Subject: [dnsext] Announcement: Test Report on DNSSEC impact on SOHO CPE

From: [email-masked]
Date: Mon, 15 Sep 2008 15:16:20 +0100

Dear Colleagues,

We would like to announce the publication of a joint study entitled
"DNSSEC Impact on Broadband Routers and Firewalls", available for
download at:

  http://download.nominet.org.uk/dnssec-cpe/DNSSEC-CPE-Report.pdf

In summary (based on 24 tested units):

"... we conclude that just 6 units (25%) operate with full DNSSEC
 compatibility "out of the box."  9 units (37%) can be reconfigured to
 bypass DNS proxy incompatibilities.  Unfortunately, the rest (38%) lack
 reconfigurable DHCP DNS parameters, making it harder for LAN clients to
 bypass their interference with DNSSEC use.

 These findings, their potential impact on DNSSEC use by broadband
 consumers, and implications for router/firewall manufacturers, are
 presented and analyzed in this report. "

Ray Bellis
Senior Researcher in Advanced Projects
Nominet UK

Lisa A. Phifer
President, Core Competence, Inc.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Florian Weimer <[email-masked]>
Date: Mon, 22 Sep 2008 17:15:36 +0200

Interesting, thanks.

In light of this report, does the working group see a need to
standardize DNSSEC behavior for mobile devices (which may move between
networks with varying levels of DNSSEC support)?

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

---

From: [email-masked]
Date: Mon, 22 Sep 2008 16:19:00 +0100

> Interesting, thanks.

You're welcome :)
 
> networks with varying levels of DNSSEC support)?

I'm planning to tackle it from the other side, by writing an Informational 
BCP on how to implement a DNS proxy.

Ray

-- 
Ray Bellis, MA(Oxon)
Senior Researcher in Advanced Projects, Nominet
e: [email-masked], t: +44 1865 332211

---

From: Nicholas Weaver <[email-masked]>
Date: Mon, 22 Sep 2008 09:02:38 -0700

> BCP on how to implement a DNS proxy.

Why not do a relatively simple thing:

Test to see if your current resolver has proper DNSSEC support to your  
liking by generating a query or two.

If so, cool.

If not, remember all your old DNS resolvers which DID support DNSSEC  
to your liking (and a list of additional fallback recursive  
resolvers), start going back through the list until you find one that  
still supports DNSSEC to your liking and will service your requests.

If none of your old DNS resolvers support DNSSEC to your liking, the  
stub resolver changes to recursive mode.

If you can't generate outbound DNS requests because of network policy,  
AND DNSSEC is not working properly, you need to consider this a  
hostile network, and you have a problem.

---

From: Paul Vixie <[email-masked]>
Date: Tue, 23 Sep 2008 15:59:01 +0000

in my hotel room (crowne plaza, ottawa) i get real answers for QTYPE=A but
timeouts for QTYPE=AAAA, and no DNS metadata reaches me.  
-- 
Paul Vixie

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 23 Sep 2008 21:46:33 -0400

On Tue, Sep 23, 2008 at 03:59:01PM +0000,
 Paul Vixie <[email-masked]> wrote 

> timeouts for QTYPE=AAAA, and no DNS metadata reaches me.  

Use another hotel :-) In the Albert Inn, one block away from the Crown
Plaza, both work fine.