idnits 2.17.00 (12 Aug 2021) /tmp/idnits26089/draft-ietf-dnsop-as112-dname-05.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- == There are 21 instances of lines with non-RFC2606-compliant FQDNs in the document. == There are 1 instance of lines with non-RFC6890-compliant IPv4 addresses in the document. If these are example addresses, they should be changed. == There are 1 instance of lines with non-RFC3849-compliant IPv6 addresses in the document. If these are example addresses, they should be changed. -- The document has examples using IPv4 documentation addresses according to RFC6890, but does not use any IPv6 documentation addresses. Maybe there should be IPv6 examples, too? ** The document seems to lack a both a reference to RFC 2119 and the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. RFC 2119 keyword, line 164: '...ting AS112 nodes SHOULD be extended to...' Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (November 19, 2014) is 2740 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- == Missing Reference: 'THIS DOCUMENT' is mentioned on line 369, but not defined == Outdated reference: draft-ietf-dnsop-rfc6304bis has been published as RFC 7534 Summary: 1 error (**), 0 flaws (~~), 6 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Abley 3 Internet-Draft Dyn, Inc. 4 Intended status: Informational B. Dickson 5 Expires: May 23, 2015 Twitter, Inc. 6 W. Kumari 7 Google 8 G. Michaelson 9 APNIC 10 November 19, 2014 12 AS112 Redirection using DNAME 13 draft-ietf-dnsop-as112-dname-05 15 Abstract 17 AS112 provides a mechanism for handling reverse lookups on IP 18 addresses that are not unique (e.g., RFC 1918 addresses). This 19 document describes modifications to the deployment and use of AS112 20 infrastructure that will allow zones to be added and dropped much 21 more easily, using DNAME resource records. 23 This approach makes it possible for any DNS zone administrator to 24 sink traffic relating to parts of the global DNS namespace under 25 their control to the AS112 infrastructure without coordination with 26 the operators of AS112 infrastructure. 28 Status of This Memo 30 This Internet-Draft is submitted in full conformance with the 31 provisions of BCP 78 and BCP 79. 33 Internet-Drafts are working documents of the Internet Engineering 34 Task Force (IETF). Note that other groups may also distribute 35 working documents as Internet-Drafts. The list of current Internet- 36 Drafts is at http://datatracker.ietf.org/drafts/current/. 38 Internet-Drafts are draft documents valid for a maximum of six months 39 and may be updated, replaced, or obsoleted by other documents at any 40 time. It is inappropriate to use Internet-Drafts as reference 41 material or to cite them other than as "work in progress." 43 This Internet-Draft will expire on May 23, 2015. 45 Copyright Notice 47 Copyright (c) 2014 IETF Trust and the persons identified as the 48 document authors. All rights reserved. 50 This document is subject to BCP 78 and the IETF Trust's Legal 51 Provisions Relating to IETF Documents 52 (http://trustee.ietf.org/license-info) in effect on the date of 53 publication of this document. Please review these documents 54 carefully, as they describe your rights and restrictions with respect 55 to this document. Code Components extracted from this document must 56 include Simplified BSD License text as described in Section 4.e of 57 the Trust Legal Provisions and are provided without warranty as 58 described in the Simplified BSD License. 60 Table of Contents 62 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 63 2. Design Overview . . . . . . . . . . . . . . . . . . . . . . . 4 64 3. AS112 Operations . . . . . . . . . . . . . . . . . . . . . . 4 65 3.1. Extensions to Support DNAME Redirection . . . . . . . . . 4 66 3.2. Redirection of Query Traffic to AS112 Servers . . . . . . 5 67 4. Continuity of AS112 Operations . . . . . . . . . . . . . . . 5 68 5. Candidate Zones for AS112 Redirection . . . . . . . . . . . . 6 69 6. DNAME Deployment Considerations . . . . . . . . . . . . . . . 6 70 7. IAB Considerations . . . . . . . . . . . . . . . . . . . . . 7 71 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 72 8.1. Address Assignment . . . . . . . . . . . . . . . . . . . 7 73 8.2. Hosting of AS112.ARPA . . . . . . . . . . . . . . . . . . 9 74 8.3. Delegation of AS112.ARPA . . . . . . . . . . . . . . . . 10 75 9. Security Considerations . . . . . . . . . . . . . . . . . . . 11 76 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 11 77 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 11 78 11.1. Normative References . . . . . . . . . . . . . . . . . . 11 79 11.2. Informative References . . . . . . . . . . . . . . . . . 11 80 Appendix A. Assessing Support for DNAME in the Real World . . . 12 81 A.1. Methodology . . . . . . . . . . . . . . . . . . . . . . . 12 82 A.2. Results . . . . . . . . . . . . . . . . . . . . . . . . . 14 83 Appendix B. Editorial Notes . . . . . . . . . . . . . . . . . . 15 84 B.1. Change History . . . . . . . . . . . . . . . . . . . . . 15 85 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 15 87 1. Introduction 89 Many sites connected to the Internet make use of IPv4 addresses that 90 are not globally unique. Examples are the addresses designated in 91 [RFC1918] for private use within individual sites. 93 Devices in such environments may occasionally originate Domain Name 94 System (DNS) queries (so-called "reverse lookups") corresponding to 95 those private-use addresses. Since the addresses concerned have only 96 local significance, it is good practice for site administrators to 97 ensure that such queries are answered locally. However, it is not 98 uncommon for such queries to follow the normal delegation path in the 99 public DNS instead of being answered within the site. 101 It is not possible for public DNS servers to give useful answers to 102 such queries. In addition, due to the wide deployment of private-use 103 addresses and the continuing growth of the Internet, the volume of 104 such queries is large and growing. The AS112 project aims to provide 105 a distributed sink for such queries in order to reduce the load on 106 the IN-ADDR.ARPA authoritative servers. The AS112 project is named 107 after the Autonomous System Number (ASN) that was assigned to it. 109 Prior to implementation of this technique, the AS112 project did not 110 accommodate the addition and removal of DNS zones elegantly. Since 111 additional zones of definitively local significance are known to 112 exist, this presents a problem. This document describes 113 modifications to the deployment and use of AS112 infrastructure that 114 will allow zones to be added and dropped much more easily. 116 The AS112 project is described in detail in 117 [I-D.ietf-dnsop-rfc6304bis]. 119 The AS112 nameservers (PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and 120 BLACKHOLE-2.IANA.ORG) are required to answer authoritatively for each 121 and every zone that is delegated to them. If a zone is delegated to 122 AS112 nameservers without those nameservers being configured ahead of 123 time to answer authoritatively for that zone, there is a detrimental 124 impact on clients following referrals for queries within that zone. 125 This misconfiguration is colloquially known as a "lame delegation". 127 AS112 nameserver operators are only loosely-coordinated, and hence 128 adding support for a new zone (or, correspondingly, removing support 129 for a zone that is no longer delegated to the AS112 nameservers) is 130 difficult to accomplish with accuracy. Testing AS112 nameservers 131 remotely to see whether they are configured to answer authoritatively 132 for a particular zone is similarly challenging since AS112 nodes are 133 distributed using anycast [RFC4786]. 135 This document defines a more flexible approach for sinking queries on 136 AS112 infrastructure that can be deployed alongside unmodified, 137 existing AS112 nodes. Instead of delegating additional zones 138 directly to AS112 nameservers, DNAME [RFC6672] redirection is used. 139 This approach has the advantage that query traffic for arbitrary 140 parts of the namespace can be directed to AS112 servers without those 141 servers having to be reconfigured every time a zone is added or 142 removed. 144 This approach makes it possible for any DNS zone administrator to 145 sink traffic relating to parts of the global DNS namespace under 146 their control to the AS112 infrastructure without coordination with 147 the operators of AS112 infrastructure. 149 2. Design Overview 151 A new zone, EMPTY.AS112.ARPA, is delegated to a single nameserver 152 BLACKHOLE.AS112.ARPA (IPv4 address TBAv4-1, IPv6 address TBAv6-1). 154 The IPv4 address TBAv4-1 has been assigned by the IANA such that the 155 address is coverable by a single IPv4 /24 prefix, and that no other 156 address covered by that prefix is in use. The IPv6 address TBAv6-1 157 has been similarly assigned such that no other address within a 158 covering /48 is in use. This addressing plan accommodates the 159 anycast distribution of the BLACKHOLE.AS112.ARPA service using a 160 single IPv4 service prefix and a single IPv6 service prefix. See 161 [RFC4786] for more discussion of anycast service distribution; see 162 Section 8 for the specific requests this document makes of the IANA. 164 Some or all of the existing AS112 nodes SHOULD be extended to support 165 these new nameserver addresses, and to host the EMPTY.AS112.ARPA 166 zone. See [I-D.ietf-dnsop-rfc6304bis] for revised guidance to AS112 167 server operators. 169 Each part of the DNS namespace for which it is desirable to sink 170 queries at AS112 nameservers should be redirected to the 171 EMPTY.AS112.ARPA zone using DNAME [RFC6672]. See Section 3.2 for 172 guidance to zone administrators. 174 3. AS112 Operations 176 3.1. Extensions to Support DNAME Redirection 178 Guidance to operators of AS112 nodes is extended to include 179 configuration of the TBAv4-1, and TBAv6-1 addresses, and the 180 corresponding announcement of covering routes for those addresses, 181 and to host the EMPTY.AS112.ARPA zone. 183 IPv4-only AS112 nodes should only configure the TBAv4-1 nameserver 184 address; IPv6-only AS112 nodes should only configure the TBAv6-1 185 nameserver address. 187 It is only necessary for a single AS112 server operator to implement 188 these extensions for this mechanism to function as intended. It is 189 beneficial if many more than one AS112 server operators make these 190 changes, however, since that provides for greater distribution and 191 capacity for the nameservers serving the EMPTY.AS112.ARPA zone. It 192 is not necessary for all AS112 server operators to make these changes 193 for the mechanism to be viable. 195 Detailed instructions for the implementation of these extensions is 196 included in [I-D.ietf-dnsop-rfc6304bis]. 198 3.2. Redirection of Query Traffic to AS112 Servers 200 Once the EMPTY.AS112.ARPA zone has been deployed using the 201 nameservers described in Section 3.1, redirections may be installed 202 in the DNS namespace for queries that are intended to be answered by 203 the AS112 infrastructure. 205 For example, reverse queries corresponding to TEST-NET-1 206 (192.0.2.0/24) [RFC5737] could be redirected to AS112 nameservers by 207 installing a DNAME resource record in the 192.IN-ADDR.ARPA zone, as 208 illustrated in Figure 1. 210 $ORIGIN 192.IN-ADDR.ARPA. 211 ... 212 2.0 IN DNAME EMPTY.AS112.ARPA. 213 ... 215 Figure 1 217 There is no practical limit to the number of redirections that can be 218 configured in this fashion. Redirection of a particular part of the 219 namespace to EMPTY.AS112.ARPA can be removed at any time, under the 220 control of the administrators of the corresponding part of the DNS 221 namespace. No changes to deployed AS112 nodes incorporating the 222 extensions described in this document are required to support 223 additional redirections. A list of possible candidates for AS112 224 redirection can be found in Section 5. 226 DNAME resource records deployed for this purpose can be signed with 227 DNSSEC [RFC4033], providing a secure means of authenticating the 228 legitimacy of each redirection. 230 4. Continuity of AS112 Operations 232 Existing guidance to AS112 server operators to accept and respond to 233 queries directed at the PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and 234 BLACKHOLE-2.IANA.ORG nameservers should continue to be followed, and 235 no changes to the delegation of existing zones hosted on AS112 236 servers should occur. These measures are intended to provide 237 continuity of operations for zones currently delegated to AS112 238 servers and avoid any accidental client impact due to the changes 239 proposed in this document. 241 Once it has become empirically and quantitatively clear that the 242 EMPTY.AS112.ARPA zone is well-hosted to the extent that it is thought 243 that the existing, unmodified AS112 servers host 10.IN-ADDR.ARPA, the 244 decision might be made to replace the delegation of those [RFC1918] 245 zones with DNAME redirection. Once implemented, the 246 PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and BLACKHOLE-2.IANA.ORG 247 nameservers could be retired. This document gives no such direction 248 to the IANA, however. 250 5. Candidate Zones for AS112 Redirection 252 All zones listed in [RFC6303] are candidates for AS112 redirection. 254 Since no pre-provisioning is required on the part of AS112 operators 255 to facilitate sinking of any name in the DNS namespace by AS112 256 infrastructure, this mechanism supports AS112 redirection by any zone 257 owner in the DNS. 259 This document is simply concerned with provision of the AS112 260 redirection service, and does not specify that any particular AS112 261 redirection be put in place. 263 6. DNAME Deployment Considerations 265 DNAME was specified years after the original implementations of 266 [RFC1035], and hence universal deployment cannot be expected. 267 [RFC6672] specifies a fall-back mechanism which makes use of 268 synthesised CNAME RRSets for this reason. The expectation that 269 design choices in the DNAME specification ought to mitigate any lack 270 of deployment is reviewed below. Experimental validation of those 271 expectations is included in Appendix A. 273 It is a fundamental design requirement of AS112 service that 274 responses be cached. We can safely declare DNAME support on the 275 authoritative server to be a prerequisite for DNAME redirection, but 276 the cases where individual elements in resolver chains do not support 277 DNAME processing deserve closer examination. 279 The expected behaviour when a DNAME response is supplied to a 280 resolver that does not support DNAME is that the accompanying, 281 synthesised CNAME will be accepted and cached. Re-query frequency 282 will be determined by the TTLs returned by the DNAME-responding 283 authoritative servers. 285 Resolution of the CNAME target is straightforward and functions 286 exactly as the AS112 project has operated since it was deployed. The 287 negative caching [RFC2308] of the CNAME target follows the parameters 288 defined in the target zone, EMPTY.AS112.ARPA. This has the side- 289 effects that all redirected names ultimately landing on an AS112 node 290 will be negatively-cached with the same parameters, but this lack of 291 flexibility seems non-controversial; the effect of reducing the 292 negative cache TTL would be increased query volume on the AS112 node 293 operator concerned, and hence controls seem well-aligned with 294 operation. 296 Validating resolvers (i.e. those requesting and processing DNSSEC 297 [RFC4033] metadata) are required to implement DNAME, and hence should 298 not make use of synthesised CNAME RRs. The lack of signature over a 299 received CNAME RR should hence not limit the ability to sign the 300 redirection point, and for those signatures to be validated. 302 In the case where a recursive server implements DNAME, but DNAME is 303 not implemented in a stub resolver, CNAME synthesis will again 304 provide a viable path. 306 DNAME support on AS112 nodes themselves is never required under this 307 proposal. 309 7. IAB Considerations 311 This document proposes a delegation within the ARPA domain, and, in 312 accordance with [RFC3172], IAB review and approval of the delegation 313 of AS112.ARPA as described in Section 8 is required. 315 Once IAB approval has been obtained, this section may be removed 316 prior to publication or updated to include text that confirms the 317 IAB's decision, at the IAB's discretion. 319 8. IANA Considerations 321 8.1. Address Assignment 323 This document requests that IANA assign IPv4 and IPv6 number 324 resources in conformance with section 4 of [RFC2860]. 326 The IANA is requested to assign one IPv4 /24 netblock and register 327 its use in the IPv4 Special-Purpose Address Registry [RFC6890] as 328 follows: 330 +----------------------+-----------------------+ 331 | Name | Value | 332 +----------------------+-----------------------+ 333 | Address Block | As determined by IANA | 334 | | | 335 | Name | AS112-v4 | 336 | | | 337 | RFC | [THIS DOCUMENT] | 338 | | | 339 | Allocation Date | As determined by IANA | 340 | | | 341 | Termination Date | N/A | 342 | | | 343 | Source | True | 344 | | | 345 | Destination | True | 346 | | | 347 | Forwardable | True | 348 | | | 349 | Global | True | 350 | | | 351 | Reserved-by-Protocol | False | 352 +----------------------+-----------------------+ 354 We suggest that IANA assign 192.31.196.0/24 from the IPv4 Recovered 355 Address Space Registry, but any /24 which has been unassigned and 356 unadvertised for at least twelve months is acceptable. 358 The IANA is requested to assign one IPv6 /48 netblock and register 359 its use in the IPv6 Special-Purpose Address Registry [RFC6890] as 360 follows: 362 +----------------------+-----------------------+ 363 | Name | Value | 364 +----------------------+-----------------------+ 365 | Address Block | As determined by IANA | 366 | | | 367 | Name | AS112-v6 | 368 | | | 369 | RFC | [THIS DOCUMENT] | 370 | | | 371 | Allocation Date | As determined by IANA | 372 | | | 373 | Termination Date | N/A | 374 | | | 375 | Source | True | 376 | | | 377 | Destination | True | 378 | | | 379 | Forwardable | True | 380 | | | 381 | Global | True | 382 | | | 383 | Reserved-by-Protocol | False | 384 +----------------------+-----------------------+ 386 We suggest that IANA assign 2001:112::/48 from the IETF Protocol 387 Assignments allocation [RFC2928], but /48 which has been unassigned 388 and unadvertised for at least twelve months is acceptable. 390 Once assigned, all occurrences of TBAv4 in this document should be 391 replaced by the IPv4 netblock assigned, in conventional notation. 392 Occurrences of TBAv4-1 should be replaced with an address from the 393 netblock with lowest octet set to 1. Similarly, all occurrences of 394 TBAv6 in this document should be replaced by the IPv6 netblock 395 assigned, in conventional notation, and TBAv6-1 replaced with an 396 address from that netblock with the lowest 48 bits set to the value 397 1. Once those changes are made, this paragraph may be removed prior 398 to publication. 400 The netblocks assigned by the IANA for this purpose are TBAv4 and 401 TBAv6. 403 8.2. Hosting of AS112.ARPA 405 The IANA is requested to host and sign the zone AS112.ARPA using 406 nameservers and DNSSEC signing infrastructure of their choosing, as 407 shown in Figure 2. SOA RDATA may be adjusted by the IANA to suit 408 their operational requirements. 410 $ORIGIN AS112.ARPA. 411 $TTL 3600 413 @ IN SOA BLACKHOLE.AS112.ARPA. NOC.DNS.ICANN.ORG. ( 414 1 ; serial 415 10800 ; refresh 416 3600 ; retry 417 1209600 ; expire 418 3600 ) ; negative cache TTL 420 NS A.IANA-SERVERS.NET. 421 NS B.IANA-SERVERS.NET. 422 NS C.IANA-SERVERS.NET. 424 BLACKHOLE A TBAv4-1 425 AAAA TBAv6-1 427 HOSTNAME NS BLACKHOLE 429 EMPTY NS BLACKHOLE 431 Figure 2 433 8.3. Delegation of AS112.ARPA 435 Once the AS112.ARPA zone is being hosted in production, the IANA is 436 requested to arrange delegation from the ARPA zone according to 437 normal IANA procedure for ARPA zone management, to the nameservers 438 used in carrying out the direction in Section 8.2. The following 439 metadata is suggested for the delegation, but may be changed by the 440 IANA if required: 442 +----------------+--------------------------------------------------+ 443 | Name | Value | 444 +----------------+--------------------------------------------------+ 445 | Domain: | AS112.ARPA | 446 | | | 447 | Administrative | Internet Architecture Board (IAB) c/o IETF | 448 | Contact: | Administrative Support Activity, ISOC | 449 | | | 450 | Technical | Internet Assigned Numbers Authority (IANA) | 451 | Contact: | | 452 | | | 453 | Nameservers: | As chosen by the IANA, see Section 8.2 | 454 | | | 455 | DS-RDATA: | As chosen by the IANA, see Section 8.2 | 456 +----------------+--------------------------------------------------+ 458 9. Security Considerations 460 This document presents no known additional security concerns to the 461 Internet. 463 For security considerations relating to AS112 service in general, see 464 [I-D.ietf-dnsop-rfc6304bis]. 466 10. Acknowledgements 468 The authors acknowledge the valuable contributions of Bob Harold and 469 other participants in the DNSOP working group in the preparation of 470 this document. 472 11. References 474 11.1. Normative References 476 [I-D.ietf-dnsop-rfc6304bis] 477 Abley, J. and W. Maton, "AS112 Nameserver Operations", 478 draft-ietf-dnsop-rfc6304bis-04 (work in progress), July 479 2014. 481 [RFC1035] Mockapetris, P., "Domain names - implementation and 482 specification", STD 13, RFC 1035, November 1987. 484 [RFC2308] Andrews, M., "Negative Caching of DNS Queries (DNS 485 NCACHE)", RFC 2308, March 1998. 487 [RFC6672] Rose, S. and W. Wijngaards, "DNAME Redirection in the 488 DNS", RFC 6672, June 2012. 490 11.2. Informative References 492 [RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and 493 E. Lear, "Address Allocation for Private Internets", BCP 494 5, RFC 1918, February 1996. 496 [RFC2860] Carpenter, B., Baker, F., and M. Roberts, "Memorandum of 497 Understanding Concerning the Technical Work of the 498 Internet Assigned Numbers Authority", RFC 2860, June 2000. 500 [RFC2928] Hinden, R., Deering, S., Fink, R., and T. Hain, "Initial 501 IPv6 Sub-TLA ID Assignments", RFC 2928, September 2000. 503 [RFC3172] Huston, G., "Management Guidelines & Operational 504 Requirements for the Address and Routing Parameter Area 505 Domain ("arpa")", BCP 52, RFC 3172, September 2001. 507 [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. 508 Rose, "DNS Security Introduction and Requirements", RFC 509 4033, March 2005. 511 [RFC4786] Abley, J. and K. Lindqvist, "Operation of Anycast 512 Services", BCP 126, RFC 4786, December 2006. 514 [RFC5737] Arkko, J., Cotton, M., and L. Vegoda, "IPv4 Address Blocks 515 Reserved for Documentation", RFC 5737, January 2010. 517 [RFC6303] Andrews, M., "Locally Served DNS Zones", BCP 163, RFC 518 6303, July 2011. 520 [RFC6890] Cotton, M., Vegoda, L., Bonica, R., and B. Haberman, 521 "Special-Purpose IP Address Registries", BCP 153, RFC 522 6890, April 2013. 524 Appendix A. Assessing Support for DNAME in the Real World 526 To measure the extent to which the DNAME construct is supported in 527 the Internet, we have used an experimental technique to test the DNS 528 resolvers used by end hosts, and derive from the test a measurement 529 of DNAME support within the Internet. 531 A.1. Methodology 533 The test was conducted by loading a user's browser with 4 URLs to 534 retrieve. The first three comprise the test setup, while the final 535 URL communicates the result the the experiment controller. The URLs 536 are: 538 A http://a..dname.example.com/1x1.png? 539 a..dname 541 B http://b.dname.example.com/1x1.png? 542 b..dname 544 C http://c..target.example.net/1x1.png? 545 c..target 547 D http://results.recorder.example.net/1x1.png? 548 results.?za=&zb=&zc= 550 The A URL is designed to test the end users capability to resolve a 551 name that has never been seen before, so that the resolution of this 552 domain name will reliably result in a query at the authoritative name 553 server. This is intended to test the use of domain names where there 554 is a dynamic component that also uses the DNAME construct. 556 The B URL is deliberately designed to be cached by caching resolvers 557 that are used in the process of resolving the domain name. 559 The C URL is a control URL. This is a unique URL, similar to A, but 560 does not refer to a DNAME structure. 562 The D URL uses a static cacheable domain name. 564 The value is common to the four URLs used in each 565 individual instance of this test, but varies from test to test. The 566 result is that each end user is presented with a unique string. 568 The contents of the EXAMPLE.COM, TARGET.EXAMPLE.NET and 569 RECORDER.EXAMPLE.NET zones are shown in Figure 3. 571 $ORIGIN EXAMPLE.COM. 572 ... 573 DNAME. IN DNAME TARGET.EXAMPLE.NET. 574 ... 576 $ORIGIN TARGET.EXAMPLE.NET. 577 ... 578 B IN A 192.0.2.0 579 * IN A 192.0.2.0 580 ... 582 $ORIGIN RECORDER.EXAMPLE.NET. 583 ... 584 RESULTS IN A 192.0.2.0 585 ... 587 Figure 3 589 The first three URLs (A, B and C) are loaded as tasks into the user's 590 browser upon execution of the test's script. The script starts a 591 timer with each of these URLs to measure the elapsed time to fetch 592 the URL. The script then waits for the three fetches to complete, or 593 10 seconds, whichever occurs first. The script then loads the 594 results of the three timers into the GET arguments of the D URL, and 595 performs a fetch to pass these results back to the experiment's 596 server. 598 Logs on the web server reached at RESULTS.EXAMPLE.NET will include 599 entries of the form shown in Figure 4. If any of the URLs fail to 600 load within 10 secords the D URL will report the failure as a "null" 601 timer value. 603 GET /1x1.png?results.?za=1822&zb=1674&zc=1582 604 GET /1x1.png?results.?za=null&zb=null&zc=161 606 Figure 4 608 The script has been encoded in Adobe Flash with a simple image in the 609 form of an online advertisement. An online advertisement network has 610 been used to distribute the script. The script is invoked when the 611 advertisement is presented in the end user's browser or application, 612 and does not require the user to click on the supplied image in any 613 way. The advertisement placement parameters were set to to broadest 614 possible scope to sample users from across the entire internet. 616 A.2. Results 618 The test was loaded into an advertisement distributed on 2013-10-10 619 and 2013-10-11. 621 +--------------------+---------+------------+ 622 | | Count | Percentage | 623 +--------------------+---------+------------+ 624 | Recorded Results: | 338,478 | | 625 | | | | 626 | A or B Loaded: | 331,896 | 98.1% | 627 | | | | 628 | A Fail and B Fail: | 6,492 | 1.9% | 629 | | | | 630 | A Fail and B Load: | 4,249 | 1.3% | 631 | | | | 632 | A Load and B Fail: | 1,624 | 0.5% | 633 | | | | 634 | C Fail: | 9,355 | 2.8% | 635 +--------------------+---------+------------+ 637 Table 1 639 These results indicate that at most 1.9% of tested clients use DNS 640 resolvers that fail to resolve a domain name that contains a DNAME 641 redirection. However the failure rate of slightly lower than 3% for 642 the control URL indicates that the failure rate for the DNAME 643 construct lies within the bounds of error within the experimental 644 framework. We conclude that there is no evidence of a consistent 645 failure on the part of deployed DNS resolvers to correctly resolve a 646 DNAME construct. 648 This experiment was conducted by Geoff Huston and George Michaelson. 650 Appendix B. Editorial Notes 652 This section (and sub-sections) to be removed prior to publication. 654 B.1. Change History 656 00 Initial write-up of Brian's idea, circulated for the purposes of 657 entertainment. 659 01 Some particularly egregious spelling mistakes fixed. Warren 660 Kumari and George Michaelson added as co-authors. Intended status 661 changed to informational. Appendix on DNAME testing added, 662 describing an experiment conducted by Geoff Huston and George 663 Michaelson. 665 00 Adopted by dnsop in IETF88, Vancouver; resubmitted as draft-ietf- 666 dnsop-as112-dname. Changed contact info for Brian. 668 01 Minor updates following submission of draft-jabley-dnsop- 669 rfc6304bis. 671 02 Text in IANA Considerations section dealing with address 672 assignments modified following informal advice received from Leo 673 Vegoda. 675 03 Updated references to 6304 following guidance from working group 676 chairs. 678 04 Corrected an error picked up by Bob Harold. 680 05 Addressed various comments from the IESG and IAB. Updated 681 Brian's contact info. Minor spelling and grammatical corrections. 682 Added text to the abstract and introduction to reinforce the point 683 that this approach allows liberal use of AS112 infrastructure 684 without coordination with AS112 operators. 686 Authors' Addresses 688 Joe Abley 689 Dyn, Inc. 690 186 Albert Street, Suite 103 691 London, ON N6A 1M1 692 Canada 694 Phone: +1 519 670 9327 695 Email: jabley@dyn.com 696 Brian Dickson 697 Twitter, Inc. 699 Email: bdickson@twitter.com 701 Warren Kumari 702 Google 703 1600 Amphitheatre Parkway 704 Mountain View, CA 94043 705 USA 707 Email: warren@kumari.net 709 George Michaelson 710 APNIC 712 Email: ggm@apnic.net