Subject: [dbound] wildcard issue and two way assertion

From: "Jiankang Yao" <[email-masked]>
Date: Thu, 12 Nov 2015 14:36:20 +0800

From: John R Levine
Date: 2015-10-03 22:49
To: yaojk
CC: [email-masked]
Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt
> >> If I want to say, "all names under example.com are under the same
> >> authority", how do I do that? 

I think that we need two-way assertion here. parents can say all my children are under my control and share the same boundaries. in the other hand,
the children should say that I share the same boundary which my parents specify too.

>> Do I have to put a DBOUND record at
> >> every name that exists at and below example.com?
> >
> > It is wildcard issue. It is an initial draft, which still does not cover it.
> 
> I think you will find that DNS wildcards don't do what you want.  In 
> particular, wildcards don't match anywhere that a name exists, even if 
> there are no records at that name.  So if you have a wildcard at 
> *.example.com with your proposed record, and an A record at 
> a.b.example.com, the wildcard will not match a.b.example.com or 
>  b.example.com.
> 

wildcards work for the non-configured sub-domain names. In this exmaple, quering c.example.com will work if c.example.com  is not configured in some ways.

if there is a record for a.b.example.com, it indicates that the a.b.exmaple.com or b.exmaple.com may exist. so under this situation, a.b.exmaple.com or b.exmaple.com should configure their own dbound record 
since a.b.exmaple.com or b.exmaple.com may be out of control of the parents. The debound record has similar same limitation with the wildcard.

Jiankang Yao

> Andrew's SOPA record has the same problem, you'd need to put a SOPA record 
> at every name that exists in the DNS subtree, which would be a very 
> difficult provisioning problem.
> 
> Regards,
> John Levine, [email-masked], Taughannock Networks, Trumansburg NY
> Please consider the environment before reading this e-mail.