Using DNAME in the root for the delegation of special-use TLDs
draft-bortzmeyer-dname-root-01

Abstract

This documents asks IANA to add DNAME records in the DNS root for TLDs which are in the Special-Use Domain Names registry, in order to ensure they receive an appropriate reply (NXDOMAIN) and that the root is not too bothered by them.

REMOVE BEFORE PUBLICATION: there is no obvious place to discuss this document. May be the IETF DNSOP (DNS Operations) group, through its mailing list (the author reads it). Or may AS112 operators mailing lists? The source of the document, as well as a list of open issues, is currently kept at Github.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on October 23, 2016.

Copyright Notice

Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction and background
• 1.1. Requirements Terminology
• 2. Rules
• 3. Benefits
• 4. Possible issues
• 5. IANA Considerations
• 6. Security Considerations
• 7. Acknowledgments
• 8. References
• 8.1. Normative References
• 8.2. Informative References
• Author's Address

1. Introduction and background

The DNS root receives a lot of requests for TLDs which do not exist. See for instance [fujiwara-root-traffic] or [icann-l-root-stats] or [ssac-045]. In the spirit of [RFC7534], it would be good if they could be redirected to a sink such as AS112, to save root's resources.

Some of these names, and specially one of the biggest offenders, .local ([RFC6762]), are registered in the Special-Use Domain Names registry of [RFC6761]. They are obvious candidates for a delegation to the sink.

It is proposed to use the new AS112, the one described by [RFC7535] to implement this sink.

TODO: results of the discussion with AS112 people

1.1. Requirements Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].

2. Rules

Every TLD ([RFC7719], section 2) which is in the Special-Use Domain Names registry ([RFC6761]) SHOULD be delegated by IANA through a DNAME to empty.as112.arpa as described in [RFC7535] if and only if the registration of this TLD say that resolvers should not or must not look them up in the DNS.

It is important to notice that this document does not define a policy to decide if a TLD should be "delegated" or not. Instead, it relies on the existing Special-Use Domain Names registry and its rules.

RFC-EDITOR: remove before publication. As of today, with these rules, .local ([RFC6762]) or .onion ([RFC7686]) would be delegated but not .example (its registration in [RFC6761] does not define special handling for resolvers) or .home or .belkin (this last one generates a huge traffic at the root but is not in the Special-Use Domain Names registry).

3. Benefits

The main benefit is less load on the root and a better efficiency of the caches, therefore helping the entire DNS ecosystem.

4. Possible issues

Of course, the solution described in this document requires a good support of DNAME by the resolvers. Appendix A of [RFC7535] describes an experiment which was run in 2013 and which shows that, indeed, we can rely on DNAME (quoting the authors: "We conclude that there is no evidence of a consistent failure on the part of deployed DNS resolvers to correctly resolve a DNAME construct.").

Regarding DNSSEC, do note the future DNAMEs in the root will be signed, but the target, empty.as112.arpa, is not. See George Michaelson's message. So, it will not be possible to validate the answers. Not a problem since these requests should never have been sent to the root, anyway.

5. IANA Considerations

IANA is requested (TODO what is the appropriate wording?) to add a DNAME in the root for every TLD which fits the rules of Section 2.

RFC-EDITOR: remove before publication. There is currently no DNAME in the root. It is expected that the creation of the first one will require a top-down, multi-stakeholder, long and complicated process with a lot of meetings, reports by consultants and design teams.

6. Security Considerations

The requests for the TLD in the Special-Use Domain Names registry are typically NOT supposed to leak to the authoritative public name servers such as the ones of the root. If they do, it means a misconfiguration somewhere. The leak is independant on whether the name is delegated to AS112 or not. See section 8 of [RFC7534] for an analysis. Some people believe there are added risks, because the queries will be seen by AS112 servers which, unlike the root, are managed by many "random people".

7. Acknowledgments

Thanks to Paul Hoffman to say that it may be a good idea and for Ted Lemon to give the final impulse, with his [I-D.tldr-sutld-ps].

8. References

8.1. Normative References

8.2. Informative References

Author's Address