What DNS Is Not

Bill Stewart nonobvious at gmail.com
Mon Nov 9 17:04:06 CST 2009


Hi, Paul - I share your dislike of DNS services that break the DNS
model for profit in ways that break applications.
For instance, returning the IP address of your company's port-80 web
server instead of NXDOMAIN
not only breaks non-port-80-http applications, it also breaks the
behaviour that browsers such as
IE and Firefox expect, which is that if a domain isn't found, they'll
do something that the user chooses,
such as sending another query to the user's favorite search engine.

There is one special case for which I don't mind having DNS servers
lie about query results,
which is the phishing/malware protection service.  In that case, the
DNS response is redirecting you to
the IP address of a server that'll tell you
       "You really didn't want to visit PayPa11.com - it's a fake" or
       "You really didn't want to visit
dgfdsgsdfgdfgsdfgsfd.example.ru - it's malware".
It's technically broken, but you really _didn't_ want to go there anyway.
It's a bit friendlier to administrators and security people if the
response page gives you the
IP address that the query would have otherwise returned, though
obviously you don't want it to be
a clickable hyperlink.

However, I disagree with your objections to CDN, and load balancers in
general - returning the
address of the server that example.com thinks will give you the best
performance is reasonable.
(I'll leave the question of whether DNS queries are any good at
determining that to the vendors.)
Maintaining a cachable ns.example.com record in the process is
friendly to everybody;
maintaining cachable A records is less important.
If reality is changing rapidly, then the directory that points to the
reality can reasonably change also.


On Mon, Nov 9, 2009 at 12:00 PM, Paul Vixie <vixie at isc.org> wrote:
> i loved the henry ford analogy -- but i think henry ford would have said that
> the automatic transmission was a huge step forward since he wanted everybody
> to have a car.  i can't think of anything that's happened in the automobile
> market that henry ford wouldn't've wished he'd thought of.

Well, there's the built-in GPS navigation system that tells you to go
drive off the dock into the water,
because it wasn't smart enough to know that the route the map database
showed in dotted lines was a ferryboat...

-- 
----
             Thanks;     Bill

Note that this isn't my regular email account - It's still experimental so far.
And Google probably logs and indexes everything you send it.




More information about the NANOG mailing list