> Wessels, Duane <mailto:dwess...@verisign.com> > Wednesday, March 11, 2015 6:19 AM > > > As Paul suggests, I'll attempt to redirect the conversation to dnsop. > > Does it make sense to define an Extended RCODE for additional signaling? > e.g. "REFUSED_BECAUSE_QTYPE_ANY"
no, because the problem is with existing clients, who only look for rcodes they understand. > > If you want to respond to ANY with NOTIMP/REFUSED, would you also > be willing to include an OPT RR in your response (when appropriate)? as i wrote in <http://www.circleid.com/posts/20120111_refusing_refused_for_sopa_pipa/>... > ... So I know that we send REFUSED in response to a query when we > don't like the client's IP address --- DNS servers do not even look at > the question before deciding whether to send REFUSED. On the client > side, if we hear a REFUSED we give up on that server and move on to > the next server --- which means we assume that it was the client's IP > address that the server is refusing, not the question we happened to > be asking at that moment. Microsoft Windows will actually > "de-preference" a name server if they hear too many REFUSED messages > from it --- so BIND is not the only DNS software that interprets > REFUSED in this way. What this boils down to is that REFUSED is all > about the relationship between the client and the server, and has > nothing to do with the particular question being asked. If SOPA or > PIPA becomes law with a requirement to signal REFUSED when someone > looks up an infringing or pirate domain name, then in the language of > DNS we will be saying "please stop asking this server any questions at > all." There is no signal in DNS that means "that's a bad question but > please feel free to ask other questions." we are, in this case, defining a protocol. our goal is to get the client to stop asking the ANY question. if we send is a signal that sounds right (REFUSED, for example) but merely has the effect of "go to next server" then we're losing. if we're serious about redefining ANY as a meta-query, then answering with RCODE=0/ANCOUNT=0 is correct. (as it would be for RD=0 queries against an RA=1 server.) but whatever we do, any new reaction to QTYPE=ANY has to ensure that the client gives up, and stops asking. -- Paul Vixie
_______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
