Subject: Re: [dnsext] Question on RFC 3225 - DO Bit and ANY

From: Mark Andrews <[email-masked]>
Date: Wed, 20 May 2009 16:56:21 +1000

Having 32 A records would break qmail based on the description.

Do we tell the world that you can't have 32 A addresses?

Having 18 AAAA records would break qmail based on the description.

Do we tell the world that you can't have 18 AAAA addresses?

Do we tell the world that you can't have more records than can fit
in 512 bytes?

There are lots of mail domains where a ANY query may cause the 512
byte limit to be broken without any DNSSEC records being returned.
Applications which DNS queries should expect that TCP fallback may
occur and that they need to supply buffers bigger than 512 bytes
when making DNS queries to account for that.

DO was designed so that queries where unknown records are not
expected (i.e. explict queries) didn't see the DNSSEC records.
Applications which make ANY queries *expect* to see unknown record
types in the answer section so there is no issue with sending them
in the answer section.

Note: you do not see DNSSEC records in the authority and additional
sections when you make a ANY query without DO being set.  If the
same query is made with DO set then you do see them in the authority
and additional sections.

Mark

;; Truncated, retrying in TCP mode.

; <<>> DiG 9.3.6-P1 <<>> any isc.org
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10531
;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:
;isc.org.			IN	ANY

;; ANSWER SECTION:
isc.org.		3099	IN	RRSIG	AAAA 5 2 43200 20090615233251 20090516233251 50082 isc.org. eU0U/TN7mYAb4aODz3yxEzoDCj7j2L/5VZeblI2VcBZRC1zAAsx0K+wU lUndou6O6UZyZ2QM6zazy8mEcKs+zCPmssbMIvDyHJ4j4e7lPaU4wKRo DyvjNled7N7Nly/SVKgDoj6fG/IM/BPjWa7l2oL3fRPWq2E+ShY54U9g GAs=
isc.org.		3099	IN	AAAA	2001:4f8:0:2::d
isc.org.		39099	IN	RRSIG	NS 5 2 43200 20090615233251 20090516233251 50082 isc.org. qG+qwfSP5jSrt+HbdoTTNIWkxyqKxy/sztz+CHvpBlywQY8G3cPO+icP TEmJFK5P8xTExsALqgWinufeUK/Mm1r/n3dWWzNN/eVwJcATDqz0yZGn 1vuqxGtdWRc/C6NVvCeeF+cxz/OKtT0GiQYRv/qJ5qUUMbbR6z9CGv0I p2g=
isc.org.		39099	IN	NS	ams.sns-pb.isc.org.
isc.org.		39099	IN	NS	sfba.sns-pb.isc.org.
isc.org.		39099	IN	NS	ns-ext.nrt1.isc.org.
isc.org.		39099	IN	NS	ord.sns-pb.isc.org.
isc.org.		3099	IN	RRSIG	DNSKEY 5 2 7200 20090613223111 20090514223111 12892 isc.org. f3gWhhuNs/hlYBJytXvSOmdMYbrw3syVAJ0yYqvToq09/pg53AWEnmdt l24NudXLWLiA57/CCrONRDrUCtX+K2dxkuSYF02Yua2zeELiIIQYEt8c 319hEbvbnqg1u1CJUOB/BCETkolstyQ1MOqBecvA+/UlXo3ZDRX064Hz Ha5RBDaFGUGsdWRZlmPQqizD6Gcug/NpkJBelz0hIuS2uWimwbgDtYhT gw2uDvMLBtsYzxUJot/GgNUwv4Ofa4kES3dvO8U9mahrjMNEFUK8khl+ WdBixijEbHs7jv0lTqrBS4xZQXVI85/07Us13iRw9J+ecFGQ5O8C/9dP TLCodA==
isc.org.		3099	IN	RRSIG	DNSKEY 5 2 7200 20090613223111 20090514223111 50082 isc.org. mCNeA0XseqHNaylvy6c7+6l61gAKZLLWBPWxPJb0aM2ffoIdKrmtwYej EjUOVVNvxU9A06IwG20I/khJzjmiu57nMsk/WfgJSOnOnTxqGOflu0ks y5YUhKPrTLdKUoeHJOLv2FE/dPS1U9Wy7b3VBbfx+4TtVGFqscwocXtu x1Q=
isc.org.		3099	IN	DNSKEY	257 3 5 BEAAAAOhHQDBrhQbtphgq2wQUpEQ5t4DtUHxoMVFu2hWLDMvoOMRXjGr hhCeFvAZih7yJHf8ZGfW6hd38hXG/xylYCO6Krpbdojwx8YMXLA5/kA+ u50WIL8ZR1R6KTbsYVMf/Qx5RiNbPClw+vT+U8eXEJmO20jIS1ULgqy3 47cBB1zMnnz/4LJpA0da9CbKj3A254T515sNIMcwsB8/2+2E63/zZrQz Bkj0BrN/9Bexjpiks3jRhZatEsXn3dTy47R09Uix5WcJt+xzqZ7+ysyL KOOedS39Z7SDmsn2eA0FKtQpwA6LXeG2w+jxmw3oA8lVUgEf/rzeC/bB yBNsO70aEFTd
isc.org.		3099	IN	DNSKEY	256 3 5 BEAAAAO1rOHZvkQ3rodVl3tbky5pkfCrBuctoc6k7LbppZwvTMRP78+7 q/WTKrJtgsmRFY6YS7C4+8DTQfKG4TXLFUZybyKyW/1EFnqkVPat/E7t R7Yh0Y8r1bXu9T2/zgJqiC4rPZC7LdrKfS+82xbFNaFp7wgV6nOm7zIU 7wcxzLV9Zw==

;; AUTHORITY SECTION:
isc.org.		39099	IN	NS	ord.sns-pb.isc.org.
isc.org.		39099	IN	NS	ns-ext.nrt1.isc.org.
isc.org.		39099	IN	NS	sfba.sns-pb.isc.org.
isc.org.		39099	IN	NS	ams.sns-pb.isc.org.

;; ADDITIONAL SECTION:
ams.sns-pb.isc.org.	39099	IN	A	199.6.1.30
ord.sns-pb.isc.org.	39099	IN	A	199.6.0.30
sfba.sns-pb.isc.org.	39099	IN	A	149.20.64.3
sfba.sns-pb.isc.org.	39095	IN	AAAA	2001:4f8:0:2::19

;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed May 20 16:42:34 2009
;; MSG SIZE  rcvd: 1495

; <<>> DiG 9.3.6-P1 <<>> any isc.org +dnssec
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9452
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 11, AUTHORITY: 5, ADDITIONAL: 7

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;isc.org.			IN	ANY

;; ANSWER SECTION:
isc.org.		2911	IN	RRSIG	AAAA 5 2 43200 20090615233251 20090516233251 50082 isc.org. eU0U/TN7mYAb4aODz3yxEzoDCj7j2L/5VZeblI2VcBZRC1zAAsx0K+wU lUndou6O6UZyZ2QM6zazy8mEcKs+zCPmssbMIvDyHJ4j4e7lPaU4wKRo DyvjNled7N7Nly/SVKgDoj6fG/IM/BPjWa7l2oL3fRPWq2E+ShY54U9g GAs=
isc.org.		2911	IN	AAAA	2001:4f8:0:2::d
isc.org.		38911	IN	RRSIG	NS 5 2 43200 20090615233251 20090516233251 50082 isc.org. qG+qwfSP5jSrt+HbdoTTNIWkxyqKxy/sztz+CHvpBlywQY8G3cPO+icP TEmJFK5P8xTExsALqgWinufeUK/Mm1r/n3dWWzNN/eVwJcATDqz0yZGn 1vuqxGtdWRc/C6NVvCeeF+cxz/OKtT0GiQYRv/qJ5qUUMbbR6z9CGv0I p2g=
isc.org.		38911	IN	NS	sfba.sns-pb.isc.org.
isc.org.		38911	IN	NS	ns-ext.nrt1.isc.org.
isc.org.		38911	IN	NS	ord.sns-pb.isc.org.
isc.org.		38911	IN	NS	ams.sns-pb.isc.org.
isc.org.		2911	IN	RRSIG	DNSKEY 5 2 7200 20090613223111 20090514223111 12892 isc.org. f3gWhhuNs/hlYBJytXvSOmdMYbrw3syVAJ0yYqvToq09/pg53AWEnmdt l24NudXLWLiA57/CCrONRDrUCtX+K2dxkuSYF02Yua2zeELiIIQYEt8c 319hEbvbnqg1u1CJUOB/BCETkolstyQ1MOqBecvA+/UlXo3ZDRX064Hz Ha5RBDaFGUGsdWRZlmPQqizD6Gcug/NpkJBelz0hIuS2uWimwbgDtYhT gw2uDvMLBtsYzxUJot/GgNUwv4Ofa4kES3dvO8U9mahrjMNEFUK8khl+ WdBixijEbHs7jv0lTqrBS4xZQXVI85/07Us13iRw9J+ecFGQ5O8C/9dP TLCodA==
isc.org.		2911	IN	RRSIG	DNSKEY 5 2 7200 20090613223111 20090514223111 50082 isc.org. mCNeA0XseqHNaylvy6c7+6l61gAKZLLWBPWxPJb0aM2ffoIdKrmtwYej EjUOVVNvxU9A06IwG20I/khJzjmiu57nMsk/WfgJSOnOnTxqGOflu0ks y5YUhKPrTLdKUoeHJOLv2FE/dPS1U9Wy7b3VBbfx+4TtVGFqscwocXtu x1Q=
isc.org.		2911	IN	DNSKEY	256 3 5 BEAAAAO1rOHZvkQ3rodVl3tbky5pkfCrBuctoc6k7LbppZwvTMRP78+7 q/WTKrJtgsmRFY6YS7C4+8DTQfKG4TXLFUZybyKyW/1EFnqkVPat/E7t R7Yh0Y8r1bXu9T2/zgJqiC4rPZC7LdrKfS+82xbFNaFp7wgV6nOm7zIU 7wcxzLV9Zw==
isc.org.		2911	IN	DNSKEY	257 3 5 BEAAAAOhHQDBrhQbtphgq2wQUpEQ5t4DtUHxoMVFu2hWLDMvoOMRXjGr hhCeFvAZih7yJHf8ZGfW6hd38hXG/xylYCO6Krpbdojwx8YMXLA5/kA+ u50WIL8ZR1R6KTbsYVMf/Qx5RiNbPClw+vT+U8eXEJmO20jIS1ULgqy3 47cBB1zMnnz/4LJpA0da9CbKj3A254T515sNIMcwsB8/2+2E63/zZrQz Bkj0BrN/9Bexjpiks3jRhZatEsXn3dTy47R09Uix5WcJt+xzqZ7+ysyL KOOedS39Z7SDmsn2eA0FKtQpwA6LXeG2w+jxmw3oA8lVUgEf/rzeC/bB yBNsO70aEFTd

;; AUTHORITY SECTION:
isc.org.		38911	IN	NS	sfba.sns-pb.isc.org.
isc.org.		38911	IN	NS	ams.sns-pb.isc.org.
isc.org.		38911	IN	NS	ord.sns-pb.isc.org.
isc.org.		38911	IN	NS	ns-ext.nrt1.isc.org.
isc.org.		38911	IN	RRSIG	NS 5 2 43200 20090615233251 20090516233251 50082 isc.org. qG+qwfSP5jSrt+HbdoTTNIWkxyqKxy/sztz+CHvpBlywQY8G3cPO+icP TEmJFK5P8xTExsALqgWinufeUK/Mm1r/n3dWWzNN/eVwJcATDqz0yZGn 1vuqxGtdWRc/C6NVvCeeF+cxz/OKtT0GiQYRv/qJ5qUUMbbR6z9CGv0I p2g=

;; ADDITIONAL SECTION:
ams.sns-pb.isc.org.	38911	IN	A	199.6.1.30
ord.sns-pb.isc.org.	38911	IN	A	199.6.0.30
sfba.sns-pb.isc.org.	38911	IN	A	149.20.64.3
sfba.sns-pb.isc.org.	38907	IN	AAAA	2001:4f8:0:2::19
ams.sns-pb.isc.org.	38911	IN	RRSIG	A 5 4 43200 20090615233251 20090516233251 50082 isc.org. IXd3ElWsnuwhxwuapFvpafIB+64FZA8PTufI82yPMco+D16vMnsq1SbQ sWlgYJRrZ54QLhmHt8NM0PN8yzz9h/4Z/j0pEuSN3H26eADFWma2f8k9 wMvEL99x6od2FAj5pRH4nGZ2aZuF/PS4Xxp4srSJlpogANO0FnmtwY1M aJM=
ord.sns-pb.isc.org.	38911	IN	RRSIG	A 5 4 43200 20090615233251 20090516233251 50082 isc.org. T0HoavEjKsZe5qZ0LT7GHlTZsu9OTWkpkS00MxAyy8D6nCGvbaUsksf0 WmiePWvQonRivxfhxkcR/wje7K01mKPeF4VUCk7iZobf3JPeY0YjGSLb RN4Yg1yMy1741mFYu6BbhgpigysacVlveUSIfVVtExF+RfRlQwVLzoeg +F4=

;; Query time: 3 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed May 20 16:45:42 2009
;; MSG SIZE  rcvd: 2007

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>