At 7:57 +0300 5/5/04, Pekka Savola wrote:
Isn't the use of QTYPE=* causing more problems than its worth, being
unreliable and all that?  Or is it's usefulness precisely restricted
to identifying what _is_ in the caches (and what is not)?

This is an ancillary comment, based on the experience of being involved in DNSSEC and the longer-than-it-should-have-taken road it has travelled.


I'd address this issue like:

A) Don't bother discussing the usefulness of QTYPE=* here. It isn't a v6. (Debating the value of a feature good "only for troubleshooting" is a rat hole. There's no objective answer. Ever.)

B) Write the guidelines for IPv6 adoption mindful of all the quirks of DNS.

C) Don't smooth over the hard parts - doing so only creates the dreaded "corner cases." Overly strict "rules" eventually cause conflict. Instead, be loose enough to absorb the shocks of running over a rough road.

DNSSEC at first tried to solve for only the normal cases of DNS, as well as some cases that were interesting to the security community (like alternative chains of trust). A lot of the delay of the security extensions to DNS came from not having enough of an understanding of the base protocol.

To address the questions 1,2,3...

1) Personally I don't see QTYPE=* as an oddity, it's just not very clear to the causal observer. I'd not mention in the document anything positive, but a warning against assuming that QTYPE=* will retrieve both A and AAAA if they both exist.

2) I doubt there's much value is writing another document on QTYPE=*. It's defined in 1035 +/- 1, well enough I think. (It's actually QTYPE=ANY, which makes it easier to understand - it's not QTYPE=ALL! The latter is the assumption many make.)

3) No - but perhaps we (and I) ought to be clearer and never refer to QTYPE=*. There are times I rely on the ANY QTYPE for debugging.

This is off-thread, but a similar situation holds for the truncation discussion. Ohta's better at it than I, the morale is not to dive into a treatise on the additional section for v6 without more research on the TC bit settings. There's a lot already written in the topic. I know - DNSSEC also messed with the rules there. ;)

--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

If time travel were ever to be realized, public key crypto is toast.
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

Reply via email to