Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt

From: yaojk <[email-masked]>
Date: Sat, 3 Oct 2015 22:31:48 +0800

在 2015年9月30日，03:55，John Levine <[email-masked]> 写道：

>>      I submit a draft about dbound solution.
> 
> This looks similar to the SOPA record that Andrew Sullivan proposed
> about a year ago.
> 
> If I want to say, "all names under example.com are under the same
> authority", how do I do that?  Do I have to put a DBOUND record at
> every name that exists at and below example.com?
> 

It is wildcard issue. It is an initial draft, which still does not cover it. 

Thanks

Jiankang 

> R's,
> John
> 
> _______________________________________________
> dbound mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dbound
>

---

From: "John R Levine" <[email-masked]>
Date: 3 Oct 2015 10:49:27 -0400

> It is wildcard issue. It is an initial draft, which still does not cover it.

I think you will find that DNS wildcards don't do what you want.  In 
particular, wildcards don't match anywhere that a name exists, even if 
there are no records at that name.  So if you have a wildcard at 
*.example.com with your proposed record, and an A record at 
a.b.example.com, the wildcard will not match a.b.example.com or 
b.example.com.

Andrew's SOPA record has the same problem, you'd need to put a SOPA record 
at every name that exists in the DNS subtree, which would be a very 
difficult provisioning problem.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

---

From: yaojk <[email-masked]>
Date: Sun, 4 Oct 2015 15:50:38 +0800

在 2015年10月3日，22:49，John R Levine <[email-masked]> 写道：

> I think you will find that DNS wildcards don't do what you want.  In particular, wildcards don't match anywhere that a name exists, even if there are no records at that name.  So if you have a wildcard at *.example.com with your proposed record, and an A record at a.b.example.com, the wildcard will not match a.b.example.com or b.example.com.
> 
You do not need put dbound record for every name that exists at or below example.com.

You just need to put 2 records:
*.example.com dbound example.com
Example.com dbound *.example.com
When do the DNS resolution for a.b.example.com, it will get the record "*.example.com dbound example.com". Then following the resolution steps in the dbound draft, it can approve that *.example.com and example.com share the same DNS boundaries. So it means that a.b.example.com and b.example.com
Share the same DNS boundaries.

Best regards 
Jiankang 

> Andrew's SOPA record has the same problem, you'd need to put a SOPA record at every name that exists in the DNS subtree, which would be a very difficult provisioning problem.
> 
> Regards,

---

From: "John R Levine" <[email-masked]>
Date: 4 Oct 2015 11:44:10 -0400

> Example.com dbound *.example.com
  When do the DNS resolution for a.b.example.com, it will get the record 
> "*.example.com dbound example.com". Then following the resolution steps 
> in the dbound draft, it can approve that *.example.com and example.com 
> share the same DNS boundaries. So it means that a.b.example.com and 
> b.example.com

DNS wildcards don't work that way.  If there's an A record at 
a.b.example.com, queries for a dbound record at a.b.example.com or at 
b.example.com will return an empty (NOERROR) answer.

See RFC 4592 which explains this in more detail.

Regards,