Subject: Re: [DNSOP] Working Group Last Call draft-ietf-dnsop-refuse-any

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 4 Jan 2017 18:11:12 +0100

On Fri, Nov 25, 2016 at 07:50:48PM -0500,
 tjw ietf <[email-masked]> wrote 
 a message of 114 lines which said:

> This starts a Working Group Last Call for
> draft-ietf-dnsop-refuse-any

Since we'll apparently have one more iteration of the draft, one small
detail. The draft says:

> The HINFO RRTYPE is believed to be rarely used in the DNS at the
> time of writing, based on observations made both at recursive
> servers and authority servers.

If you have access to a passive DNS database, you can check by
yourself. Indeed, the vast majority of HINFO comes from Cloudflare
domains. In .fr (3 million domains), DNSDB found only 54
non-Cloudflare HINFO. My favorites are (a former employer):

iiel.iie.cnam.fr. IN HINFO "VS3100" "VMS-6.2"
wotan.iie.cnam.fr. IN HINFO "AlphaServer-1000" "OSF"

I strongly doubt there is really a VaxStation 3100 still in operation
:-)

---

From: Matthijs Mekking <[email-masked]>
Date: Fri, 6 Jan 2017 16:28:17 +0100

> Since we'll apparently have one more iteration of the draft, one small

I'll add some more feedback for the next iteration, that came up during 
a discussion with some colleagues, to make the document more clearer:

1. In section 7, "Updates to RFC 1035" the draft says "ANY does not mean 
ALL" and that it is consistent with RFC 1035, while in fact 1035 does 
say that QTYPE=* means a request for all records. It would be good to 
clarify the statement in section 7 that even if RFC 1035 says that the 
ANY query is a request for *all* records, it is not reliable that this 
also means you get all records. In other words, the response behavior is 
consistent with 1035.

2. "Conventional ANY response" is used but not defined. A line or two 
that defines Conventional ANY response to be "a response that includes 
all the available records at the QNAME" or something like that would be 
a good addition.

3. Insisting that the HINFO OS field SHOULD be empty seems a little too 
strong; perhaps it's better to say "The OS field of the HINFO RDATA 
SHOULD be short to minimize the size of the response. It MAY be empty or 
MAY include a summarized description of local policy." Perhaps even the 
keywords can be lowercased?

Furthermore I would be interested in the problems that Cloudflare 
encountered when implementing the HINFO response. All I could find in 
this thread was "probably a validator will requery with QTYPE=HINFO". Is 
that statement based on observations or assumptions?

Best regards,
   Matthijs