Re: The state of DNS support, was Deprecating SPF

Nicholas Weaver <[email protected]> Tue, 27 Aug 2013 07:44:21 -0700

Newsgroups	gmane.ietf.dnsext
Message-ID	<[email protected]>

On Aug 27, 2013, at 7:25 AM, Hadriel Kaplan <[email protected]> wrote:

> But from reading the problems SPF listed in RFC 6686 and the emails from SPFBIS folks, I don't think that would solve the problem, even if by some miracle all DNS servers on the planet supported the new RRs.  There're just too many other DNS-related-things involved. (DNS servers and registries, and their provisioning interfaces, and DNS resolvers/caches, firewalls, CGN middleboxes, client libraries and their APIs...)

Fortunately, for MOST such boxes, they do actually handle unknown resource records right (we've been testing that with Netalyzr for almost forever, with type 169 on transport, and 1169 on probes to configured recursive resolvers).  Namely because the protocol is actually designed right in that respect: its actually easier to handle ALL types in a generic manner after special casing the FEW types that allow name compression.

Thus it really is that the major problem is provisioning, not transport, of unknown DNS types.

--
Nicholas Weaver                  it is a tale, told by an idiot,
[email protected]                full of sound and fury,
510-666-2903                                 .signifying nothing
PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext

signature.asc (application/pgp-signature, 841 B)