Re: static versus dynamic nature of DNS: rate limiting

On 2004-02-22 20:01:53 +0100, Hadmut Danisch wrote:
> On Sun, Feb 22, 2004 at 12:19:31PM -0500, Meng Weng Wong wrote:
> > custom DNS server.  His server keeps track of the number of messages
> > sent from a given IP in a day, and returns an allow/deny accordingly.
> > It is a proof of concept that shows that you *can* teach an old DNS new
> > tricks.
>
>
> Of course, you can try to teach an old cow dancing and flying.
>
> What's the point in "teaching an old DNS new tricks"? Didn't so many
> people object against RMX RR because it requires just a new record
> type which means to just have an update for DNS servers and client
> libraries? Wasn't that considered as infeasible? Wasn't that the
> reason why SPF used TXT records? And now you want to "teach an old DNS
> new tricks"???

There is a difference between changing the protocol and changing the
implementation. A new RR is a change in the protocol, and all servers
and clients will have to be changed to make use of it. Changing a
specific implementation is much easier. If I want to run a domain name
server which returns one answer if the client's IP address is evenly
divisible by 13 and the moon is full, and another in all other cases,
only I will have to change my server. Clients will be completely
unaffected, and domain owners which are happy with static zones can also
continue to run their name servers.


> What do we do here? Do we want to design a mechanism for sender
> verification or do we want to teach DNS "new tricks"? Isn't that a
> task for the DNS working group?

The Domain Name System doesn't have to learn new tricks. Some domain
name servers may want to learn them.

	hp

--
   _  | Peter J. Holzer    | I think we need two definitions:
|_|_) | Sysadmin WSR       | 1) The problem the *users* want us to solve
| |   | [email protected]         | 2) The problem our solution addresses.
__/   | http://www.hjp.at/ |    -- Phillip Hallam-Baker on spam

[demime 0.99d.1 removed an attachment of type application/pgp-signature]