Subject: [v6ops] new version of IPv6 rDNS for ISPs

From: "Lee Howard" <[email-masked]>
Date: Wed, 21 Nov 2012 10:02:58 -0500

You may remember this draft from a couple of years ago.  People keep asking
me what a residential ISP should do for IPv6 PTR records, and I keep
repeating what's in the draft.
The intent is to document existing solutions, since prepopulating PTRs like
we did in IPv4 doesn't work.  Last time I brought it to DNSOP, there was
interest, but not necessarily as a working group document.  Since it's been
a while, and the operator community is still asking for guidance, I've
updated it, and would like a renewed review of it as an individual
submission (unless this WG or dnsop wants it).

Filename:	 draft-howard-isp-ip6rdns
Revision:	 05
Title:		 Reverse DNS in IPv6 for Internet Service Providers
Creation date:	 2012-11-20
WG ID:		 Individual Submission
Number of pages: 13
URL:
http://www.ietf.org/internet-drafts/draft-howard-isp-ip6rdns-05.txt
Status:          http://datatracker.ietf.org/doc/draft-howard-isp-ip6rdns
Htmlized:        http://tools.ietf.org/html/draft-howard-isp-ip6rdns-05
Diff:
http://www.ietf.org/rfcdiff?url2=draft-howard-isp-ip6rdns-05

Abstract:
   In IPv4, Internet Service Providers (ISPs) commonly provide IN-
   ADDR.ARPA. information for their customers by prepopulating the zone
   with one PTR record for every available address.  This practice does
   not scale in IPv6.  This document analyzes different approaches for
   ISPs to manage the ip6.arpa zone for IPv6 address space assigned to
   many customers.

Thanks,

Lee

---

From: Philipp Kern <[email-masked]>
Date: Sat, 24 Nov 2012 12:34:02 +0100

Hi,

> submission (unless this WG or dnsop wants it).

couldn't we deprecate "Every Internet-reachable host should have a name" if the
benefits are questionable in the IPv6 realm?

Kind regards
Phliipp Kern

---

From: Gert Doering <[email-masked]>
Date: Sat, 24 Nov 2012 20:12:27 +0100

Hi,

> benefits are questionable in the IPv6 realm?

I'm not necessarily married to reverse DNS, but I *like* that paradigm,
"every Internet-reachable host should have a name, and a FQDN at that".

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

---

From: Ted Lemon <[email-masked]>
Date: Sat, 24 Nov 2012 23:39:14 +0000

> "every Internet-reachable host should have a name, and a FQDN at that".

Why?

---

From: joel jaeggli <[email-masked]>
Date: Sat, 24 Nov 2012 18:37:45 -0800

>> "every Internet-reachable host should have a name, and a FQDN at that".

what fqdn should a privacy address have?
>
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 25 Nov 2012 07:50:09 +0000

> what fqdn should a privacy address have?

Let's ask that question about any form of temporary address.

There are numerous strong arguments for using FQDNs whenever possible
for any purpose whatever; my hobby horse of renumbering is only one of
them. But if an address is truly temporary, those arguments tend to
fall away.

   Brian

---

From: Gert Doering <[email-masked]>
Date: Sun, 25 Nov 2012 11:47:39 +0100

Hi,

> > "every Internet-reachable host should have a name, and a FQDN at that".

I find it convenient to know who I'm talking to, or at least, where he's
coming from (like "chinatelecom.net" or "t-online.de").

The argument about privacy addresses has merits, of course, but then, I 
do not like privacy addresses very much either (I'm not saying that they
do not solve a valid issue, but I'm personally fine with a static IPv6
address for my client systems - trackability of mac-based EUI-64 could
have been solved differently, like "hashing in something unique per
attached-to network", but that's a wholly separate discussion).

Note that I didn't say "MUST have" or such.  I said I *like* it.

Gert Doering
        -- NetMaster

---

From: Philipp Kern <[email-masked]>
Date: Sun, 25 Nov 2012 11:58:40 +0100

Gert,

On Sun, 25 Nov 2012 11:47:39 +0100
Gert Doering <[email-masked]> wrote:
> I find it convenient to know who I'm talking to, or at least, where
> he's coming from (like "chinatelecom.net" or "t-online.de").

well, as a provider you know the source AS. As a server provider
we could solve that with CIDR lists? For after the fact matching like
access log processing that should be doable. Currently we also
have few enough /32 and PI /48 so that matching could be done on
the fly. But that's obviously not guaranteed to remain that way…

Kind regards
Philipp Kern

---

From: Gert Doering <[email-masked]>
Date: Sun, 25 Nov 2012 12:06:30 +0100

Hi,

On Sun, Nov 25, 2012 at 11:58:40AM +0100, Philipp Kern wrote:
> the fly. But that's obviously not guaranteed to remain that way???

Of course I can get the info with "whois" (or other tools) today, but none 
of my machines knows how to do that.  Reverse DNS is simple, and they know
how to query it - if someone's machine has its own name, it will give
it to me, and if the ISP only does generic rDNS, this is a statement of
its own...

Gert Doering
        -- NetMaster

---

From: Philipp Kern <[email-masked]>
Date: Sun, 25 Nov 2012 12:10:26 +0100

On Sun, 25 Nov 2012 12:06:30 +0100
Gert Doering <[email-masked]> wrote:
> Of course I can get the info with "whois" (or other tools) today, but
> none of my machines knows how to do that.  Reverse DNS is simple, and
> they know how to query it - if someone's machine has its own name, it
> will give it to me, and if the ISP only does generic rDNS, this is a
> statement of its own...

So what I was aiming at? Do we need a library for that? (Which would
certainly depend on the use cases where such a lookup would help.)

Kind regards
Philipp Kern

---

From: Gert Doering <[email-masked]>
Date: Sun, 25 Nov 2012 12:11:56 +0100

Hi,

> certainly depend on the use cases where such a lookup would help.)

Well, before going to solution space, we should agree that DNS is indeed
failing to get the job done.  I'm not convinced of that yet.

Gert Doering
        -- NetMaster

---

From: Mark Andrews <[email-masked]>
Date: Mon, 26 Nov 2012 00:36:33 +1100

> what fqdn should a privacy address have?

The reverse of a IPv6 address is a legal fully qualified hostname.

	R(address) PTR R(address)
	R(address) AAAA address

When a host generates a new privacy address it adds a AAAA and PTR
address pair for it.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: [email-masked]
Date: Sun, 25 Nov 2012 15:10:13 +0100 (CET)

> When a host generates a new privacy address it adds a AAAA and PTR

And the whole point of this exercise is just to ensure that the IPv6
address has forward and reverse entries - but which don't really
convey a lot of information...

As an ISP, my immediate reaction is no thank you - this is extra
complexity with no real benefits. I'd much rather spend my resources
working to get rid of those systems and ISPs that *require* working
DNS names for no good reason.

Steinar Haug, AS 2116

---

From: Ted Lemon <[email-masked]>
Date: Sun, 25 Nov 2012 14:15:47 +0000

> coming from (like "chinatelecom.net" or "t-online.de").

You may find it convenient, but you don't actually know.   You just have some information that someone you don't know put in the DNS.   The idea that this constitutes "knowing" in any meaningful sense is mistaken.   I get what you mean—the information is often (at least apparently) accurate, and is useful at times.   But I think it's important to recognize it for what it is, and that means not taking it as something that can result in "knowing" anything.

Also, your argument refers specifically to PTR records; my question was, why do we need A/AAAA records for all hosts that connect to the internets.   E.g., right now my laptop is an IPv4 and an IPv6 host.   The IPv4 host exists behind a NAT.   No A record refers to it, because that's not possible.   Yet from a functional standpoint it is a host connected to the Internet.

I would be the first to admit that my laptop's connection to the IPv4 internet is suboptimal.   But what specifically am I, or are you, missing out on because it doesn't have an A record?   It also doesn't have an AAAA record, because it's a pain to set up and I haven't bothered.   What am I missing out on because of this?   Is it just that you can't identify my laptop by name when it connects to your web server?

> When a host generates a new privacy address it adds a AAAA and PTR

Please, tell me what host you are talking about.   Are you speaking theoretically, or referring to a specific implementation?

---

From: Gert Doering <[email-masked]>
Date: Sun, 25 Nov 2012 17:36:45 +0100

Hi,

On Sun, Nov 25, 2012 at 02:15:47PM +0000, Ted Lemon wrote:
> I would be the first to admit that my laptop's connection to the IPv4 internet is suboptimal.   But what specifically am I, or are you, missing out on because it doesn't have an A record?   

Actually, the IPv4 address that shows up in my logs is quite likely to
have a PTR record, and for most ISPs that use generic reverse DNS names,
it will also have a matching A...

Gert Doering
        -- NetMaster

---

From: Mikael Abrahamsson <[email-masked]>
Date: Sun, 25 Nov 2012 18:54:27 +0100 (CET)

> it will also have a matching A...

Someone needs to put the functionality into all common dns servers to 
statelessly handle large zones of A and PTR, as in "in this /36, the 
forward/reverse format is <xxyyzz> if you don't have any other 
information".

I want to overload some WHOIS info into dns for spam filtering as well, 
such as "in this /44, all customers are /56 unless otherwise more 
specifically stated".

WHOIS doesn't really scale well for large number of lookups, DNS does, but 
for IPv6 we need some new operational practices (involving new code in the 
DNS servers). I don't know if an RFC is needed, but it would probably 
help.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Ted Lemon <[email-masked]>
Date: Sun, 25 Nov 2012 20:12:09 +0000

> it will also have a matching A...

True, but it's not the address of the host, because the host has no address.   Anyway, it seems that you are saying that the reason for the rule that hosts ought to have names is so that we can look them up.   IOW, there is no benefit to the person who has the host, unless they want you to be able to look them up.

---

From: Victor Kuarsingh <[email-masked]>
Date: Sun, 25 Nov 2012 15:58:56 -0500

On 2012-11-25 3:12 PM, "Ted Lemon" <[email-masked]> wrote:

>True, but it's not the address of the host, because the host has no
>address.   Anyway, it seems that you are saying that the reason for the
>rule that hosts ought to have names is so that we can look them up.
>IOW, there is no benefit to the person who has the host, unless they want
>you to be able to look them up.

In line with what Gert said, your host does often have a A/PTR for the NAT
address on your home gateway (assuming you are behind a gateway).  If you
are directly attached to a network (say a modem), then the ISP may often
generate a A/PTR of the assigned address.

Your "unnamed" host, according to many Internet hosts will have a name
associated with it (the one associated with the NAT or directly addressed
host).

I am not saying this is good/bad, just noting how it works in many places
today.

As for IPv6, I will be honest and say that I am drawn to the notation that
some continuity with what we had in IPv4 may be desired/needed.

I understand many argue against this, but can we guarantee that we don't
run into problems if we don't have this functionality for the future?
Perhaps we don't absolutely need it now, but can we say never?

I would say that there are some operational benefits of having this.  I
can say that resolving an address to a name can help in many regards
(operational focus).  Many times this information is know via various
network/system state entries (I.e. DHCP, routing tables etc).  But going
the long way to resolve something may not be very optimal. Having a way of
making this resolution quicker and more functional is a benefit in IMHO.

Regards,

Victor K

---

From: Ted Lemon <[email-masked]>
Date: Sun, 25 Nov 2012 21:10:57 +0000

To be clear, what I was asking is not "does somebody imagine a use for all hosts having names."   I can easily imagine this myself.   What I was asking was what specific use case Gert had in mind.   It seems pretty clear that you and he both have the same use case in mind: being able to acquire advisory, untrusted information that may or may not truthfully name a node with which you are exchanging packets.

---

From: Gert Doering <[email-masked]>
Date: Sun, 25 Nov 2012 22:40:49 +0100

Hi,

> True, but it's not the address of the host, because the host has no address.   Anyway, it seems that you are saying that the reason for the rule that hosts ought to have names is so that we can loo…

So what's the benefit to you, having a name?

Gert Doering
        -- NetMaster

---

From: Arturo Servin <[email-masked]>
Date: Sun, 25 Nov 2012 19:43:02 -0200

WEIRDS?

	It would be json and http. For some apps it may be easier than DNS.

Regards,
as

On 25/11/2012 09:06, Gert Doering wrote:
>> On Sun, 25 Nov 2012 11:47:39 +0100 Gert Doering <[email-masked]>
>> wrote:
>>> I find it convenient to know who I'm talking to, or at least,
>>> where he's coming from (like "chinatelecom.net" or
>>> "t-online.de").
>> 
>> we could solve that with CIDR lists? For after the fact matching
>> like access log processing that should be doable. Currently we
>> also have few enough /32 and PI /48 so that matching could be
>> done on the fly. But that's obviously not guaranteed to remain
>> that way???
> 
> Of course I can get the info with "whois" (or other tools) today,
> but none of my machines knows how to do that.  Reverse DNS is
> simple, and they know how to query it - if someone's machine has
> its own name, it will give it to me, and if the ISP only does
> generic rDNS, this is a statement of its own...
> 
> Gert Doering -- NetMaster
> 
> 
> 
> _______________________________________________ v6ops mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Arturo Servin <[email-masked]>
Date: Sun, 25 Nov 2012 19:48:48 -0200

The "problem" with WHOIS is not scalability. It is that it does not
contain information about single IP addresses. The granularity just goes
to some level of allocation from ISPs to other entities.

	Scalability may be improved by WEIRDS work, but containing more
granular information at IP level is much more complex.

Regards,
as

On 25/11/2012 15:54, Mikael Abrahamsson wrote:
>> have a PTR record, and for most ISPs that use generic reverse DNS
>> names, it will also have a matching A...
> 
> WHOIS doesn't really scale well for large number of lookups, DNS does,
> but for IPv6 we need some new operational practices (involving new code
> in the DNS servers). I don't know if an RFC is needed, but it would
> probably help.
>

---

From: Ted Lemon <[email-masked]>
Date: Sun, 25 Nov 2012 21:49:49 +0000

> So what's the benefit to you, having a name?

To my mind, the main benefit of having a name is that you want to be referred to.   So a host needs a name if other hosts will be contacting it at the direction of humans.   And, as you and Victor have suggested, it is also useful to have a name to call a host with which you are communicating, if a human is going to be thinking about the relationship between the two endpoints.

So there's a clear purpose to naming a device if we want it to be a web server, or a file server, or something like that, and there's a clear purpose to some kind of name if we want to be able to debug a connection.   But these purposes relate to what function the host is serving, and aren't innate qualities of the host.

---

From: Mikael Abrahamsson <[email-masked]>
Date: Mon, 26 Nov 2012 04:13:09 +0100 (CET)

On Sun, 25 Nov 2012, Arturo Servin wrote:

> 	The "problem" with WHOIS is not scalability. It is that it does 
> not contain information about single IP addresses. The granularity just 
> goes to some level of allocation from ISPs to other entities.

It depends on what problem you're trying to solve. If you want to convey 
"ip-w-x-y-z.isp.net", because people want to get an idea what ISP you're 
using, then you don't need individualism.