21 Nov 2010, Eric Brunner-Williams wrote:
>
> ergo, any scheme to use domain age to differentiate domains acquired for spam,
> maleware, ... purposes, if effective, will result in the use of marginal seo
> assets as spam, maleware, ... assets, limiting the utility of an age-aware
> spam, maleware, ... mitigation scheme.

On the other hand, if you treat a new domain with suspicion you buy
yourself time to find out if it is bad or not by gathering data from other
sources.

> association,

That also works well.

Tony.

---

From: [email-masked]
Date: Mon, 22 Nov 2010 20:36:17 +0000

we tried this a couple time last decade with limited success.
(pre SRV).  it would work, if and only if there were general
agreement by the zone admins to actually keep up w/ the data.

there was even an attempt to stuff rPKI data into the DNS (with
DNSSEC) and Tony Bates even wrote up an ID on the topic.  I did 
a study and reported the results at inet'98.  it clearly doable,
if people want to code the entries.

--bill

---

From: Paul Vixie <[email-masked]>
Date: Mon, 22 Nov 2010 21:58:02 +0000

> Date: Mon, 22 Nov 2010 20:36:17 +0000
> From: [email-masked]
> 
> we tried this a couple time last decade with limited success.  (pre
> SRV).  it would work, if and only if there were general agreement by
> the zone admins to actually keep up w/ the data.

while i expect that it would be a gateway rather than a data transform,
and while i agree that if it's a data transform then it should be done
often enough to not get out of date, i note that i'm asking a different
question than "would it work".

i'm wondering if there's enough interest to have it be worth writing it
up as a dns schema so that interested producers and consumers of this
information in this form can have a standard rendezvous (qname format)
and delivery system (TXT formats).  that's not "would it work".  it's
"could it ever be useful to anybody".

i am not trying to get input on technical feasibility since i think that's
pretty obvious.  nor am i trying to get input on governance like should
registries be required by icann to implement it or should icann implement
it for root, arpa, and other non-delegated zones.  just "is there interest".

---

From: [email-masked]
Date: Mon, 22 Nov 2010 22:52:34 +0000

> "could it ever be useful to anybody".

	well, at least two schemas have been proposed and there was
	limited uptake either time.  perhaps times have changed.

> it for root, arpa, and other non-delegated zones.  just "is there interest".

	well, one thing that kind of makes sense is where to anchor such 
	records... two choices - a WKA such as in-addr.arpa, ip6.int, enum.arpa
	et.al.  or place the entries at each delegation point and sweep the
	tree periodically to build a stale cache of data...

--bill

---

From: Paul Vixie <[email-masked]>
Date: Mon, 22 Nov 2010 23:46:49 +0000

> Date: Mon, 22 Nov 2010 22:52:34 +0000

the fact that so few people have spoken up gives me my answer -- there's
not enough interest in this to make it worth doing.  previous efforts did
not become RFC's in any form, and it seems likely that another would also
not make it.

> 	records... two choices - a WKA such as in-addr.arpa, ip6.int,
>	enum.arpa et.al.  or place the entries at each delegation point
>	and sweep the tree periodically to build a stale cache of data...

in the basenote of this thread i was only proposing this for registries of
names.  so, vix._domain._whois._registry.com for vix.com, and similarly
pv15._contact._whois._registry.com for the PV15 contact in the COM registry.

i'm aware of your prior work to do this for numbers but that wasn't my topic.