Subject: Re: [DNSOP] Questions on draft-ietf-dnsop-delegation-only

From: Paul Wouters <[email-masked]>
Date: Tue, 3 Nov 2020 09:59:33 -0500 (EST)

Joe,

You never replied to this. I would really appreciate an answer so that
the Working Group knows whether or not your objection is still relevant,
based on the below developments of the Registry that is running the
TLD for which you were speaking.

As this seems to be the only outstanding technical issue with the draft,
it would be nice to get this answered. The remaining question then
becomes if the draft is worth it to enable the feature for those who
see value in it.

Regards,

Paul

On Tue, 11 Aug 2020, Paul Wouters wrote:

> On Thu, 30 Jul 2020, Joe Abley wrote:
>
>>>  I do not believe that is correct. The first and foremost purpose is for
>>>  the bit to signal the parent zone's behaviour in a public way that
>>>  prevents targeted / coerced attacks from the parent. This allows
>>>  policy violations to be rejected even if these violating DNS answers
>>>  are DNSSEC signed.
>>
>>  Has anybody done a survey to find out how many TLD zones actually fits the
>>  description of "delegation-only"?
>>
>>  I know for a fact that ORG does not today and I would say is unlikely ever
>>  to.
>
> So this statement aged badly with today's announcement from Afilias:
>
> http://www.circleid.com/posts/20200811-afilias-to-protect-tlds-against-potential-orphan-glue-exploits/
>
> 	 Afilias has informed registrars and registry clients that it is
> 	 taking steps to remove orphan glue records from 200+ TLD zones
> 	 in its care. This will eliminate the potential for a handful of
> 	 domain names to be misused.
>
> 	Afilias identified a handful of domain names among the 20 million 
> names
>
>>  For example, any nameserver N that is subordinate to domain D and linked
>>  to some other domain E will be served authoritatively from the ORG zone if
>>  domain D is suspended and while E continues to be delegared. Suspensions
>>  happen regularly, e.g. for domains implicated in technical abuse. There
>>  are several thousand examples of such N today and history suggests the
>>  number is not becoming smaller. Even if the number of such N could reach
>>  zero in ORG, we could never assume the number would remain at zero and
>>  still would not be able to assert usefully that the zone is
>>  delegation-only.
>>
>>  I don't think ORG is particularly special in this regard; it seems
>>  possible that other (possibly many other; possibly most or all) TLD zones
>>  are similar. If there are no TLD zones that actually are delegation-only
>>  then there seems no obvious application for it, regardless of whether we
>>  consider it to be useful or not.
>
> Well, 200+ TLD's are now removing this problematic orphan glue due to
> security reasons unrelated to this draft.
>
> So my question to Joe is, did you have any other concerns with allowing
> this draft to move forward?
>
> Paul
>
>

---

From: Joe Abley <[email-masked]>
Date: Tue, 3 Nov 2020 10:49:45 -0500

Hi Paul,

> TLD for which you were speaking.

Sorry about that, wasn't intentional. See below.

>> 	Afilias identified a handful of domain names among the 20 million names

I am familiar with the contents of that blog post and the circumstances surrounding it. My position on the usefulness of this draft has not changed. See below for more detail.

PIR and Afilias identified a software defect that in certain cases allowed glue records to remain in the zone even though they had been removed from the registry. Since the ORG zone is relatively large and since the defect had existed for a long time, the number of lingering orphan glue records was significant, even though the circumstances by which they showed up were relatively rare.

The software defect was eliminated and the glue records associated with the defect were removed.

However, even a cursory look at the ORG zone today, long after these records were removed, reveals that there are many orphan glue records (in the DNS sense, not in the registry sense) that remain. An example of the circumstances that lead to these remaining glue records being present in the zone is the case where a domain is suspended for abuse according to our published procedures; in those circumstances the delegation is removed from the zone but any subordinate glue records that might exist will remain.

On 2020-09-22 there were 7207 such orphan glue records in the ORG zone.

On 2020-11-03 (today, zone serial 2014131123) there are 8155 such orphan glue records in the ORG zone.

>> security reasons unrelated to this draft.

I have not done a survey of other TLD zones, but perhaps if I have a few spare minutes I'll take CZDS for a spin and see what I can see there.

>> this draft to move forward?

ORG is not a delegation-only zone today, and we do not expect it ever to be a delegation-only zone. Correspondingly, this is not a mechanism we would use in ORG.

Joe

---

From: Joe Abley <[email-masked]>
Date: Tue, 3 Nov 2020 16:15:23 -0500

Hey,

> I have not done a survey of other TLD zones, but perhaps if I have a few spare minutes I'll take CZDS for a spin and see what I can see there.

I don't have access to all zone data in CZDS since some registries take longer to approve access than others. It's perhaps also worth mentioning that CZDS doesn't carry any ccTLD zone data. This is not a representative sample.

From a quick look (with very little checking, and more than a little crude scripty hackery) it looks to me like 217 TLDs have at least one orphan glue record and 872 have none, based on this incomplete sample.

jabley@manta bin % jq '.zones | map_values(select(.orphans > 0)) | keys | length' zonedata.json
217
jabley@manta bin % jq '.zones | map_values(select(.orphans == 0)) | keys | length' zonedata.json
872
jabley@manta bin % 

See attached, if you feel like slicing the data some other way (or checking it).

Joe

---

From: "John Levine" <[email-masked]>
Date: 3 Nov 2020 17:19:31 -0500

In article <[email-masked]> you write:
>I am familiar with the contents of that blog post and the circumstances surrounding it. My position on the usefulness of
>this draft has not changed. See below for more detail.

Hi. I'm not Joe but I have a CZDS account. As I said back in August,
while there are lots of zones that are delegation-mostly, that is not
the same as being delegation-only. It is simply true that most TLDs
are delegation-only, and this hack is not useful.

I grepped through the downloaded contracted zone files for signed A
and AAAA records and found over 32,000 of them in over 200 TLDs. The
list of TLDs and counts are below, or you can find the whole set at
https://www.iecc.com/signedglue.txt

There are also _nicname._tcp SRV records in TLDs including .am .at.
ax. be. bg. biz. ch. cl. co. de. dk. fo. fr. gg. hu. ie. is. and at
least a dozen others.

Beyond that, there are 17,000 signed MX records in the .name zone and probably
other oddities if I looked further.

R's,
John

   1 abogado.txt
   1 aeg.txt
   1 afamilycompany.txt
   1 amazon.txt
   1 aol.txt
   2 arab.txt
 182 asia.txt
   1 audible.txt
   1 author.txt
   1 aws.txt
   1 barefoot.txt
   1 bayern.txt
   1 bbc.txt
   5 bbt.txt
   1 beer.txt
   1 bentley.txt
   4 bet.txt
   2 biz.txt
   6 black.txt
  60 blue.txt
   1 bms.txt
   1 book.txt
   1 boston.txt
   1 bot.txt
   1 bradesco.txt
   1 broadway.txt
   8 broker.txt
   2 brussels.txt
   1 budapest.txt
   1 buy.txt
   1 call.txt
   8 career.txt
   1 casa.txt
  17 cat.txt
   8 chanel.txt
   1 circle.txt
   8 clubmed.txt
   1 comcast.txt
   1 cooking.txt
   8 cookingchannel.txt
   2 cpa.txt
   8 crown.txt
   8 crs.txt
   8 csc.txt
   1 cymru.txt
   1 dds.txt
   1 deal.txt
   8 diy.txt
   8 duck.txt
   4 eco.txt
   8 ericsson.txt
   1 fashion.txt
   1 fast.txt
   8 fidelity.txt
   1 fire.txt
   1 fishing.txt
   1 fit.txt
   8 food.txt
   8 foodnetwork.txt
   8 forex.txt
   1 free.txt
   8 frontdoor.txt
   8 fujixerox.txt
   8 gallo.txt
   1 garden.txt
   8 genting.txt
   8 glade.txt
  28 global.txt
   1 gop.txt
   1 got.txt
   2 green.txt
   8 guardian.txt
   8 hgtv.txt
   1 horse.txt
   1 hot.txt
   8 hotmail.txt
   8 ice.txt
   1 imdb.txt
20338 info.txt
   2 ist.txt
   8 istanbul.txt
   8 jaguar.txt
   8 java.txt
   1 jot.txt
   1 joy.txt
   8 juniper.txt
   8 kerryhotels.txt
   8 kerrylogistics.txt
   8 kerryproperties.txt
  33 kim.txt
   1 kindle.txt
   8 kuokgroup.txt
   8 landrover.txt
   1 law.txt
   8 lefrak.txt
   8 lego.txt
   1 like.txt
   8 linde.txt
   6 link.txt
   8 lipsy.txt
   7 llc.txt
   2 llp.txt
   1 locus.txt
   1 london.txt
   8 lundbeck.txt
   8 lupin.txt
   1 luxe.txt
   8 maif.txt
   8 markets.txt
   8 med.txt
   1 miami.txt
   8 microsoft.txt
 303 mobi.txt
   1 moi.txt
   2 moscow.txt
   8 nab.txt
   8 nationwide.txt
   8 next.txt
   8 nextdirect.txt
   8 nikon.txt
   8 nissay.txt
   8 norton.txt
   1 now.txt
   8 obi.txt
   8 off.txt
   8 omega.txt
   3 onl.txt
   8 onyourside.txt
   8 oracle.txt
   8 orange.txt
8171 org.txt
   1 organic.txt
   2 paris.txt
   1 pay.txt
   2 pet.txt
   8 pictet.txt
   1 pin.txt
  14 pink.txt
   4 poker.txt
   4 politie.txt
   1 prime.txt
1246 pro.txt
   4 promo.txt
   8 raid.txt
   1 read.txt
   8 realestate.txt
   8 realtor.txt
  38 red.txt
   8 rexroth.txt
   1 rodeo.txt
   1 room.txt
   8 rwe.txt
   1 safe.txt
   8 sanofi.txt
   1 save.txt
   8 sbs.txt
   8 sca.txt
   3 scb.txt
   8 scjohnson.txt
   1 secure.txt
   8 sener.txt
   8 ses.txt
   8 shangrila.txt
   8 shell.txt
   1 shiksha.txt
   1 silk.txt
   8 sky.txt
   1 smile.txt
   1 spot.txt
   4 srl.txt
   1 surf.txt
   8 swatch.txt
   1 talk.txt
   8 tatamotors.txt
 141 tel.txt
   8 tiaa.txt
   8 tiffany.txt
 783 top.txt
   8 trading.txt
  12 travel.txt
   8 travelchannel.txt
   1 tunes.txt
   1 tushu.txt
   8 ubank.txt
   8 ubs.txt
   8 vanguard.txt
   1 vip.txt
   1 virgin.txt
   8 visa.txt
   2 vlaanderen.txt
   1 vodka.txt
   8 volvo.txt
  12 vote.txt
   1 wales.txt
   1 wanggou.txt
   8 weber.txt
   1 wedding.txt
   8 weir.txt
   8 windows.txt
   1 work.txt
   1 wow.txt
   8 xbox.txt
   8 xerox.txt
   1 xfinity.txt
  18 xin.txt
   2 xn--30rr7y.txt
   8 xn--5su34j936bgsg.txt
   1 xn--6frz82g.txt
   8 xn--9dbq2a.txt
   3 xn--9et52u.txt
   1 xn--c1avg.txt
   1 xn--cckwcxetd.txt
   2 xn--efvy88h.txt
   1 xn--i1b6b1a6a2e.txt
   1 xn--jlq480n2rg.txt
  60 xn--kput3i.txt
   8 xn--mk1bu44c.txt
   2 xn--mxtq1m.txt
   2 xn--ngbrx.txt
   1 xn--nqv7f.txt
   8 xn--t60b56a.txt
   8 xn--tckwe.txt
   8 xn--w4r85el8fhu5dnra.txt
   8 xn--w4rs40l.txt
   1 yamaxun.txt
   1 yoga.txt
   1 you.txt
   1 zappos.txt