Re: static versus dynamic nature of DNS: rate limiting

On Sun, Feb 22, 2004 at 12:19:31PM -0500, Meng Weng Wong wrote:
>
> custom DNS server.  His server keeps track of the number of messages
> sent from a given IP in a day, and returns an allow/deny accordingly.
> It is a proof of concept that shows that you *can* teach an old DNS new
> tricks.


Of course, you can try to teach an old cow dancing and flying. 

What's the point in "teaching an old DNS new tricks"? Didn't so many
people object against RMX RR because it requires just a new record
type which means to just have an update for DNS servers and client
libraries? Wasn't that considered as infeasible? Wasn't that the
reason why SPF used TXT records? And now you want to "teach an old DNS
new tricks"???

What do we do here? Do we want to design a mechanism for sender
verification or do we want to teach DNS "new tricks"? Isn't that a
task for the DNS working group? 

Isn't it a severe design mistake to base such a mechanism tightly on
teaching a stone age old service "new tricks"?

What's wrong with HTTP? There is absolutely no need to update
anything, there are millions of web servers, proven to be robust, 
thousands of experienced CGI programmers, plenty of CGI environments
and script languages. Many Webservers use LAMP
(Linux/Apache/MySQL/PHP) which *perfectly* would do the job.

Will be quite easy to provide web interfaces which allow unexperienced 
users to generate the authorization records through a very simple 
user interface. That's what we need for rapid deployment.

Anything like that for DNS? No!


Most ISP/MSPs don't even give their customers direct access to 
the DNS zone files.



How many people know how to put a file on a web server?

How many people know how to run a cgi script?

How many people know how to write a zone file correctly and to 
update a DNS server automatedly?

Should this working group really come to the conclusion that we should 
"teach DNS new tricks"? Haha

Hadmut