Subject: FW: I-D ACTION:draft-larson-bad-dns-res-00.txt

From: "Larson, Matt" <[email-masked]>
Date: Tue, 13 Nov 2001 10:59:58 -0500

Comments solicited and gratefully received...

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, November 13, 2001 7:08 AM
To: IETF-Announce; @loki.ietf.org
Subject: I-D ACTION:draft-larson-bad-dns-res-00.txt

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

	Title		: Observed DNS Resolution Misbehavior
	Author(s)	: P. Barber, J. Brady, M. Larson
	Filename	: draft-larson-bad-dns-res-00.txt
	Pages		: 14
	Date		: 12-Nov-01
	
This Internet-Draft describes DNS name server and stub resolver
behavior that results in a significant query volume sent to the
root and top-level domain (TLD) name servers.  In some cases we
recommend minor additions to the DNS protocol specification and
corresponding changes in name server implementations to alleviate
these unnecessary queries.  In one case, we have highlighted
behavior of a popular name server implementation that does not
conform to the DNS specification.  The recommendations made in this
document are a direct byproduct of observation and analysis of
abnormal query traffic patterns seen at two of the thirteen root
name servers and all thirteen com/net/org TLD name servers.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-larson-bad-dns-res-00.txt

To remove yourself from the IETF Announcement list, send a message to 
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-larson-bad-dns-res-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-larson-bad-dns-res-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Robert Elz <[email-masked]>
Date: Wed, 14 Nov 2001 15:11:35 +0700

Most of the draft looks good to me, I have a concern over just one
part of it ...

     For this query of the parent zone to be useful, the target zone's
     entire set of name servers would have to change AND the former set
     of name servers would have to be deconfigured and/or decomissioned
     AND the delegation information in the parent zone would have to be
     updated with the new set of name servers, all within the TTL of the
     target zone's NS RRset.  We believe this scenario is uncommon:

Unfortunately, not, though it doesn't happen quite as set out there.

The usual happening is for the old servers to vanish first (possibly carted
away on a truck when their owner went bust).   Then the domain owner gets
some new servers, and has them configured (to this point the parent is
still replying with the old defunct servers with full TTL - a day or two).
The domain then updates its delegation (which is reflected by the parent,
which goes in an instant from the old NS set with full TTL to the new NS
set with full TTL)

Then we have exactly the scenario where the query of the parent domain is
useful - instead of waiting for the TTL to expire before the new servers are
visible, they are found as soon as (near enough) there's a query after the
delegation has changed.   That has the effect of getting the domain back
working again as quickly as is possible - which is exactly what the domain
owner needs after their previous host has vanished.

Prohibiting this will only have the effect of the end users demanding that
the TTLs in the parent zones be reduced from something measured in days,
to something measured in hours (at most), so they're effectively disconnected
by circumstances outside their control for the smallest time possible.
This "cure" might be worse than the disease.

So, I'd suggest that instead of prohibiting this extra lookup, it would be
better to simply scale it better - require that it not be repeated within
an hour of a previous lookup.   That's short enough that dead domains can
be resurrected quickly, yet long enough that it should provide some respite
for the servers.

kre