Subject: results (was: Re: name server without root cache)

From: bert hubert <[email-masked]>
Date: Mon, 29 Apr 2002 22:59:10 +0200

Preliminary results indicate that there are nameserver implementations out
there that do not react well to a 'SERVFAIL' response and decide to hammer
your nameservers if these ought to be authoritative according to higher
delegations.

An example is net.com.ws that has been delegated to the express.powerdns.com
nameservers, but for which no user has configured a zone. 

We were seeing up to 120 queries/second from a limited number of nameservers
around the world hammering us, whereas we normally see 20 queries/second in
total.

We're going to experiment with sending out a root referral (although we
consider that pointless) to see if that helps. 

I know that Roy has developed a tool for fingerprinting nameservers
remotely, I'll post some misbehaving IP addresses here soon so we can see if
it is implementation related.

Furthermore, the SERVFAIL has been confusing the CO.ZA registry. So it has
not been a great success for us.

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>