Subject: LLMNR Issue 96: LLMNR Usage

From: Bernard Aboba <[email-masked]>
Date: Tue, 23 Aug 2005 16:55:31 -0700 (PDT)

The text of LLMNR Issue 96 is enclosed below.  

The proposed resolution is as follows:

In section 2, change:

"  An LLMNR sender may send a request for any name.  However, by
   default, LLMNR requests SHOULD be sent only when one of the following
   conditions are met:

   [1] No manual or automatic DNS configuration has been performed.
       If DNS server address(es) have been configured, then LLMNR
       SHOULD NOT be used as the primary name resolution mechanism,
       although it MAY be used as a secondary name resolution
       mechanism.  For dual stack hosts configured with DNS server
       address(es) for one protocol but not another, this implies
       that DNS queries SHOULD be sent over the protocol configured
       with a DNS server, prior to sending LLMNR queries.

   [2] All attempts to resolve the name via DNS on all interfaces
       have failed after exhausting the searchlist.  This can occur
       because DNS servers did not respond, or because they
       responded to DNS queries with RCODE=3 (Authoritative Name
       Error) or RCODE=0, and an empty answer section.  A dual
       stack host SHOULD attempt to reach DNS servers over all
       protocols on which DNS server address(es) are configured,
       prior to use of LLMNR."
To:

"An LLMNR sender MAY send a request for any name.  By default, 
LLMNR requests SHOULD NOT be sent unless one of the following
conditions are met:

[1] No manual or automatic DNS configuration has been performed.
If DNS server address(es) have been configured, then LLMNR
SHOULD NOT be used as the primary name resolution mechanism,
although it MAY be used as a secondary name resolution
mechanism. A dual stack host SHOULD attempt to reach DNS
servers over all protocols on which DNS server address(es) are
configured, prior to sending LLMNR queries. For dual stack
hosts configured with DNS server address(es) for one protocol 
but not another, this implies that DNS queries SHOULD be sent 
over the protocol configured with a DNS server, prior to 
sending LLMNR queries.

[2] All attempts to resolve the name via DNS on all interfaces
have failed after exhausting the searchlist. This can occur
because DNS servers did not respond, or because they
responded to DNS queries with RCODE=3 (Authoritative Name
Error) or RCODE=0, and an empty answer section. Where a single 
call to the resolver generates DNS queries for A and AAAA RRs,
an implementation MAY choose not to send LLMNR queries
if any of the DNS queries is successful. An LLMNR
query SHOULD only be sent for the originally requested name; 
the DNS searchlist is not used to form additional LLMNR queries." 

---------------------------------------------------------------------------
Issue 96: LLMNR Usage
Submitter: Yi Zhao
Submitter email address: [email-masked]
Date first submitted: August 11, 2005
Reference: 
Document: LLMNR-42
Comment type: T
Priority: S
Section: Various
Rationale/Explanation of issue:

In the case that a DNS query fails to produce an answer as described in 
Section 2, does LLMNR use the searchlist to compose its own set of queries 
or does it just send a query for the originally requested name?

Is it always the case that an LLMNR query should be sent when a DNS query 
returns rcode 0 and no RRs in the answer section or rcode 3? For example, 
if separate IPv4 and IPv6 DNS queries are sent for the same name, then 
very frequently an A RR will be present, but a AAAA RR will not be 
(RCODE=0, no RRs in the answer section). Do we have to send an LLMNR query 
in this situation? 

What if RRs are returned in the authority or additional sections? 

[BA]  Section 2 of LLMNR-42 states:

   [2] All attempts to resolve the name via DNS on all interfaces
       have failed after exhausting the searchlist.  This can occur
       because DNS servers did not respond, or because they
       responded to DNS queries with RCODE=3 (Authoritative Name
       Error) or RCODE=0, and an empty answer section.  A dual
       stack host SHOULD attempt to reach DNS servers over all
       protocols on which DNS server address(es) are configured,
       prior to use of LLMNR.

As a result, LLMNR will only be used once DNS has exhausted the
searchlist.  Since the DNS searchlist does not apply to LLMNR, 
LLMNR should only send a query for the originally
requested name;  the searchlist is not used to form additional LLMNR 
queries. 

When are LLMNR queries sent? 

LLMNR-42 Section 2 states:

   An LLMNR sender may send a request for any name.  However, by
   default, LLMNR requests SHOULD be sent only when one of the following
   conditions are met:

   [1] No manual or automatic DNS configuration has been performed.
       If DNS server address(es) have been configured, then LLMNR
       SHOULD NOT be used as the primary name resolution mechanism,
       although it MAY be used as a secondary name resolution
       mechanism.  For dual stack hosts configured with DNS server
       address(es) for one protocol but not another, this implies
       that DNS queries SHOULD be sent over the protocol configured
       with a DNS server, prior to sending LLMNR queries.

   [2] All attempts to resolve the name via DNS on all interfaces
       have failed after exhausting the searchlist.  This can occur
       because DNS servers did not respond, or because they
       responded to DNS queries with RCODE=3 (Authoritative Name
       Error) or RCODE=0, and an empty answer section.  A dual
       stack host SHOULD attempt to reach DNS servers over all
       protocols on which DNS server address(es) are configured,
       prior to use of LLMNR.

The implication here is that either condition [1] or [2] needs to
be met to send an LLMNR query. However, this does not imply that an
LLMNR query SHOULD be sent if either condition applies. 

In the case where the intent is to obtain an A or AAAA RR, but not
necessarily both, it is not necessary to send an LLMNR query if
either the A or AAAA RR query succeeds. 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>