Subject: Re: Who hates the DNAME?

From: David Conrad <[email-masked]>
Date: Fri, 15 Apr 2005 10:26:03 -0700

On Apr 15, 2005, at 8:52 AM, Edward Lewis wrote:
> How many implementations have the DNAME processing in them - in the 
> recursive server, doing step 4?  I suppose BIND does, but do any 
> others?

Perhaps not surprisingly, Nominum CNS supports DNAME.

> (Has interoperability been achieved?)

I'm not aware of any formal interoperability tests, although I suspect 
a number of informal tests have been done.

> If there is interoperability and widespread use, then the RFC ought to 
> be amended for completeness.

If there is a need for amendment, yes.

> If not, I'd like to put forward the idea of obsoleting the record.

I would not want to do this, but that's just me.

Rgds,
-drc

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Fri, 15 Apr 2005 14:12:04 -0400

>Perhaps not surprisingly, Nominum CNS supports DNAME.

Until now, I hadn't heard of anyone else implementing it...

>I would not want to do this, but that's just me.

I'm still curious about how much use it is getting.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

If you knew what I was thinking, you'd understand what I was saying.

---

From: Mark Andrews <[email-masked]>
Date: Wed, 27 Apr 2005 13:45:28 +1000

> After trying over and over to "clarify" DNAMEs and wild cards, I have 
> come to have a complete dislike for the DNAME.  Not just the document 
> but also the idea.
> 
> For one, DNAME violates principles that have been voiced in 
> opposition to things like NSEC3 and proposals to put application data 
> in the DNS.  In short, denying current proposals via criteria that 
> the DNAME "breaks" is rather hypocritical.  Worse, I take this to 
> mean that perhaps the DNAME is a suspect extension.
> 
> It is said that DNAME works.  But it only works within certain 
> bounds, i.e., not with wild cards.  If that's the case, then other 
> extensions ought to be allowed if they are used within their bounds.
> 
> Specifically, I am troubled by the changes to the search algorithm in 
> the DNAME RFC (RFC 2672).  Not only is part 'c' of step 3 
> incompletely updated (it says nothing of what happens when the QTYPE 
> is any or DNAME), but it also modifies the search in the cache. 
> Specifically, the cache now takes on a role that is otherwise 
> reserved for the authoritative data - a "search" having knowledge of 
> the tree structure.
> 
> (NSEC3 proposes changing the search algorithm, this has been cited as bad:
>    http://ops.ietf.org/lists/namedroppers/namedroppers.2005/msg00685.html)
> 
> others?  (Has interoperability been achieved?)
> 
> How widespread is the use of DNAME?  There's an ISC report on how to 
> do it, but is it common enough?
> 
> If there is interoperability and widespread use, then the RFC ought 
> to be amended for completeness.  If not, I'd like to put forward the 
> idea of obsoleting the record.
> 
> -- 

	The reason for blocking "* DNAME" is that it results in different
	results from authoritative servers compared with the results that
	come from the cache.

	Plain (non-wildcard) DNAME.

	"example.com DNAME foo.net" is like
	"*.example.com CNAME <match of wildcard>.foo.net".  Note there
	is a implict wildcard generated by the DNAME that *also* operates
	in caches.  To get consistant results from both authoritative
	servers and caches no subdomains of the DNAME owner are permitted.

	With wildcard DNAME you have *only* the explict wilcard being expaned
	by the authoritatives servers and *only* the implicit wildcard being
	expanded by the caches.  This results in different answers depending
	apon which server you query.

	As for which servers support DNAME.  Every server that supports
	DNSSECbis is required to support DNAME.

	Mark
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]