Subject: another out-of-zone cname question-- anti-aliasing of zone servers?

From: Paul Vixie <[email-masked]>
Date: Mon, 03 Apr 2006 17:47:03 +0000

"dig en.wikipedia.org a" retrieves from the wikipedia.org authority server
the following out-of-zone cname chain:

    ;; ANSWER SECTION:
    en.wikipedia.org.       3600    IN      CNAME   rr.wikimedia.org.
    rr.wikimedia.org.       600     IN      CNAME   rr.pmtpa.wikimedia.org.
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.202
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.245
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.246
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.206
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.203
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.236
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.210
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.214
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.235
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.247
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.213
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.205
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.204
    rr.pmtpa.wikimedia.org. 3600    IN      A       207.142.131.248

because the second and subsequent ownernames are outside the wikipedia.org
zone, they are thrown away by at least one modern paranoid resolver, since
this is the same mechanism that would be used to poison a cache with phish
data (like a www.bankofamerica.com name).

i don't blame wikipedia for trying this, since it's also what virtually all
akamaized services do.  check "www.yahoo.com" or "www.microsoft.com" for
examples.  what this causes is an extra query from the resolver to the zone
authority of each out-of-zone cname target.

    ;; ANSWER SECTION:
    www.yahoo.com.          300     IN      CNAME   www.yahoo.akadns.net.
    www.yahoo.akadns.net.   60      IN      A       66.94.230.41
    www.yahoo.akadns.net.   60      IN      A       66.94.230.39
    www.yahoo.akadns.net.   60      IN      A       66.94.230.49
    www.yahoo.akadns.net.   60      IN      A       66.94.230.42
    www.yahoo.akadns.net.   60      IN      A       66.94.230.36
    www.yahoo.akadns.net.   60      IN      A       66.94.230.47
    www.yahoo.akadns.net.   60      IN      A       66.94.230.46
    www.yahoo.akadns.net.   60      IN      A       66.94.230.44

    ;; ANSWER SECTION:
    www.microsoft.com.      3600    IN      CNAME   toggle.www.ms.akadns.net.
    toggle.www.ms.akadns.net. 300   IN      CNAME   g.www.ms.akadns.net.
    g.www.ms.akadns.net.    300     IN      CNAME   lb1.www.ms.akadns.net.
    lb1.www.ms.akadns.net.  300     IN      A       207.46.20.60
    lb1.www.ms.akadns.net.  300     IN      A       207.46.19.60
    lb1.www.ms.akadns.net.  300     IN      A       207.46.225.60
    lb1.www.ms.akadns.net.  300     IN      A       207.46.199.30
    lb1.www.ms.akadns.net.  300     IN      A       207.46.19.30
    lb1.www.ms.akadns.net.  300     IN      A       207.46.20.30
    lb1.www.ms.akadns.net.  300     IN      A       207.46.198.30
    lb1.www.ms.akadns.net.  300     IN      A       207.46.198.60

so here's my question.  should a modern paranoid resolver anti-alias these
out-of-zone cname targets, with logic along the lines of "even though the
zone of the target isn't within the zone of my question, i know that the
zone of the target is served by the same nameservers as the zone of my
question, so it is allowed to give me this out-of-zone data"?

if we should do this, it will save on backbone and overall DNS traffic, but
it will mean we have to think very hard about the ways in which other NS RRs
get into our cache.  (since they will override some current paranoia logic.)

if we should not do this, then wikipedia should put all of its infrastructure
under the main (wikipedia.org) name and not switch to wikimedia.org (note the
"m" rather than the "p") and akamai's customers should allocate .akamai
subdomains of their .com names, still served by akamai but semantically "part
of" the zone that the most common queries in the universe are all asking for.

either way it's probably time for a BCP document on this kind of processing.

i'm especially interested in DJB's perspective on this issue.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>