Subject: Proposed Resolution to LLMNR Issue 89: Failed lookups

From: Bernard Aboba <[email-masked]>
Date: Wed, 13 Jul 2005 19:02:30 -0700 (PDT)

The text of LLMNR Issue 89 is enclosed below.  This and other LLMNR
Issues are tracked on the LLMNR Issues Web site at:
http://www.drizzle.com/~aboba/DNSEXT/llmnrissues.html

The proposed resolution is as follows:

In Section 2, change:

" An LLMNR sender may send a request for any name. However, by
default, LLMNR requests SHOULD be sent only when one of the following
conditions are met:

[1] No manual or automatic DNS configuration has been
performed. If DNS server address(es) have been
configured, then LLMNR SHOULD NOT be used as the
primary name resolution mechanism, although it MAY
be used as a secondary name resolution mechanism.
For dual stack hosts configured with DNS server
address(es) for one protocol but not another,
this implies that DNS queries SHOULD be sent
over the protocol configured with a DNS
server, prior to sending LLMNR queries.

[2] DNS servers do not respond. For a dual stack
host, the host SHOULD attempt to reach
DNS servers over all protocols on which
DNS server address(es) are configured, prior
to use of LLMNR.

[3] DNS servers respond to a DNS query with RCODE=3
(Authoritative Name Error) or RCODE=0, and an empty
answer section."

To:

" An LLMNR sender may send a request for any name. However, by
default, LLMNR requests SHOULD be sent only when one of the
following conditions are met:

[1] No manual or automatic DNS configuration has been
performed. If DNS server address(es) have been
configured, then LLMNR SHOULD NOT be used as the
primary name resolution mechanism, although it MAY
be used as a secondary name resolution mechanism.
For dual stack hosts configured with DNS server
address(es) for one protocol but not another,
this implies that DNS queries SHOULD be sent
over the protocol configured with a DNS
server, prior to sending LLMNR queries.

[2] All attempts to resolve the name have failed after
exhausting the searchlist, either because DNS
servers did not respond, or because they responded
to DNS queries with RCODE=3 (Authoritative Name
Error) or RCODE=0, and an empty answer section.
A dual stack host SHOULD attempt to reach DNS
servers over all protocols on which DNS server
address(es) are configured, prior to use of LLMNR."

----------------------------------------------------------------------
Issue 89: Failed Lookups
Submitter: Stuart Cheshire
Submitter email address: [email-masked]
Date first submitted: May 25, 2005
Reference:
http://ops.ietf.org/lists/namedroppers/namedroppers.2005/msg00984.html
Document: LLMNR-40
Comment type: T
Priority: S
Section: Various
Rationale/Explanation of issue:

   An LLMNR sender may send a request for any name.  However, by
   default, LLMNR requests SHOULD be sent only when one of the following
   conditions are met:

   [3] DNS servers respond to a DNS query with RCODE=3
       (Authoritative Name Error) or RCODE=0, and an empty
       answer section.

This seems to imply that *every* single failed name lookup on a
LLMNR-enabled host has to suffer the full LLMNR timeout before returning
to the caller.

For example, when I look up "foo" today, the DNS resolver client rapidly
runs through my searchlist getting authoritative no-answer or NXDOMAIN
responses for each one. With LLMNR, *every* single one of those failed
lookups would have to wait a second or two for LLMNR to time out. What
used to take mere milliseconds could now take 5-10 seconds to complete.

[BA] Sending an LLMNR query after *every* single failed name lookup is not
required, and is undesirable for the reasons you state.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>