Re: Empty AA=0 AD=1 answers to AAAA queries: your thoughts pls

On 20 Dec 2014, at 14:41, bert hubert <[email protected]> wrote:

> On Sun, Dec 21, 2014 at 01:25:06AM +1100, Mark Andrews wrote:
>>> I have a question if I am right in concluding something is a protocol
>>> violation, and if we should reward it by papering it over or (finally)
>>> concluding that enough is enough.
>> 
>> I've been thinking for a long time that enough is enough.  Named tried
>> to reject all non referral "aa=0" from supposedly authoritative servers
>> a while back and we had to reverse the change.  While pandora.tv has
>> fixed the aa=0 issue they still return malformed answers.
> 
> What about if (say) ISC, NLNetlabs, Nominum, PowerDNS and Google DNS say
> "enough is enough"?  

There are options between SERVFAIL and work-around. One such would be
'delay responses in respect of non-conformant replies by 3 seconds'.
I would bet pretty Google Pagespeed etc. will start including a
test to see whether the DNS server is broken and thus causes excessive
delay with certain resolvers.

That's far less antisocial than "surely you didn't you really mean
'aa=0'? Let me just ask you 255 more times to make sure in case you
change your mind", no matter how tempting ...

-- 
Alex Bligh




_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext