Subject: What are valid reasons to have wildcards in DNS?

From: Matus UHLAR - fantomas <[email-masked]>
Date: Thu, 06 Nov 2003 15:56:51 -0000

[ post by non-subscriber.  with the massive amount of spam, it is easy to miss
  and therefore delete posts by non-subscribers.  if you wish to regularly
  post from an address that is not subscribed to this mailing list, send a
  message to <listname>[email-masked] and ask to have the alternate
  address added to the list of addresses from which submissions are
  automatically accepted. ]

Hello,

for last two months there were many discussions and clarifications about
wildcards in DNS. There is a question that seems to me still unanswered:

what are legal and valid reasons to have wildcards in domains?

>From my point of view, wildcards are used:
1. by admins lazy to set up higher number of hostnames od MX records
2. for lame people not able to use some reasonable defaults (e.g. *.museum
   versus www.museum)

when we take into consideration all problems happening caused by using
wildcard domain names - all of them were named in when verisgn introduced
wildcards in .com and .net zones:

http://lists.megacity.org/pipermail/rfci-discuss/2003-September/001759.html
http://www.icann.org/announcements/advisory-03oct03.htm

And when we look at the discussions in this group, wouldn't it be much
better to disable wildcards in DNS at all?

-- 
Matus UHLAR - fantomas, [email-masked] ; http://www.fantomas.sk/
Warning: I don't wish to receive e-mail advertising to this address.
Varovanie: Nezelam si na tuto adresu dostavat akukolvek reklamnu postu.
Honk if you love peace and quiet. 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Thu, 13 Nov 2003 15:04:28 +0000

> ...

no.  the protocol community has no concrete or complete idea of why a
zone adminstrator might use wildcards.  all we know is that they are
in wide use for many purposes, and that they are often used incorrectly
or unnecessarily.

but more importantly, current dns does wildcard synthesis in the authority
server, not in the resolvers.  this means two things.  first, there's no
workload being placed on or shifted toward resolvers by the use of wildcards.
second, a zone administrator could synthesize data for their own purposes,
with or without wildcard rules, as long as she controlled all of her 
authority servers (and therefore did not depend on axfr to carry the
synthesis marker, as wildcards do.)

therefore there's not only nothing we SHOULD do to restrict the use of
wildcards, there's also nothing we COULD do to restrict such use.

the recent discussions about the *.COM and *.NET wildcards ended by pointing
up the fact that the "zone administrator" function is not singularly held
by any one entity, and that the putative zone administrator apparently lacks
the full autonomy needed to synthesize responses to nonexisting names in the
way a non-gTLD zone administrator would normally be able to do.  i hope you
will agree that this is a problem for the lawyers, not for the protocol
community, to resolve.

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 14 Nov 2003 00:26:22 +0900

Paul Vixie;

> in wide use for many purposes, and that they are often used incorrectly

Both of you should read 4.3.3 of 1034, though you are free to
argue against it.

							Masataka Ohta

---

From: "Olaf M.Kolkman" <[email-masked]>
Date: Thu, 13 Nov 2003 09:41:32 -0600

> Both of you should read 4.3.3 of 1034, though you are free to

Ohta San,

Could you expand; it not quite clear, to me at least, what you are 
trying to argue with providing the reference.

--Olaf Kolkman
    namedropper.

---

From: Jim Reid <[email-masked]>
Date: Thu, 13 Nov 2003 16:07:56 +0000

>>>>> "Paul" == Paul Vixie <[email-masked]> writes:

    Paul> therefore there's not only nothing we SHOULD do to restrict
    Paul> the use of wildcards, there's also nothing we COULD do to
    Paul> restrict such use.

Not even a BCP which says "Wildcard RRs are considered harmful. Don't
use them unless you really know what you're doing. Which you obviously
don't if you have to read this BCP..."?

I agree 100% there's nothing we could or should do to restrict usage
of wildcards. However we could discourage their use and so do a little
to help make the internet a better place.

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 14 Nov 2003 01:42:21 +0900

> trying to argue with providing the reference.

There is a description why a zone administrator might use wildcards.

And, my understanding is that wildcard is useful if there are many
or huge number of names sharing same properties and a zone administrator
do not want or can't modify zone everytime a new name appears.

I also think it is unlikely that the reasons are applicable to A
RR that there will be a confusion if people, ignoring the example
in 1034, think DNS is a system to retrieve addresses.

						Masataka Ohta

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Thu, 13 Nov 2003 12:12:20 -0500

> Both of you should read 4.3.3 of 1034, though you are free to

I'm looking at a .museum, which apparently uses wildcards for a purpose
not apparently described in section 4.3.3 of 1034.

Eric

---

From: Paul Vixie <[email-masked]>
Date: 13 Nov 2003 17:44:53 +0000

> Both of you should read 4.3.3 of 1034, though you are free to

i have reread it.  please point out the part that i seem not to agree with.
the only part that stands out as relevant to the original questioner is...

>> This facility is most often used to create a zone which will be used to
>> forward mail from the Internet to some other mail system.

...and while i agree with this, i also note that "most often" is nonexclusive.
-- 
Paul Vixie

---

From: Paul Vixie <[email-masked]>
Date: Thu, 13 Nov 2003 17:55:52 +0000

> don't if you have to read this BCP..."?

not even that, nope.

> to help make the internet a better place.

sounds like a dnsop issue.

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 13 Nov 2003 13:57:32 -0500 (EST)

> do not want or can't modify zone everytime a new name appears.

Synthesis would be useful in such cases, but not the standardized
wildcard.

I suggest reading draft-ietf-dnsext-wcard-clarify-02.txt, particularly
the first paragraph on page three.

-- Sam

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 14 Nov 2003 04:15:53 +0900

Samuel Weiler;

> Synthesis would be useful in such cases, but not the standardized

Wild card is the standard way of "synthesis", which means it works
over standardized zone transfer.

> the first paragraph on page three.

I checked it again but found no useful information in the paragraph.

						Masataka Ohta

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 13 Nov 2003 15:28:29 -0500 (EST)

> I checked it again but found no useful information in the paragraph.

Then perhaps I should be more plain, or you should read the paragraph
yet again.  I'll quote it here to make it easy to find:

   Note that a wild card domain name has no special impact on the search
   for a query type (QTYPE).  If a domain name is found that matches the
   QNAME (exact or a wild card) but the QTYPE is not found at that
   point, the proper response is that there is no data available.  The
   search does not continue on to seek other wild cards that might match
   the QTYPE.  To illustrate, a wild card owning an MX RR does not
   'cover' other names in the zone that own an A RR.  ...

> >>do not want or can't modify zone everytime a new name appears.

I think your understanding is incorrect.  The cited paragraph says
that if a name exists, the standard wildcard has no effect on it.  So
the standard wildcard won't be useful unless the "huge number of
names" you refer to is either every possible name in the zone or every
possible name except for explicitly instantiated ones.

-- Sam

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 14 Nov 2003 05:52:16 +0900

Samuel Weiler;

> I think your understanding is incorrect.

Why?

> The cited paragraph says
> that if a name exists, the standard wildcard has no effect on it.

Correct, so far.

> So

I never said "if and only if".

Paul wrote "no concrete or complete idea", and I gave a reference
to an idea.

Then, I'm still puzzled because I think "if a name exists, the
standard wildcard has no effect on it" has no relevance to my
point.

Just FYI, wildcard may appear anywhere in a zone not necessarily at
the top.

							Masataka Ohta

---

From: Nathan Jones <[email-masked]>
Date: Fri, 14 Nov 2003 09:07:28 +1100

>what are legal and valid reasons to have wildcards in domains?

Here is one example that springs to mind...

A company (Foo) provides web sites to real estate businesses. Each
business hosts its domain somewhere different and needs traffic to reach
the Foo web server. Foo tells its 400 customers to use CNAMEs, like this:

www.ocean-realty.example.  IN  CNAME  server.foo.example.

...so that if Foo's network must be renumbered, they don't have to make
400 real estate agents update DNS.

Of course, sometimes the customer wants "ocean-realty.example" to work in
a browser, so they break their DNS with:

@  IN  CNAME  server.foo.example.

>wouldn't it be much better to disable wildcards in DNS at all?

No. Only to educate DNS Admins about the possible problems.

-- 
Nathan Jones

---

From: Kevin Darcy <[email-masked]>
Date: Thu, 13 Nov 2003 19:44:13 -0500

>1. by admins lazy to set up higher number of hostnames od MX records
Lazy? What if you have an internal-root architecture, sitting behind 
proxy-style firewalls for *all* protocols (including SMTP) and you want 
to control your outgoing mail routes centrally via MX records 
(controlling mail routing is, after all, what MX records are for)? Short 
of adding a duplicate entry for 
*every*possible*Internet*mail*destination* to your internal DNS, you're 
pretty much committed to using wildcard MXes. It's a little presumptuous 
IMO to call that "lazy".

Oh sure, I know that plenty of folks with such network architectures 
plug *static* mail routes into every one of their internal mail server's 
configurations. But, think about it, isn't that conceptually like 
inserting a huge *root* wildcard MX record into every one of those 
boxes' brains? Given a choice, I'd prefer to use real-life wildcard MXes 
in DNS centrally, than have to be responsible for maintaining static 
routing configs -- pseudo-wildcard-MXes, if you will -- on hundreds of 
servers. But then, that's just me.

>wildcards in .com and .net zones:
So, yet again we have a proposal to address an 
administrative/organizational/political/social problem with a 
technological quick-fix, i.e. disallow wildcards altogether. Wildcards 
are a tool; like most tools, they can be misused or abused. Don't blame 
the tool: blame the people who misuse or abuse it. Those of us who use 
the tool wisely and carefully and productively don't appreciate your 
attempts to take away our functionality.

- Kevin