Subject: [DNSOP] I-D Action: draft-ietf-dnsop-resolver-priming-06.txt

From: [email-masked]
Date: Wed, 13 Jan 2016 14:32:15 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Domain Name System Operations Working Group of the IETF.

        Title           : Initializing a DNS Resolver with Priming Queries
        Authors         : Peter Koch
                          Matt Larson
                          Paul Hoffman
	Filename        : draft-ietf-dnsop-resolver-priming-06.txt
	Pages           : 6
	Date            : 2016-01-13

Abstract:
   This document describes the queries a DNS resolver can emit to
   initialize its cache.  The result is that the resolver gets both a
   current NS RRSet for the root zone and the necessary address
   information for reaching the root servers.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-resolver-priming/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-dnsop-resolver-priming-06

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-resolver-priming-06

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Bob Harold <[email-masked]>
Date: Thu, 14 Jan 2016 13:25:00 -0500

> https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-resolver-priming-06

Section 1 says
[RFC1034] describes
that configuration as a list of servers that will authoritative
answers to queries about the root.

s/that will authoritative answers to/that will give authoritative answers to/
(or "that will authoritatively answer")

Section 3 says
The RD bit MAY be set to 0 or 1, although the meaning of it being set
to 1 is undefined for priming queries.

But a priming query is just a normal DNS query, so RD would be defined
normally, no?

---

From: "Paul Hoffman" <[email-masked]>
Date: Thu, 14 Jan 2016 11:09:36 -0800

> (or "that will authoritatively answer")

Good catch; fixed.

> But a priming query is just a normal DNS query, so RD would be defined

It would be defined normally, yes. Section 4.1 says that a priming query 
should come back with an authoritative answer. Setting the RD bit to 1 
could result in non-authoritative answers.

How does the WG feel about this? If the response to a priming query is 
non-authoritative, should the resolver reject it and try more queries? 
Or is it OK for a priming response to be non-authoritative?

--Paul Hoffman

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 15 Jan 2016 11:50:28 +0100

On Thu, Jan 14, 2016 at 11:09:36AM -0800,
 Paul Hoffman <[email-masked]> wrote 
 a message of 34 lines which said:

> Setting the RD bit to 1 could result in non-authoritative answers.

Today, all root name servers are not recursive. It seems good
practice, even if I'm not sure it's formally written somewhere (I do
not find it in RFC 7720).

> If the response to a priming query is non-authoritative, should the
> resolver reject it and try more queries?

I would say yes, since it is supposed to be sent to authoritative
servers.

If a name server is deprecated and replaced by a resolver, not
authoritative for the root, I tend to think that its response cannot
be trusted.

---

From: Tony Finch <[email-masked]>
Date: Fri, 15 Jan 2016 13:03:41 +0000

Paul Hoffman <[email-masked]> wrote:
> resolver reject it and try more queries? Or is it OK for a priming
> response to be non-authoritative?

If you are unlucky enough to be on a network that intercepts DNS queries
and diverts them to a recursive server, you are likely to get RA=1 AA=0
answers to priming queries. Your resolver ought to soldier on as best it
can in this situation.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Lundy, Fastnet, Irish Sea: Northwest 5 to 7, occasionally gale 8 at first in
Irish Sea, becoming variable 4. Moderate or rough, becoming slight or
moderate. Wintry showers. Good, occasionally poor.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 15 Jan 2016 14:59:01 +0100

On Fri, Jan 15, 2016 at 01:03:41PM +0000,
 Tony Finch <[email-masked]> wrote 
 a message of 22 lines which said:

> If you are unlucky enough to be on a network that intercepts DNS
> queries and diverts them to a recursive server, you are likely to
> get RA=1 AA=0 answers to priming queries. Your resolver ought to
> soldier on as best it can in this situation.

If the resolver validates with DNSSEC, it may go on in such a case. If
it doesn't, I'm tempted to say that it should give in and tell the
sysadmin that it cannot do its job properly and safely.

At the very minimum, such problem should be escalated to the sysadmin.

---

From: "Darcy Kevin (FCA)" <[email-masked]>
Date: Fri, 15 Jan 2016 17:52:34 +0000

It's not really a "normal" query, in the sense that it's not coming from a stub resolver, typically, and the initiator wouldn't normally assume that recursion is required to fetch the answer.

So, in the typical case I'd expect RD=0.

Not sure that the "although" verbiage below really adds any value, though. If you've already declared that something is a "MAY", what's the practical effect of then saying that its meaning is "undefined"? Either it's allowable per the standard or it's not.

															- Kevin

-----Original Message-----
From: DNSOP [mailto:[email-masked]] On Behalf Of Bob Harold
Sent: Thursday, January 14, 2016 1:25 PM
To: IETF DNSOP WG
Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-resolver-priming-06.txt

[...]

Section 3 says
The RD bit MAY be set to 0 or 1, although the meaning of it being set to 1 is undefined for priming queries.

But a priming query is just a normal DNS query, so RD would be defined normally, no?