Subject: RE: DEPLOY: DNS Record Types

From: "Jim Lyon" <[email-masked]>
Date: Thu, 26 Aug 2004 15:39:13 -0700

Dave Crocker wrote (regard whether one MAY, SHOULD or MUST publish a TXT
record): 
> If there were a problem with publishing the new record type, that [not
> requiring a TXT record] would be a significant barrier.  Unless there
> is a claim that publishing such data is highly problematic, then
requiring
> the long-term record type to be used seems to make sense.

For many of us, there *IS* a problem with publishing the new record
type,
and it *IS* a significant barrier.

There *IS* a claim that publishing a new record type is highly
problematic.
As has been repeatedly discussed:

1. Microsoft DNS server (all currently deployed versions) cannot publish
   the new record type. (Exception: some can, but only if they received
   the data via a zone transfer and have not been restarted since
receiving
   it.  If you attempt to restart them after receiving the unknown
record
   type, startup fails.)

2. The DNS resolver APIs on all Microsoft OS's don't let you query for
an
   unknown record type.

3. Even if you write your own DNS resolver code, if you're behind a
   firewall created by Microsoft ISA Server, you usually can't
successfully
   send and receive a query for a new record type.

I can't speak for other name servers, resolvers or firewalls, but I
believe
that the above is a substantial enough segment of the population to
constitute
a significant barrier.

Dave also says:
> Looking at the other side of this, making publishing in a TXT record
be
> a SHOULD means that there is a long-term requirement for support,
> whereas the intention is to use it for the near-term.

Perhaps the disagreement has to do with a difference in time-scales.
Assuming that Microsoft set out to change (1) through (3) above (and it
hasn't), then it would probably be 3 years from start of design until a
non-beta product became available.  It's probably another 2 years for
50% adoption, or another 5 to 10 years for 90% adoption.  Putting it all
together, "short-term" lasts somewhere between 5 and 13 years from when
Microsoft starts to fix their DNS stuff.

Given that the IETF standards process, slow as it is, is much faster
than this, it makes sense to mandate the short-term behavior today, and
to revisit the issue once the motivation for the short-term behavior has
passed.

-- Jim Lyon

---

From: Dave Crocker <[email-masked]>
Date: Thu, 26 Aug 2004 16:10:50 -0700

Jim,

JL> 1. Microsoft DNS server (all currently deployed versions) cannot publish
...
JL> 2. The DNS resolver APIs on all Microsoft OS's don't let you query for

I did recall that there were problems on the client side.

So the thought is to make the record available, but realize that it will
only get queried as clients get more capable.

In any event, having a specification that contains no "MUST" strikes me
as odd, since there is no identifiable core of functionality that is
guaranteed to be implemented.  Such a guarantee is usually the basis for
IETF protocols being assured to work.

d/
--
 Dave Crocker <dcrocker-at-brandenburg-dot-com>
 Brandenburg InternetWorking <www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>

---

From: David Blacka <[email-masked]>
Date: Fri, 27 Aug 2004 18:09:43 -0400

On Thursday 26 August 2004 7:10 pm, Dave Crocker wrote:
> Jim,
>
> JL> 1. Microsoft DNS server (all currently deployed versions) cannot
> publish ...

Why not:

   SHOULD publish SPF2
   MAY publish TXT
   MUST publish at least one of the two.

-- 
David Blacka    <[email-masked]> 
Sr. Engineer    VeriSign Applied Research