Re: morishita-dnsop-misbehavior-against-aaaa

[Iljitsch van Beijnum <iljitsch@muada.com>]

On 19-nov-03, at 1:16, Jim Reid wrote:

>     Iljitsch> If I run an IPv6-only service, why would IPv4-only
>     Iljitsch> systems need to be able to resolve my DNS names?

> Let's turn that question around. Why should an IPv4-only system be
> denied access to names of IPv6-only systems?

Simple: because they can't use them as intended anyway.

> Now to answer your question -- I hope you'll answer mine! -- there are
> many reasons why an IPv4 only host would need to resolve your IPv6
> only names. An IPv6 host might need to use a local IPv4-only DNS
> resolver.

How could an IPv6-only host make use of an IPv4-only resolver? But 
granted, this resolver could be dual stack and point to an IPv4-only 
resolver.

> Secondly, my
> IPv4-only resolver will need the capability to lookup your IPv6-only
> names. Say to find out if you're using AAAA or A6 records. Or just to
> know what the IPv6 address of one of those names is today. [For
> instance to find out why we can't get mail to you as your SMTP server
> is on an IPv6-only host (say).]

I agree this could be useful, but not to the degree that we should 
_require_ otherwise IPv6-only networks to run IPv4 nameservers.

> Now you might not care that the IPv4 world could break in weird ways
> whenever it tries to get to your IPv6-only world because your bit of
> the name space is misconfigured. However the former *will* care. And
> they've got a much bigger installed base. :-)

I don't believe running an IPv6-only network is misconfiguration. If 
v4-only users care, so much the better, then they can upgrade and visit 
my stuff over IPv6.  :-)

> Having IPv6-only name servers for useful zones will be very unwise for
> the forseeable future.

Agree with this (but who are we to deny people the right to be uwise?), 
...

> It would be as bad as putting all the servers
> for say muada.com on RFC1918 addresses that aren't routed on the
> internet.

... but not with this one. IPv6 and RFC 1918 are very different beasts.

> There will be other reasons too. The ones above are enough to be going
> on with.

I suggest that the authors take this text and put it in the draft, as 
it currently only refers to the obviousness of the lack of wisdom of 
doing all of this.

#----------------------------------------------------------------------
# To unsubscribe, send a message to <dnsop-request@cafax.se>.