Subject: Migrating away from TXT records

From: Florian Weimer <[email-masked]>
Date: Thu, 11 Aug 2005 19:59:44 +0200

Someone apparently told the SPF folks that when you migrate away from
TXT records to a specifically-assigned record type, you have to
perform a check that records contain identical data when both types
are present.  In other words, if there is a domain name for which both
TXT records and new-type records are present, an implementation MUST
check if both records contain the same data, and it MUST signal a
error if this is not the case.

Unfortunately, this is not a very good idea.  As long as you only
query your local resolver, it is *not* possible to obtain a consistent
cut--which is necessary before you can perform such a consistency
check.  As a result, the check will fail sporadically, for example
when the records are updated, even if the update to both sets happens
in a single zone reload (or whatever means you use to publish DNS
records).

(It turns out that the SPF specification assumes in many places that
DNS inconsistencies are always permanent and never temporary, but this
peculiar approach to DNS probably doesn't concern this WG.)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 11 Aug 2005 22:14:30 +0200

Florian,
The originating bad idea was to start juggling with two RR types, one
well-known and one to be assigned.

I.e. it is a "system error" forcing people to create a new type
if the actual application does not gain by that.

Such gains have AFAIK not been demonstrated.

Probably the ill fate of "http://www.ietf.org/internet-drafts/draft-snell-dnsepd-02.txt"
in part depended on the fact that the authors did invent not less than TWO
new RR types without having them registered before the initial publication of the draft.
OTOH, IANA requires a draft to register so maybe they just got caught
in the DNS catch 22.

Therefore I stick to TXT, and I'm proud of it! :-)
(computers don't feel pain due to lack of esthetics)

Anders

---

From: "william(at)elan.net" <[email-masked]>
Date: Thu, 11 Aug 2005 14:54:58 -0700 (PDT)

Isn't it my understanding that caching server will carry data even
for data types that it does not know (in fact caching server does
not need to know about structure of most DNS RR)? If so I do not see
anything wrong with checking to make certain that both SPF RR and
TXT RR are the same. I note that there is an assumption being made that 
both SPF and TXT lookups will be done through same local dns resolver.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: David Blacka <[email-masked]>
Date: Thu, 11 Aug 2005 18:16:59 -0400

On Aug 11, 2005, at 5:54 PM, william(at)elan.net wrote:

> TXT RR are the same. I note that there is an assumption being made  
> that both SPF and TXT lookups will be done through same local dns  
> resolver.

Imagine: 1. query for example.com TXT.
          2. example.com TXT, NEWRR contents change.
          3. app queries for example.com TXT, example.com NEWRR

App will see TXT cached at time 1, NEWRR from time 3.

Also imagine: 1. app queries for example.com TXT, ttl = 300, NEWRR  
ttl = 600
               2. example.com TXT, NEWRR contents change.
               3. 400 seconds later, app queries for example.com TXT,  
NEWRR.

App will see changed TXT, cached NEWRR.

--
David Blacka    <[email-masked]>
Sr. Engineer    VeriSign Applied Research

---

From: Mark Andrews <[email-masked]>
Date: Fri, 12 Aug 2005 10:17:09 +1000

> peculiar approach to DNS probably doesn't concern this WG.)

	Why bother checking.  Just use the new one and be done with it.

	The code point has been assigned.  The vast majority of servers
	and clients will handle the new code point now even if the
	servers have to use TYPE99 initially.  It's not like SPF is
	hard to hand encode.

	Note there are already patches for various servers around.

	Mark
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Florian Weimer <[email-masked]>
Date: Fri, 12 Aug 2005 08:55:41 +0200

> both SPF and TXT lookups will be done through same local dns resolver.

Are you aware that caching works per record type (and class) and
domain name, not just per domain name?  This means that the two cached
versions expire at different times (or just one of them is cached in
the first place).  When a client which performs the consistency check
comes along, only one of the record types might be updated, leading to
a tempoary inconsistency after a zone update.

Or do you think the damage done by this is negligible compared to the
benefits?

---

From: Florian Weimer <[email-masked]>
Date: Fri, 12 Aug 2005 09:09:46 +0200

> 	Why bother checking.  Just use the new one and be done with it.

Yes, this is fine.

I raised the issue on this mailing list because the SPF folks claim
that they were forced to add the check after review by anonymous DNS
experts during the IETF standardization process.

---

From: "william(at)elan.net" <[email-masked]>
Date: Fri, 12 Aug 2005 01:05:30 -0700 (PDT)

Ok, I see where the problem is now.