Standard way for Authoratitive DNS servers to refuse ANY query
draft-ogud-dnsop-any-notimp-00

Abstract

DNS ANY query is widely abused for reflection attacks. This feature was designed to aid in debugging. As there is no good reason for applications to ever issue an ANY query this document codifies how an authoritative server can reject such queries.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on September 7, 2015.

Copyright Notice

Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 2. Requirements notation
• 3. Protocol change
• 4. IANA considerations
• 5. Security considerations
• 6. Internationalizaiton Considerations
• 7. Implementation Experience
• 8. Normative References
• Appendix A. Document history
• Authors' Addresses

1. Introduction

DNS is an evolving protocol, at glacial phase, this document specifies how an Authorative server can reject an ANY query. ANY queries are widely abused by attackers doing reflection attacks as they return the largest answers. Over the years a number of attempts have been made to throttle ANY queries, ranging from returning TC bit to all UDP ANY queries, blocking them totally, and QoS'ing the number of ANY queires accepted per second. All of those are band-aids.

Some modern Authoritative servers, such as those used by CDN's, do not have DNS zones. For those servers answering ANY query truthfully is hard work. Thus ignoring ANY queries simplifies the implementation.

2. Requirements notation

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].

3. Protocol change

An Authorative DNS[RFC1035] server can reject ANY query by returning RCODE = 4 (NOTIMP).

A Recurisive Resolver SHOULD ignore RD bit set on ANY query. Additionaly as Recursive Resolver SHOULD remember that ANY queries are not available from upstream Auth server, this SHOULD be cached for at least 5 minutes.

4. IANA considerations

No IANA action is requested

5. Security considerations

ANY query is mainly used for attacks on the internet due to its amplification factor. Codifying this behavior makes life harder for attackers, at minimal cost for DNS operators.

6. Internationalizaiton Considerations

NONE

7. Implementation Experience

TBD

8. Normative References

Appendix A. Document history

[RFC Editor: Please remove this section before publication ]

00 Initial version

Authors' Addresses