Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-12-16 Thread Doug Barton
On 12/16/2013 03:26 PM, Mark Andrews wrote: In message <52acf0ee.3040...@redbarn.org>, Paul Vixie writes: this is true. and i am a strong opponent of mixed-mode (recursive plus authoritative) servers, and i believe these are deprecated in later DNS RFC's, and in any case not even BIND 10 will

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-12-16 Thread Paul Vixie
Mark Andrews wrote: > In message <52acf0ee.3040...@redbarn.org>, Paul Vixie writes: >> this is true. and i am a strong opponent of mixed-mode (recursive plus >> authoritative) servers, ... > > I don't care about mixed-mode for a nominally recursive server. > > If you are a *listed* authoritativ

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-12-16 Thread Mark Andrews
In message <52acf0ee.3040...@redbarn.org>, Paul Vixie writes: > > this is true. and i am a strong opponent of mixed-mode (recursive plus > authoritative) servers, and i believe these are deprecated in later DNS > RFC's, and in any case not even BIND 10 will have that feature mix -- > but RFC 1034

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-12-16 Thread Tony Finch
Paul Vixie wrote: > Robert Edmonds wrote: > > i'm curious as to exactly what this root zone slaved resolver > > configuration looks like and how it would behave. [...] > > > if i understand things right, this config could only be achieved with > > particular resolver implementations that combine a

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-12-14 Thread Paul Vixie
Robert Edmonds wrote: > i'm curious as to exactly what this root zone slaved resolver > configuration looks like and how it would behave. i don't believe i've > ever set up a resolver like that before. in BIND, you just make yourself a secondary server for ".", pulling from 192.5.5.241 (f-root

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-28 Thread Robert Edmonds
Mark Andrews wrote: > In message <20131128000148.ga20...@mycre.ws>, Robert Edmonds writes: > > i'm curious as to exactly what this root zone slaved resolver > > configuration looks like and how it would behave. i don't believe i've > > ever set up a resolver like that before. > > zone "." IN {

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-27 Thread Mark Andrews
In message <20131128000148.ga20...@mycre.ws>, Robert Edmonds writes: > David Conrad wrote: > > Ed, > > > > On Nov 27, 2013, at 6:00 AM, Edward Lewis wrote: > > > My excuse is - operators limit "the effort expended in fighting > > > entropy." Imagine an average operations environment operating a

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-27 Thread Robert Edmonds
David Conrad wrote: > Ed, > > On Nov 27, 2013, at 6:00 AM, Edward Lewis wrote: > > My excuse is - operators limit "the effort expended in fighting entropy." > > Imagine an average operations environment operating as most environments go. > > ... > > Eventually one day something breaks and then.

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-27 Thread David Conrad
Ed, On Nov 27, 2013, at 6:00 AM, Edward Lewis wrote: > My excuse is - operators limit "the effort expended in fighting entropy." > Imagine an average operations environment operating as most environments go. > ... > Eventually one day something breaks and then... ...include here "the > on

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-27 Thread Edward Lewis
My excuse is - operators limit "the effort expended in fighting entropy." Imagine an average operations environment operating as most environments go. One admin comes in a decides they can do a better job. And the admin does, stellar talent. Then the said stellar admin decides to move on care

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-27 Thread SM
Hi Damian, At 18:17 26-11-2013, Damian Menscher wrote: Back to solving the problem of traffic at the roots, I've always been curious why recursive resolvers don't just AXFR the root zone file and cache the list of TLDs. Yes, From some RFC: "Root servers SHOULD NOT answer AXFR, or other zon

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-26 Thread Joe Abley
On Tuesday 26 November 2013 at 21:17, Damian Menscher wrote: > Back to solving the problem of traffic at the roots, I've always been curious > why recursive resolvers don't just AXFR the root zone file and cache the list > of TLDs. Yes, a new TLD might go unnoticed for the duration of your cache,

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-26 Thread Doug Barton
On 11/26/2013 01:06 PM, Andrew Sullivan wrote: On Tue, Nov 26, 2013 at 08:58:18PM +, Jim Reid wrote: +1. However the lookups I was talking about are not going to name servers that google owns or have agreed to receive that traffic. I'm not sure it's entirely true that, if you've decided

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-26 Thread Andrew Sullivan
On Tue, Nov 26, 2013 at 08:58:18PM +, Jim Reid wrote: > +1. However the lookups I was talking about are not going to name servers > that google owns or have agreed to receive that traffic. > I'm not sure it's entirely true that, if you've decided to operate a root name server, you haven't ag

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-26 Thread Jim Reid
On 26 Nov 2013, at 20:22, Vernon Schryver wrote: > If those diagnoses are correct that the probes are for subdomains of > the local hosts's domain I'll be charitable. If these diagnoses are correct they fail to tell the full story. It's not possible to predict what the code does unless someone

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-26 Thread Jim Reid
On 26 Nov 2013, at 19:23, Vernon Schryver wrote: > If the probing test requests are for domains that Google owns or has > permission for junk queries, then no one outside Google has standing > to complain. +1. However the lookups I was talking about are not going to name servers that google own

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-26 Thread Vernon Schryver
> From: Rubens Kuhl > Yeap, in the source code. Some discussions on those: > http://productforums.google.com/forum/#!topic/chrome/dQ92XhrDjfk > https://code.google.com/p/chromium/issues/detail?id=47262 > http://serverfault.com/questions/235307/unusual-head-requests-to-nonsense-urls-from-chrome >

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-26 Thread Rubens Kuhl
> > Is whatever Google doing documented somewhere? I didn't see anything > with https://www.google.com/search?q=chromium+nxdomain+detection+dns > and one or two similar searches. Yeap, in the source code. Some discussions on those: http://productforums.google.com/forum/#!topic/chrome/dQ92XhrDj

Re: [dns-operations] chrome's 10 character QNAMEs to detect NXDOMAIN rewriting

2013-11-26 Thread Vernon Schryver
> From: Jim Reid > This is definitely not a nice trick. It generates hundreds of millions > of queries to the root servers every day that don't need to go there. The devil is in the details. If the probing test requests are for domains that Google owns or has permission for junk queries, then n