Subject: Re: (ngtrans) The reverse lookup issue

From: Bruce Campbell <[email-masked]>
Date: Wed, 3 Jul 2002 23:53:07 +0200 (CEST)

On Wed, 3 Jul 2002, Louis A. Mamakos wrote in reply to Christian Huitema:

> > So, my question is, do we really need to invest in a reverse lookup DNS
> > tree for IPv6? Or should we not just "declare victory" and recognize
> > that reverse lookup has very little practical value?
>
> I think that about a decade ago (or so I it seems..) I suggested that
> we abandon the notion of using the DNS to do address->name lookups.

> Rather, define a simple standard service where a host can be asked
> what it thinks it's name is.  In many cases, this does the "right

If you wish 'simple', you may as well use something very much akin to
ident(1431), or indeed, overload the existing ident protocol with a
slightly different request and answer.  Not that I'm seriously suggesting
that.

> thing" in that you get a meaningful name at the time that the
> address was allocated to someone (e.g., out of a DHCP pool or other
> transient network connection.)

As DNS operational folk have seen (MS, ddns by default), if you give the
user the ability to define their own name, they will attempt to declare
themselves to be 'all.high.and.mighty', and I really wouldn't like to see
that sort of string appearing in my access logs.

> Sure, you can't "trust" this name.  Just like you can't really trust
> the one in DNS PTR records, either.

If you wish vaguely reliable, you've got the existing (reverse) DNS at the
administrative mercies of providers/hopefully clued users.  Most PTR
records, if available, do have some sort of relationship to the
responsible person behind the host.

> Or simply decide the practical value is small.

The practical value of address to name mapping is large for the site
administrator; 'What is the host behind this IP address?'.  If the host in
question has been compromised, you can no longer trust _anything_ from
that host.  Hence, a requirement for address to name mapping does exist.
DNS, so far, appears to work in providing that functionality.

People outside your site may have policies (sometimes poorly thought out)
that require you to provide some level of address to name mapping.  This
may or may not alter your liking of doing such.

Regards,

--==--
Bruce.

Speaking for myself.

---

From: Bill Manning <[email-masked]>
Date: Wed, 3 Jul 2002 16:35:12 -0700 (PDT)

As others have pointed out, the addressing structure maps the topology
while the naming structure maps the administrative structure. Sometimes
(rarely) they overlap. Most times they do not. My keys/certs are tied
to the node name (bloat.isi.edu) and not to the IP address, which can
and does change with some frequency. (any time the laptop moves).

 Cross-correlation is a good and useful thing.  
 The claim about the maintaince of the in-addr tree vs the
 maintance of the forward tree are interesting. The last data
 that we collected on in-addr.arpa and the Mice/Men data on
 the forward tree indicates that the in-addr tree is actually
 better maintained...   Go figure.

--bill