Subject: [DNSOP] Erik Kline's Yes on draft-ietf-dnsop-dns-tcp-requirements-13: (with COMMENT)

From: Erik Kline via Datatracker <[email-masked]>
Date: Tue, 26 Oct 2021 13:09:00 -0700

Erik Kline has entered the following ballot position for
draft-ietf-dnsop-dns-tcp-requirements-13: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/blog/handling-iesg-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-dns-tcp-requirements/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

[abstract vs. S1/S3, question]

* The abstract says:

   "...strongly
   encourages the operational practice of permitting DNS messages to be
   carried over TCP"

  while section 1 says:

   "...all DNS resolvers and recursive
   servers MUST support and service both TCP and UDP queries"

  and section 3 also some MUST text.

  Should the abstract be updated to say MUST rather than just
  "strongly encourages", or is there a subtly in here I'm missing?

[S4.1, comment]

* "Resolvers and other DNS clients should be aware that some servers
   might not be reachable over TCP.  For this reason, clients MAY want
   to track and limit the number of TCP connections and connection
   attempts to a single server."

  I think the same comment could be made about paths to a server from
  a given network, e.g., in the case of one network filtering TCP/53 for
  some reason.

  I'm not sure how to best reword this to add a per-network notion to
  TCP connection success tracking, but I did want to note that a mobile
  client's measure of TCP connection success to a single server might
  vary from network to network.  (for your consideration)

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 26 Oct 2021 13:13:23 -0700

> https://datatracker.ietf.org/doc/draft-ietf-dnsop-dns-tcp-requirements/

"require" might be better than "MUST", on the principle that if a given
requirement is stated in more than one place, there is risk of inadvertent
skew between what is actually stated; such skew can cause interoperability
failure or security vulnerabilities if different implementations use the
differing behaviors.

-Ben

---

From: Erik Kline <[email-masked]>
Date: Wed, 27 Oct 2021 08:12:59 -0700

On Tue, Oct 26, 2021 at 1:13 PM Benjamin Kaduk <[email-masked]> wrote:

> > Please refer to
> https://www.ietf.org/blog/handling-iesg-ballot-positions/

+1 sgtm

---

From: "Wessels, Duane" <[email-masked]>
Date: Fri, 29 Oct 2021 20:57:55 +0000

Erik, thanks for the review

> On Oct 26, 2021, at 1:09 PM, Erik Kline via Datatracker <[email-masked]> wrote:
> 
> 
> 

Based on the suggestion from Ben, we’ve updated the text:

      <t>This document updates RFC 1123 and RFC 1536.  This
      document requires the operational practice of permitting
      DNS messages to be carried over TCP on the Internet as a Best
      Current Practice.  This operational requirement is aligned with the
      implementation requirements in RFC 7766.  The use of TCP includes

>  vary from network to network.  (for your consideration)

Is this because mobile devices are more likely to have multiple network choices (say wifi and cellular data) and so the device should include the local network when remembering which works and which doesn’t?

DW