[DNSOP] Question regarding draft-ietf-dnsop-svcb-https-10 sections 4.1 and 6

2022-09-29 Thread Klaus Malorny
Hi all, I have a small question in respect to section 4.1 (DNS Server Behavior /Authoritative servers) and section 6 (SVCB-compatible). I have to admit that I do not yet fully understand the current draft (having neglected following the discussion on the draft in the past). So please forgive

Re: [DNSOP] status of the aname and svcb/httpsvc drafts

2020-02-21 Thread Klaus Malorny
On 21.02.20 14:44, Vladimír Čunát wrote: On 2/21/20 2:23 PM, Klaus Malorny wrote: My understanding of the plan is that for fallbacks we'll have what people are using now, e.g. that http redirect.  Perhaps you can elaborate on why that doesn't seem sufficient. Hi Vladimir, simply t

Re: [DNSOP] status of the aname and svcb/httpsvc drafts

2020-02-21 Thread Klaus Malorny
On 21.02.20 13:19, Dan York wrote: If HTTPSVC can do that, and browser vendors will implement it [1], then that use case can be satisfied. Dan Hi all, I have to admit that I haven't worked through the HTTPSSVC/SVCB draft in detail, but while it seems to provide much more functionality than

Re: [DNSOP] status of the aname and svcb/httpsvc drafts

2020-02-21 Thread Klaus Malorny
On 21.02.20 10:08, Benno Overeinder wrote: I am interested to learn what the problem is that the customer wants to solve. Quoting from the email from Evan Hunt in this thread: "CNAME at the apex wasn't really the problem. Getting browsers to display content from the right CDN server was the pro

Re: [DNSOP] status of the aname and svcb/httpsvc drafts

2020-02-20 Thread Klaus Malorny
Hi, thanks all for responding, this was very informative for me. The lack of interest for the ANAME draft is a bit pity. We have some customer requests in this direction and I was hoping to be able to offer them a standards compliant solution. So now I have to rethink our strategy. Regard

[DNSOP] status of the aname and svcb/httpsvc drafts

2020-02-18 Thread Klaus Malorny
Hi all, I asked myself about the status of the two drafts. I got the impression a little bit that the svcb/httpsvc draft successfully killed the aname draft, but is now dying slowly itself. It would be great if somebody could give me some insight whether the one or the other has still a meas

[DNSOP] question regarding draft-ietf-dnsop-aname: aname section & truncation

2019-05-31 Thread Klaus Malorny
Hi all, thanks for answering my recent questions so far, but I have to bother you with another (maybe stupid?) issue. I saw that for regular address queries, you moved the ANAME record from the "answer" section to the "additional" section in the -02 draft. I tried to figure out why, but di

[DNSOP] question regarding draft-ietf-dnsop-aname-03.txt/proof of non-existence of the ANAME record

2019-05-29 Thread Klaus Malorny
Hi all, while still struggling with the basic ANAME processing (as described in my other mail), I wondered whether with DNSSEC, an authoritative name server MAY, SHOULD or MUST prove the non-existence of an ANAME record when it receives an A or query and no sibling ANAME record exists

Re: [DNSOP] question regarding draft-ietf-dnsop-aname-03.txt/authoritative name server response

2019-05-29 Thread Klaus Malorny
On 28.05.19 21:14, Matthijs Mekking wrote: Hi Klaus, Hi Matthijs, I provided responses inline. I too. On 5/28/19 5:49 PM, Klaus Malorny wrote: Hi all, [...] For authoritative servers that receive A or requests, the address records shall appear only once: in the answer

[DNSOP] question regarding draft-ietf-dnsop-aname-03.txt/authoritative name server response

2019-05-28 Thread Klaus Malorny
Hi all, I am working on an experimental implementation of ANAMEs in our authoritative name server software, which shall perform its own ANAME lookup. I am a bit puzzled what is really expected to be returned for regular address (A/) queries. - Is it right that the determined target a

Re: [DNSOP] Multiplexing DNS & HTTP over TLS

2019-02-14 Thread Klaus Malorny
On 14.02.19 11:03, Shane Kerr wrote: Stephane, Is there a write-up on this? Thinking about it naively, a demultiplexer really only needs to say "is there a non-ASCII character in the first 2 or 3 bytes of a TLS session?". Hi, please think of HTTP/2, which is a binary protocol (althoug

Re: [DNSOP] TSIG - BADKEY error handling appears to be underspecified.

2018-09-17 Thread Klaus Malorny
On 17.09.18 02:27, Mark Andrews wrote: Actually having the clients time and fudge in those fields for BADKEY provides spoofing protection for the unsigned responses. This is especially important with opportunistic TSIG,which is what TSIG with a WKK will be, as there is no longer the presumption t

Re: [DNSOP] TSIG - BADKEY error handling appears to be underspecified.

2018-09-14 Thread Klaus Malorny
On 14.09.18 00:55, Mark Andrews wrote: I was testing TSIG with a well known key against TLD servers and got the following response. Once you get past the bad class field (reported to the operator) there were a number of other items: * the tsig name does not match the request. * the algorithm

Re: [DNSOP] Extended CNAME (ENAME)

2014-05-22 Thread Klaus Malorny
On 22.05.2014 03:18, Masataka Ohta wrote: Klaus Malorny wrote: Sure, but I am talking of about 5-20 variants per name, not all that are combinatorially possible. The idea is that the registrant simply decides which of the variants he wants to have included with his original name. Those

Re: [DNSOP] Extended CNAME (ENAME)

2014-05-21 Thread Klaus Malorny
On 21.05.2014 13:30, Masataka Ohta wrote: Klaus Malorny wrote: Sure, but I am talking of about 5-20 variants per name, not all that are combinatorially possible. I'm afraid you don't distinguish "name" and "label". Anyway, what if you encounter a label wit

Re: [DNSOP] Extended CNAME (ENAME)

2014-05-21 Thread Klaus Malorny
On 21.05.2014 12:08, Masataka Ohta wrote: Klaus Malorny wrote: please take into account that a CNAME + DNAME, the previously discussed BNAME or the now discussed ENAME solution is still interesting for domain name registries that have to deal with (maybe lots of) IDN variants. Scalability of

Re: [DNSOP] Extended CNAME (ENAME)

2014-05-21 Thread Klaus Malorny
On 21.05.2014 11:52, Ralf Weber wrote: Moin! Hi Ralf, Oh and then came DNAME for redirecting whole domain trees and that might have been a nice idea if I have a couple of domains and want them all to have the same data. But I do not know of Registries/Registrars that picked that up. Or is t

Re: [DNSOP] Extended CNAME (ENAME)

2014-05-21 Thread Klaus Malorny
On 21.05.2014 08:09, Mark Andrews wrote: What's wrong with: _http._tcp.example.net. SRV ... www.example.net. Nothing. Hi, please take into account that a CNAME + DNAME, the previously discussed BNAME or the now discussed ENAME solution is still interesting for domain name registr