draft-ietf-dnsop-as112-dname-06.txt   rfc7535.txt 
Network Working Group J. Abley Internet Engineering Task Force (IETF) J. Abley
Internet-Draft Dyn, Inc. Request for Comments: 7535 Dyn, Inc.
Intended status: Informational B. Dickson Category: Informational B. Dickson
Expires: May 28, 2015 Twitter, Inc. ISSN: 2070-1721 Twitter, Inc.
W. Kumari W. Kumari
Google Google
G. Michaelson G. Michaelson
APNIC APNIC
November 24, 2014 May 2015
AS112 Redirection using DNAME AS112 Redirection Using DNAME
draft-ietf-dnsop-as112-dname-06
Abstract Abstract
AS112 provides a mechanism for handling reverse lookups on IP AS112 provides a mechanism for handling reverse lookups on IP
addresses that are not unique (e.g., RFC 1918 addresses). This addresses that are not unique (e.g., RFC 1918 addresses). This
document describes modifications to the deployment and use of AS112 document describes modifications to the deployment and use of AS112
infrastructure that will allow zones to be added and dropped much infrastructure that will allow zones to be added and dropped much
more easily, using DNAME resource records. more easily, using DNAME resource records.
This approach makes it possible for any DNS zone administrator to This approach makes it possible for any DNS zone administrator to
sink traffic relating to parts of the global DNS namespace under sink traffic relating to parts of the global DNS namespace under
their control to the AS112 infrastructure without coordination with their control to the AS112 infrastructure without coordination with
the operators of AS112 infrastructure. the operators of AS112 infrastructure.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This document is not an Internet Standards Track specification; it is
provisions of BCP 78 and BCP 79. published for informational purposes.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months This document is a product of the Internet Engineering Task Force
and may be updated, replaced, or obsoleted by other documents at any (IETF). It represents the consensus of the IETF community. It has
time. It is inappropriate to use Internet-Drafts as reference received public review and has been approved for publication by the
material or to cite them other than as "work in progress." Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are a candidate for any level of Internet
Standard; see Section 2 of RFC 5741.
This Internet-Draft will expire on May 28, 2015. Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7535.
Copyright Notice Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction ....................................................3
2. Design Overview . . . . . . . . . . . . . . . . . . . . . . . 4 2. Design Overview .................................................4
3. AS112 Operations . . . . . . . . . . . . . . . . . . . . . . 4 3. AS112 Operations ................................................5
3.1. Extensions to Support DNAME Redirection . . . . . . . . . 4 3.1. Extensions to Support DNAME Redirection ....................5
3.2. Redirection of Query Traffic to AS112 Servers . . . . . . 5 3.2. Redirection of Query Traffic to AS112 Servers ..............5
4. Continuity of AS112 Operations . . . . . . . . . . . . . . . 5 4. Continuity of AS112 Operations ..................................6
5. Candidate Zones for AS112 Redirection . . . . . . . . . . . . 6 5. Candidate Zones for AS112 Redirection ...........................6
6. DNAME Deployment Considerations . . . . . . . . . . . . . . . 6 6. DNAME Deployment Considerations .................................7
7. IAB Statement Regarding this .ARPA Request . . . . . . . . . 7 7. IAB Statement Regarding This .ARPA Request ......................8
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 8. IANA Considerations .............................................8
8.1. Address Assignment . . . . . . . . . . . . . . . . . . . 7 8.1. Address Assignment .........................................8
8.2. Hosting of AS112.ARPA . . . . . . . . . . . . . . . . . . 9 8.2. Hosting of AS112.ARPA .....................................10
8.3. Delegation of AS112.ARPA . . . . . . . . . . . . . . . . 10 8.3. Delegation of AS112.ARPA ..................................10
9. Security Considerations . . . . . . . . . . . . . . . . . . . 10 9. Security Considerations ........................................10
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10 10. References ....................................................11
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 11 10.1. Normative References .....................................11
11.1. Normative References . . . . . . . . . . . . . . . . . . 11 10.2. Informative References ...................................11
11.2. Informative References . . . . . . . . . . . . . . . . . 11 Appendix A. Assessing Support for DNAME in the Real World .........13
Appendix A. Assessing Support for DNAME in the Real World . . . 12 A.1. Methodology ................................................13
A.1. Methodology . . . . . . . . . . . . . . . . . . . . . . . 12 A.2. Results ....................................................15
A.2. Results . . . . . . . . . . . . . . . . . . . . . . . . . 14 Acknowledgements ..................................................16
Appendix B. Editorial Notes . . . . . . . . . . . . . . . . . . 14 Authors' Addresses ................................................16
B.1. Change History . . . . . . . . . . . . . . . . . . . . . 14
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 15
1. Introduction 1. Introduction
Many sites connected to the Internet make use of IPv4 addresses that Many sites connected to the Internet make use of IPv4 addresses that
are not globally unique. Examples are the addresses designated in are not globally unique. Examples are the addresses designated in
[RFC1918] for private use within individual sites. [RFC1918] for private use within individual sites.
Devices in such environments may occasionally originate Domain Name Devices in such environments may occasionally originate Domain Name
System (DNS) queries (so-called "reverse lookups") corresponding to System (DNS) queries (so-called "reverse lookups") corresponding to
those private-use addresses. Since the addresses concerned have only those private-use addresses. Since the addresses concerned have only
skipping to change at page 3, line 28 skipping to change at page 3, line 34
the IN-ADDR.ARPA authoritative servers. The AS112 project is named the IN-ADDR.ARPA authoritative servers. The AS112 project is named
after the Autonomous System Number (ASN) that was assigned to it. after the Autonomous System Number (ASN) that was assigned to it.
Prior to implementation of this technique, the AS112 project did not Prior to implementation of this technique, the AS112 project did not
accommodate the addition and removal of DNS zones elegantly. Since accommodate the addition and removal of DNS zones elegantly. Since
additional zones of definitively local significance are known to additional zones of definitively local significance are known to
exist, this presents a problem. This document describes exist, this presents a problem. This document describes
modifications to the deployment and use of AS112 infrastructure that modifications to the deployment and use of AS112 infrastructure that
will allow zones to be added and dropped much more easily. will allow zones to be added and dropped much more easily.
The AS112 project is described in detail in The AS112 project is described in detail in [RFC7534].
[I-D.ietf-dnsop-rfc6304bis].
The AS112 nameservers (PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and The AS112 nameservers (PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG, and
BLACKHOLE-2.IANA.ORG) are required to answer authoritatively for each BLACKHOLE-2.IANA.ORG) are required to answer authoritatively for each
and every zone that is delegated to them. If a zone is delegated to and every zone that is delegated to them. If a zone is delegated to
AS112 nameservers without those nameservers being configured ahead of AS112 nameservers without those nameservers being configured ahead of
time to answer authoritatively for that zone, there is a detrimental time to answer authoritatively for that zone, there is a detrimental
impact on clients following referrals for queries within that zone. impact on clients following referrals for queries within that zone.
This misconfiguration is colloquially known as a "lame delegation". This misconfiguration is colloquially known as a "lame delegation".
AS112 nameserver operators are only loosely-coordinated, and hence AS112 nameserver operators are only loosely coordinated, and hence
adding support for a new zone (or, correspondingly, removing support adding support for a new zone (or, correspondingly, removing support
for a zone that is no longer delegated to the AS112 nameservers) is for a zone that is no longer delegated to the AS112 nameservers) is
difficult to accomplish with accuracy. Testing AS112 nameservers difficult to accomplish with accuracy. Testing AS112 nameservers
remotely to see whether they are configured to answer authoritatively remotely to see whether they are configured to answer authoritatively
for a particular zone is similarly challenging since AS112 nodes are for a particular zone is similarly challenging, since AS112 nodes are
distributed using anycast [RFC4786]. distributed using anycast [RFC4786].
This document defines a more flexible approach for sinking queries on This document defines a more flexible approach for sinking queries on
AS112 infrastructure that can be deployed alongside unmodified, AS112 infrastructure that can be deployed alongside unmodified,
existing AS112 nodes. Instead of delegating additional zones existing AS112 nodes. Instead of delegating additional zones
directly to AS112 nameservers, DNAME [RFC6672] redirection is used. directly to AS112 nameservers, DNAME [RFC6672] redirection is used.
This approach has the advantage that query traffic for arbitrary This approach has the advantage that query traffic for arbitrary
parts of the namespace can be directed to AS112 servers without those parts of the namespace can be directed to AS112 servers without those
servers having to be reconfigured every time a zone is added or servers having to be reconfigured every time a zone is added or
removed. removed.
This approach makes it possible for any DNS zone administrator to This approach makes it possible for any DNS zone administrator to
sink traffic relating to parts of the global DNS namespace under sink traffic relating to parts of the global DNS namespace under
their control to the AS112 infrastructure without coordination with their control to the AS112 infrastructure without coordination with
the operators of AS112 infrastructure. the operators of AS112 infrastructure.
2. Design Overview 2. Design Overview
A new zone, EMPTY.AS112.ARPA, is delegated to a single nameserver A new zone, EMPTY.AS112.ARPA, is delegated to a single nameserver
BLACKHOLE.AS112.ARPA (IPv4 address TBAv4-1, IPv6 address TBAv6-1). BLACKHOLE.AS112.ARPA (IPv4 address 192.31.196.1, IPv6 address
2001:4:112::1).
The IPv4 address TBAv4-1 has been assigned by the IANA such that the The IPv4 address 192.31.196.1 has been selected from the prefix
address is coverable by a single IPv4 /24 prefix, and that no other assigned by the IANA such that the address is coverable by a single
address covered by that prefix is in use. The IPv6 address TBAv6-1 IPv4 /24 prefix, and that no other address covered by that prefix is
has been similarly assigned such that no other address within a in use. The IPv6 address 2001:4:112::1 has been similarly assigned
covering /48 is in use. This addressing plan accommodates the such that no other address within a covering /48 is in use. This
anycast distribution of the BLACKHOLE.AS112.ARPA service using a addressing plan accommodates the anycast distribution of the
single IPv4 service prefix and a single IPv6 service prefix. See BLACKHOLE.AS112.ARPA service using a single IPv4 service prefix and a
[RFC4786] for more discussion of anycast service distribution; see single IPv6 service prefix. See [RFC4786] for more discussion of
Section 8 for the specific requests this document makes of the IANA. anycast service distribution; see Section 8 for the specific actions
completed by IANA per this document.
Some or all of the existing AS112 nodes SHOULD be extended to support Some or all of the existing AS112 nodes should be extended to support
these new nameserver addresses, and to host the EMPTY.AS112.ARPA these new nameserver addresses and to host the EMPTY.AS112.ARPA zone.
zone. See [I-D.ietf-dnsop-rfc6304bis] for revised guidance to AS112 See [RFC7534] for revised guidance to AS112 server operators.
server operators.
Each part of the DNS namespace for which it is desirable to sink Each part of the DNS namespace for which it is desirable to sink
queries at AS112 nameservers should be redirected to the queries at AS112 nameservers should be redirected to the
EMPTY.AS112.ARPA zone using DNAME [RFC6672]. See Section 3.2 for EMPTY.AS112.ARPA zone using DNAME [RFC6672]. See Section 3.2 for
guidance to zone administrators. guidance to zone administrators.
3. AS112 Operations 3. AS112 Operations
3.1. Extensions to Support DNAME Redirection 3.1. Extensions to Support DNAME Redirection
Guidance to operators of AS112 nodes is extended to include Guidance to operators of AS112 nodes is extended to include
configuration of the TBAv4-1, and TBAv6-1 addresses, and the configuration of the 192.31.196.1 and 2001:4:112::1 addresses, and
corresponding announcement of covering routes for those addresses, the corresponding announcement of covering routes for those
and to host the EMPTY.AS112.ARPA zone. addresses, and to host the EMPTY.AS112.ARPA zone.
IPv4-only AS112 nodes should only configure the TBAv4-1 nameserver IPv4-only AS112 nodes should only configure the 192.31.196.1
address; IPv6-only AS112 nodes should only configure the TBAv6-1 nameserver address; IPv6-only AS112 nodes should only configure the
nameserver address. 2001:4:112::1 nameserver address.
It is only necessary for a single AS112 server operator to implement It is only necessary for a single AS112 server operator to implement
these extensions for this mechanism to function as intended. It is these extensions for this mechanism to function as intended. It is
beneficial if many more than one AS112 server operators make these beneficial if many more than one AS112 server operator makes these
changes, however, since that provides for greater distribution and changes, however, since that provides for greater distribution and
capacity for the nameservers serving the EMPTY.AS112.ARPA zone. It capacity for the nameservers serving the EMPTY.AS112.ARPA zone. It
is not necessary for all AS112 server operators to make these changes is not necessary for all AS112 server operators to make these changes
for the mechanism to be viable. for the mechanism to be viable.
Detailed instructions for the implementation of these extensions is Detailed instructions for the implementation of these extensions are
included in [I-D.ietf-dnsop-rfc6304bis]. included in [RFC7534].
3.2. Redirection of Query Traffic to AS112 Servers 3.2. Redirection of Query Traffic to AS112 Servers
Once the EMPTY.AS112.ARPA zone has been deployed using the Once the EMPTY.AS112.ARPA zone has been deployed using the
nameservers described in Section 3.1, redirections may be installed nameservers described in Section 3.1, redirections may be installed
in the DNS namespace for queries that are intended to be answered by in the DNS namespace for queries that are intended to be answered by
the AS112 infrastructure. the AS112 infrastructure.
For example, reverse queries corresponding to TEST-NET-1 For example, reverse queries corresponding to TEST-NET-1
(192.0.2.0/24) [RFC5737] could be redirected to AS112 nameservers by (192.0.2.0/24) [RFC5737] could be redirected to AS112 nameservers by
skipping to change at page 5, line 48 skipping to change at page 6, line 15
additional redirections. A list of possible candidates for AS112 additional redirections. A list of possible candidates for AS112
redirection can be found in Section 5. redirection can be found in Section 5.
DNAME resource records deployed for this purpose can be signed with DNAME resource records deployed for this purpose can be signed with
DNSSEC [RFC4033], providing a secure means of authenticating the DNSSEC [RFC4033], providing a secure means of authenticating the
legitimacy of each redirection. legitimacy of each redirection.
4. Continuity of AS112 Operations 4. Continuity of AS112 Operations
Existing guidance to AS112 server operators to accept and respond to Existing guidance to AS112 server operators to accept and respond to
queries directed at the PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and queries directed at the PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG, and
BLACKHOLE-2.IANA.ORG nameservers should continue to be followed, and BLACKHOLE-2.IANA.ORG nameservers should continue to be followed, and
no changes to the delegation of existing zones hosted on AS112 no changes to the delegation of existing zones hosted on AS112
servers should occur. These measures are intended to provide servers should occur. These measures are intended to provide
continuity of operations for zones currently delegated to AS112 continuity of operations for zones currently delegated to AS112
servers and avoid any accidental client impact due to the changes servers and avoid any accidental client impact due to the changes
proposed in this document. proposed in this document.
Once it has become empirically and quantitatively clear that the Once it has become empirically and quantitatively clear that the
EMPTY.AS112.ARPA zone is well-hosted to the extent that it is thought EMPTY.AS112.ARPA zone is well hosted to the extent that it is thought
that the existing, unmodified AS112 servers host 10.IN-ADDR.ARPA, the that the existing, unmodified AS112 servers host 10.IN-ADDR.ARPA, the
decision might be made to replace the delegation of those [RFC1918] decision might be made to replace the delegation of those [RFC1918]
zones with DNAME redirection. Once implemented, the zones with DNAME redirection. Once implemented, the
PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and BLACKHOLE-2.IANA.ORG PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG, and BLACKHOLE-2.IANA.ORG
nameservers could be retired. This document gives no such direction nameservers could be retired. This document gives no such direction
to the IANA, however. to the IANA, however.
5. Candidate Zones for AS112 Redirection 5. Candidate Zones for AS112 Redirection
All zones listed in [RFC6303] are candidates for AS112 redirection. All zones listed in [RFC6303] are candidates for AS112 redirection.
Since no pre-provisioning is required on the part of AS112 operators Since no pre-provisioning is required on the part of AS112 operators
to facilitate sinking of any name in the DNS namespace by AS112 to facilitate sinking of any name in the DNS namespace by AS112
infrastructure, this mechanism supports AS112 redirection by any zone infrastructure, this mechanism supports AS112 redirection by any zone
owner in the DNS. owner in the DNS.
This document is simply concerned with provision of the AS112 This document is simply concerned with provision of the AS112
redirection service, and does not specify that any particular AS112 redirection service and does not specify that any particular AS112
redirection be put in place. redirection be put in place.
6. DNAME Deployment Considerations 6. DNAME Deployment Considerations
DNAME was specified years after the original implementations of DNAME was specified years after the original implementations of
[RFC1035], and hence universal deployment cannot be expected. [RFC1035], and hence universal deployment cannot be expected.
[RFC6672] specifies a fall-back mechanism which makes use of [RFC6672] specifies a fallback mechanism that makes use of
synthesised CNAME RRSets for this reason. The expectation that synthesised CNAME RRSets for this reason. The expectation that
design choices in the DNAME specification ought to mitigate any lack design choices in the DNAME specification ought to mitigate any lack
of deployment is reviewed below. Experimental validation of those of deployment is reviewed below. Experimental validation of those
expectations is included in Appendix A. expectations is included in Appendix A.
It is a fundamental design requirement of AS112 service that It is a fundamental design requirement of AS112 service that
responses be cached. We can safely declare DNAME support on the responses be cached. We can safely declare DNAME support on the
authoritative server to be a prerequisite for DNAME redirection, but authoritative server to be a prerequisite for DNAME redirection, but
the cases where individual elements in resolver chains do not support the cases where individual elements in resolver chains do not support
DNAME processing deserve closer examination. DNAME processing deserve closer examination.
The expected behaviour when a DNAME response is supplied to a The expected behaviour when a DNAME response is supplied to a
resolver that does not support DNAME is that the accompanying, resolver that does not support DNAME is that the accompanying,
synthesised CNAME will be accepted and cached. Re-query frequency synthesised CNAME will be accepted and cached. Re-query frequency
will be determined by the TTLs returned by the DNAME-responding will be determined by the TTLs (Time to Live) returned by the
authoritative servers. DNAME-responding authoritative servers.
Resolution of the CNAME target is straightforward and functions Resolution of the CNAME target is straightforward and functions
exactly as the AS112 project has operated since it was deployed. The exactly as the AS112 project has operated since it was deployed. The
negative caching [RFC2308] of the CNAME target follows the parameters negative caching [RFC2308] of the CNAME target follows the parameters
defined in the target zone, EMPTY.AS112.ARPA. This has the side- defined in the target zone, EMPTY.AS112.ARPA. This has the side
effects that all redirected names ultimately landing on an AS112 node effects that all redirected names ultimately landing on an AS112 node
will be negatively-cached with the same parameters, but this lack of will be negatively cached with the same parameters, but this lack of
flexibility seems non-controversial; the effect of reducing the flexibility seems non-controversial; the effect of reducing the
negative cache TTL would be increased query volume on the AS112 node negative cache TTL would be increased query volume on the AS112 node
operator concerned, and hence controls seem well-aligned with operator concerned, and hence controls seem well aligned with
operation. operation.
Validating resolvers (i.e. those requesting and processing DNSSEC Validating resolvers (i.e., those requesting and processing DNSSEC
[RFC4033] metadata) are required to implement DNAME, and hence should [RFC4033] metadata) are required to implement DNAME and hence should
not make use of synthesised CNAME RRs. The lack of signature over a not make use of synthesised CNAME RRs. The lack of signature over a
received CNAME RR should hence not limit the ability to sign the received CNAME RR should hence not limit the ability to sign the
redirection point, and for those signatures to be validated. (DNAME) redirection point, and for those (DNAME) signatures to be
validated.
In the case where a recursive server implements DNAME, but DNAME is In the case where a recursive server implements DNAME but DNAME is
not implemented in a stub resolver, CNAME synthesis will again not implemented in a stub resolver, CNAME synthesis will again
provide a viable path. provide a viable path.
DNAME support on AS112 nodes themselves is never required under this DNAME support on AS112 nodes themselves is never required under this
proposal. proposal.
7. IAB Statement Regarding this .ARPA Request 7. IAB Statement Regarding This .ARPA Request
With the publication of this document, the IAB approves of the With the publication of this document, the IAB approves of the
delegation of 'AS112' in the ARPA domain. Under [RFC3172], the IAB delegation of 'AS112' in the ARPA domain. Under [RFC3172], the IAB
has requested that IANA delegate and provision "AS112.ARPA" as has requested that IANA delegate and provision "AS112.ARPA" as
specified in this specification. However, the IAB does not take any specified in this specification. However, the IAB does not take any
architectural or technical position about this specification. architectural or technical position about this specification.
8. IANA Considerations 8. IANA Considerations
8.1. Address Assignment 8.1. Address Assignment
This document requests that IANA assign IPv4 and IPv6 number Per this document, IANA has assigned IPv4 and IPv6 number resources
resources in conformance with section 4 of [RFC2860]. in conformance with Section 4 of [RFC2860].
The IANA is requested to assign one IPv4 /24 netblock and register
its use in the IPv4 Special-Purpose Address Registry [RFC6890] as
follows:
+----------------------+-----------------------+
| Name | Value |
+----------------------+-----------------------+
| Address Block | As determined by IANA |
| | |
| Name | AS112-v4 |
| | |
| RFC | [THIS DOCUMENT] |
| | |
| Allocation Date | As determined by IANA |
| | |
| Termination Date | N/A |
| | |
| Source | True |
| | |
| Destination | True |
| | |
| Forwardable | True |
| | |
| Global | True |
| | |
| Reserved-by-Protocol | False |
+----------------------+-----------------------+
We suggest that IANA assign 192.31.196.0/24 from the IPv4 Recovered
Address Space Registry, but any /24 which has been unassigned and
unadvertised for at least twelve months is acceptable.
The IANA is requested to assign one IPv6 /48 netblock and register The IANA has assigned one IPv4 /24 netblock and registered its use in
its use in the IPv6 Special-Purpose Address Registry [RFC6890] as the "IANA IPv4 Special-Purpose Address Registry" [RFC6890] as
follows: follows:
+----------------------+-----------------------+ +----------------------+-----------------+
| Name | Value | | Name | Value |
+----------------------+-----------------------+ +----------------------+-----------------+
| Address Block | As determined by IANA | | Address Block | 192.31.196.0/24 |
| | | | | |
| Name | AS112-v6 | | Name | AS112-v4 |
| | | | | |
| RFC | [THIS DOCUMENT] | | RFC | RFC 7535 |
| | | | | |
| Allocation Date | As determined by IANA | | Allocation Date | 2014-12 |
| | | | | |
| Termination Date | N/A | | Termination Date | N/A |
| | | | | |
| Source | True | | Source | True |
| | | | | |
| Destination | True | | Destination | True |
| | | | | |
| Forwardable | True | | Forwardable | True |
| | | | | |
| Global | True | | Global | True |
| | | | | |
| Reserved-by-Protocol | False | | Reserved-by-Protocol | False |
+----------------------+-----------------------+ +----------------------+-----------------+
We suggest that IANA assign 2001:112::/48 from the IETF Protocol
Assignments allocation [RFC2928], but /48 which has been unassigned
and unadvertised for at least twelve months is acceptable.
Once assigned, all occurrences of TBAv4 in this document should be IANA has assigned one IPv6 /48 netblock and registered its use in the
replaced by the IPv4 netblock assigned, in conventional notation. "IANA IPv6 Special-Purpose Address Registry" [RFC6890] as follows:
Occurrences of TBAv4-1 should be replaced with an address from the
netblock with lowest octet set to 1. Similarly, all occurrences of
TBAv6 in this document should be replaced by the IPv6 netblock
assigned, in conventional notation, and TBAv6-1 replaced with an
address from that netblock with the lowest 48 bits set to the value
1. Once those changes are made, this paragraph may be removed prior
to publication.
The netblocks assigned by the IANA for this purpose are TBAv4 and +----------------------+-----------------+
TBAv6. | Name | Value |
+----------------------+-----------------+
| Address Block | 2001:4:112::/48 |
| | |
| Name | AS112-v6 |
| | |
| RFC | RFC 7535 |
| | |
| Allocation Date | 2014-12 |
| | |
| Termination Date | N/A |
| | |
| Source | True |
| | |
| Destination | True |
| | |
| Forwardable | True |
| | |
| Global | True |
| | |
| Reserved-by-Protocol | False |
+----------------------+-----------------+
8.2. Hosting of AS112.ARPA 8.2. Hosting of AS112.ARPA
The IANA is requested to host and sign the zone AS112.ARPA using The IANA hosts and signs the zone AS112.ARPA using nameservers and
nameservers and DNSSEC signing infrastructure of their choosing, as DNSSEC signing infrastructure of their choosing, as shown in
shown in Figure 2. SOA RDATA may be adjusted by the IANA to suit Figure 2. SOA RDATA may be adjusted by the IANA to suit their
their operational requirements. operational requirements.
$ORIGIN AS112.ARPA. $ORIGIN AS112.ARPA.
$TTL 3600 $TTL 3600
@ IN SOA BLACKHOLE.AS112.ARPA. NOC.DNS.ICANN.ORG. ( @ IN SOA BLACKHOLE.AS112.ARPA. NOC.DNS.ICANN.ORG. (
1 ; serial 1 ; serial
10800 ; refresh 10800 ; refresh
3600 ; retry 3600 ; retry
1209600 ; expire 1209600 ; expire
3600 ) ; negative cache TTL 3600 ) ; negative cache TTL
NS A.IANA-SERVERS.NET. NS A.IANA-SERVERS.NET.
NS B.IANA-SERVERS.NET. NS B.IANA-SERVERS.NET.
NS C.IANA-SERVERS.NET. NS C.IANA-SERVERS.NET.
BLACKHOLE A TBAv4-1 BLACKHOLE A 192.31.196.1
AAAA TBAv6-1 AAAA 2001:4:112::1
HOSTNAME NS BLACKHOLE HOSTNAME NS BLACKHOLE
EMPTY NS BLACKHOLE EMPTY NS BLACKHOLE
Figure 2 Figure 2
8.3. Delegation of AS112.ARPA 8.3. Delegation of AS112.ARPA
Once the AS112.ARPA zone is being hosted in production, the IANA is The IANA has arranged delegation from the ARPA zone according to
requested to arrange delegation from the ARPA zone according to
normal IANA procedure for ARPA zone management, to the nameservers normal IANA procedure for ARPA zone management, to the nameservers
used in carrying out the direction in Section 8.2. The whois contact used in carrying out the direction in Section 8.2. The whois contact
information for the new record should be specified by the IAB under information for the new record is specified by the IAB under
[RFC3172]. [RFC3172].
9. Security Considerations 9. Security Considerations
This document presents no known additional security concerns to the This document presents no known additional security concerns to the
Internet. Internet.
For security considerations relating to AS112 service in general, see For security considerations relating to AS112 service in general, see
[I-D.ietf-dnsop-rfc6304bis]. [RFC7534].
10. Acknowledgements
The authors acknowledge the valuable contributions of Bob Harold and
other participants in the DNSOP working group in the preparation of
this document.
11. References
11.1. Normative References 10. References
[I-D.ietf-dnsop-rfc6304bis] 10.1. Normative References
Abley, J. and W. Maton, "AS112 Nameserver Operations",
draft-ietf-dnsop-rfc6304bis-04 (work in progress), July
2014.
[RFC1035] Mockapetris, P., "Domain names - implementation and [RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, November 1987. specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
November 1987, <http://www.rfc-editor.org/info/rfc1035>.
[RFC2308] Andrews, M., "Negative Caching of DNS Queries (DNS [RFC2308] Andrews, M., "Negative Caching of DNS Queries (DNS
NCACHE)", RFC 2308, March 1998. NCACHE)", RFC 2308, DOI 10.17487/RFC2308, March 1998,
<http://www.rfc-editor.org/info/rfc2308>.
[RFC6672] Rose, S. and W. Wijngaards, "DNAME Redirection in the [RFC6672] Rose, S. and W. Wijngaards, "DNAME Redirection in the
DNS", RFC 6672, June 2012. DNS", RFC 6672, DOI 10.17487/RFC6672, June 2012,
<http://www.rfc-editor.org/info/rfc6672>.
11.2. Informative References [RFC7534] Abley, J. and W. Sotomayor, "AS112 Nameserver Operations",
RFC 7534, DOI 10.17487/RFC7534, May 2015,
<http://www.rfc-editor.org/info/rfc7534>.
[RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and 10.2. Informative References
E. Lear, "Address Allocation for Private Internets", BCP
5, RFC 1918, February 1996. [RFC1918] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.,
and E. Lear, "Address Allocation for Private Internets",
BCP 5, RFC 1918, DOI 10.17487/RFC1918, February 1996,
<http://www.rfc-editor.org/info/rfc1918>.
[RFC2860] Carpenter, B., Baker, F., and M. Roberts, "Memorandum of [RFC2860] Carpenter, B., Baker, F., and M. Roberts, "Memorandum of
Understanding Concerning the Technical Work of the Understanding Concerning the Technical Work of the
Internet Assigned Numbers Authority", RFC 2860, June 2000. Internet Assigned Numbers Authority", RFC 2860,
DOI 10.17487/RFC2860, June 2000,
[RFC2928] Hinden, R., Deering, S., Fink, R., and T. Hain, "Initial <http://www.rfc-editor.org/info/rfc2860>.
IPv6 Sub-TLA ID Assignments", RFC 2928, September 2000.
[RFC3172] Huston, G., "Management Guidelines & Operational [RFC3172] Huston, G., Ed., "Management Guidelines & Operational
Requirements for the Address and Routing Parameter Area Requirements for the Address and Routing Parameter Area
Domain ("arpa")", BCP 52, RFC 3172, September 2001. Domain ("arpa")", BCP 52, RFC 3172, DOI 10.17487/RFC3172,
September 2001, <http://www.rfc-editor.org/info/rfc3172>.
[RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S.
Rose, "DNS Security Introduction and Requirements", RFC Rose, "DNS Security Introduction and Requirements",
4033, March 2005. RFC 4033, DOI 10.17487/RFC4033, March 2005,
<http://www.rfc-editor.org/info/rfc4033>.
[RFC4786] Abley, J. and K. Lindqvist, "Operation of Anycast [RFC4786] Abley, J. and K. Lindqvist, "Operation of Anycast
Services", BCP 126, RFC 4786, December 2006. Services", BCP 126, RFC 4786, DOI 10.17487/RFC4786,
December 2006, <http://www.rfc-editor.org/info/rfc4786>.
[RFC5737] Arkko, J., Cotton, M., and L. Vegoda, "IPv4 Address Blocks [RFC5737] Arkko, J., Cotton, M., and L. Vegoda, "IPv4 Address Blocks
Reserved for Documentation", RFC 5737, January 2010. Reserved for Documentation", RFC 5737,
DOI 10.17487/RFC5737, January 2010,
<http://www.rfc-editor.org/info/rfc5737>.
[RFC6303] Andrews, M., "Locally Served DNS Zones", BCP 163, RFC [RFC6303] Andrews, M., "Locally Served DNS Zones", BCP 163,
6303, July 2011. RFC 6303, DOI 10.17487/RFC6303, July 2011,
<http://www.rfc-editor.org/info/rfc6303>.
[RFC6890] Cotton, M., Vegoda, L., Bonica, R., and B. Haberman, [RFC6890] Cotton, M., Vegoda, L., Bonica, R., Ed., and B. Haberman,
"Special-Purpose IP Address Registries", BCP 153, RFC "Special-Purpose IP Address Registries", BCP 153,
6890, April 2013. RFC 6890, DOI 10.17487/RFC6890, April 2013,
<http://www.rfc-editor.org/info/rfc6890>.
Appendix A. Assessing Support for DNAME in the Real World Appendix A. Assessing Support for DNAME in the Real World
To measure the extent to which the DNAME construct is supported in To measure the extent to which the DNAME construct is supported in
the Internet, we have used an experimental technique to test the DNS the Internet, we have used an experimental technique to test the DNS
resolvers used by end hosts, and derive from the test a measurement resolvers used by end hosts and derive from the test a measurement of
of DNAME support within the Internet. DNAME support within the Internet.
A.1. Methodology A.1. Methodology
The test was conducted by loading a user's browser with 4 URLs to The test was conducted by loading a user's browser with four URLs
retrieve. The first three comprise the test setup, while the final to retrieve. The first three comprise the test setup, while the
URL communicates the result the the experiment controller. The URLs final URL communicates the result to the experiment controller.
are: The URLs are:
A http://a.<unique_string>.dname.example.com/1x1.png? A http://a.<unique_string>.dname.example.com/1x1.png?
a.<unique_string>.dname a.<unique_string>.dname
B http://b.dname.example.com/1x1.png? B http://b.dname.example.com/1x1.png?
b.<unique_string>.dname b.<unique_string>.dname
C http://c.<unique_string>.target.example.net/1x1.png? C http://c.<unique_string>.target.example.net/1x1.png?
c.<unique_string>.target c.<unique_string>.target
D http://results.recorder.example.net/1x1.png? D http://results.recorder.example.net/1x1.png?
results.<unique_string>?za=<a_result>&zb=<b_result>&zc=<c_result> results.<unique_string>?za=<a_result>&zb=<b_result>&zc=<c_result>
The A URL is designed to test the end users capability to resolve a The A URL is designed to test the end user's capability to resolve a
name that has never been seen before, so that the resolution of this name that has never been seen before, so that the resolution of this
domain name will reliably result in a query at the authoritative name domain name will reliably result in a query at the authoritative
server. This is intended to test the use of domain names where there nameserver. This is intended to test the use of domain names where
is a dynamic component that also uses the DNAME construct. there is a dynamic component that also uses the DNAME construct.
The B URL is deliberately designed to be cached by caching resolvers The B URL is deliberately designed to be cached by caching resolvers
that are used in the process of resolving the domain name. that are used in the process of resolving the domain name.
The C URL is a control URL. This is a unique URL, similar to A, but The C URL is a control URL. This is a unique URL, similar to A, but
does not refer to a DNAME structure. does not refer to a DNAME structure.
The D URL uses a static cacheable domain name. The D URL uses a static cacheable domain name.
The <unique_string> value is common to the four URLs used in each The <unique_string> value is common to the four URLs used in each
individual instance of this test, but varies from test to test. The individual instance of this test but varies from test to test. The
result is that each end user is presented with a unique string. result is that each end user is presented with a unique string.
The contents of the EXAMPLE.COM, TARGET.EXAMPLE.NET and The contents of the EXAMPLE.COM, TARGET.EXAMPLE.NET, and
RECORDER.EXAMPLE.NET zones are shown in Figure 3. RECORDER.EXAMPLE.NET zones are shown in Figure 3.
$ORIGIN EXAMPLE.COM. $ORIGIN EXAMPLE.COM.
... ...
DNAME. IN DNAME TARGET.EXAMPLE.NET. DNAME. IN DNAME TARGET.EXAMPLE.NET.
... ...
$ORIGIN TARGET.EXAMPLE.NET. $ORIGIN TARGET.EXAMPLE.NET.
... ...
B IN A 192.0.2.0 B IN A 192.0.2.0
* IN A 192.0.2.0 * IN A 192.0.2.0
... ...
$ORIGIN RECORDER.EXAMPLE.NET. $ORIGIN RECORDER.EXAMPLE.NET.
... ...
RESULTS IN A 192.0.2.0 RESULTS IN A 192.0.2.0
... ...
Figure 3 Figure 3
The first three URLs (A, B and C) are loaded as tasks into the user's The first three URLs (A, B, and C) are loaded as tasks into the
browser upon execution of the test's script. The script starts a user's browser upon execution of the test's script. The script
timer with each of these URLs to measure the elapsed time to fetch starts a timer with each of these URLs to measure the elapsed time to
the URL. The script then waits for the three fetches to complete, or fetch the URL. The script then waits for the three fetches to
10 seconds, whichever occurs first. The script then loads the complete, or 10 seconds, whichever occurs first. The script then
results of the three timers into the GET arguments of the D URL, and loads the results of the three timers into the GET arguments of the
performs a fetch to pass these results back to the experiment's D URL and performs a fetch to pass these results back to the
server. experiment's server.
Logs on the web server reached at RESULTS.EXAMPLE.NET will include Logs on the web server reached at RESULTS.RECORDER.EXAMPLE.NET will
entries of the form shown in Figure 4. If any of the URLs fail to include entries of the form shown in Figure 4. If any of the URLs
load within 10 secords the D URL will report the failure as a "null" fail to load within 10 seconds, the D URL will report the failure as
timer value. a "null" timer value.
GET /1x1.png?results.<unique_string>?za=1822&zb=1674&zc=1582 GET /1x1.png?results.<unique_string>?za=1822&zb=1674&zc=1582
GET /1x1.png?results.<unique_string>?za=null&zb=null&zc=161 GET /1x1.png?results.<unique_string>?za=null&zb=null&zc=161
Figure 4 Figure 4
The script has been encoded in Adobe Flash with a simple image in the The script has been encoded in Adobe Flash with a simple image in the
form of an online advertisement. An online advertisement network has form of an online advertisement. An online advertisement network has
been used to distribute the script. The script is invoked when the been used to distribute the script. The script is invoked when the
advertisement is presented in the end user's browser or application, advertisement is presented in the end user's browser or application
and does not require the user to click on the supplied image in any and does not require the user to click on the supplied image in any
way. The advertisement placement parameters were set to to broadest way. The advertisement placement parameters were set to the broadest
possible scope to sample users from across the entire internet. possible scope to sample users from across the entire Internet.
A.2. Results A.2. Results
The test was loaded into an advertisement distributed on 2013-10-10 The test was loaded into an advertisement distributed on 2013-10-10
and 2013-10-11. and 2013-10-11.
+--------------------+---------+------------+ +--------------------+---------+------------+
| | Count | Percentage | | | Count | Percentage |
+--------------------+---------+------------+ +--------------------+---------+------------+
| Recorded Results: | 338,478 | | | Recorded Results: | 338,478 | |
skipping to change at page 14, line 30 skipping to change at page 15, line 30
| | | | | | | |
| A Load and B Fail: | 1,624 | 0.5% | | A Load and B Fail: | 1,624 | 0.5% |
| | | | | | | |
| C Fail: | 9,355 | 2.8% | | C Fail: | 9,355 | 2.8% |
+--------------------+---------+------------+ +--------------------+---------+------------+
Table 1 Table 1
These results indicate that at most 1.9% of tested clients use DNS These results indicate that at most 1.9% of tested clients use DNS
resolvers that fail to resolve a domain name that contains a DNAME resolvers that fail to resolve a domain name that contains a DNAME
redirection. However the failure rate of slightly lower than 3% for redirection. However, the failure rate of slightly lower than 3% for
the control URL indicates that the failure rate for the DNAME the control URL indicates that the failure rate for the DNAME
construct lies within the bounds of error within the experimental construct lies within the bounds of error within the experimental
framework. We conclude that there is no evidence of a consistent framework. We conclude that there is no evidence of a consistent
failure on the part of deployed DNS resolvers to correctly resolve a failure on the part of deployed DNS resolvers to correctly resolve a
DNAME construct. DNAME construct.
This experiment was conducted by Geoff Huston and George Michaelson. This experiment was conducted by Geoff Huston and George Michaelson.
Appendix B. Editorial Notes Acknowledgements
This section (and sub-sections) to be removed prior to publication.
B.1. Change History
00 Initial write-up of Brian's idea, circulated for the purposes of
entertainment.
01 Some particularly egregious spelling mistakes fixed. Warren
Kumari and George Michaelson added as co-authors. Intended status
changed to informational. Appendix on DNAME testing added,
describing an experiment conducted by Geoff Huston and George
Michaelson.
00 Adopted by dnsop in IETF88, Vancouver; resubmitted as draft-ietf-
dnsop-as112-dname. Changed contact info for Brian.
01 Minor updates following submission of draft-jabley-dnsop-
rfc6304bis.
02 Text in IANA Considerations section dealing with address
assignments modified following informal advice received from Leo
Vegoda.
03 Updated references to 6304 following guidance from working group
chairs.
04 Corrected an error picked up by Bob Harold.
05 Addressed various comments from the IESG and IAB. Updated Brian's
contact info. Minor spelling and grammatical corrections. Added
text to the abstract and introduction to reinforce the point that
this approach allows liberal use of AS112 infrastructure without
coordination with AS112 operators.
06 Made changes requested by the IAB relating to [RFC3172]. The authors acknowledge the valuable contributions of Bob Harold and
other participants in the DNSOP working group in the preparation of
this document.
Authors' Addresses Authors' Addresses
Joe Abley Joe Abley
Dyn, Inc. Dyn, Inc.
186 Albert Street, Suite 103 103-186 Albert Street
London, ON N6A 1M1 London, ON N6A 1M1
Canada Canada
Phone: +1 519 670 9327 Phone: +1 519 670 9327
Email: jabley@dyn.com EMail: jabley@dyn.com
Brian Dickson Brian Dickson
Twitter, Inc. Twitter, Inc.
Email: bdickson@twitter.com EMail: bdickson@twitter.com
Warren Kumari Warren Kumari
Google Google
1600 Amphitheatre Parkway 1600 Amphitheatre Parkway
Mountain View, CA 94043 Mountain View, CA 94043
USA United States
EMail: warren@kumari.net
Email: warren@kumari.net
George Michaelson George Michaelson
APNIC APNIC
Email: ggm@apnic.net EMail: ggm@apnic.net
 End of changes. 81 change blocks. 
288 lines changed or deleted 234 lines changed or added

This html diff was produced by rfcdiff 1.42. The latest version is available from http://tools.ietf.org/tools/rfcdiff/