|
North American Network Operators Group
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
Re: Root Server Operators (Re: What *are* they smoking?)
- From: Jack Bates
- Date: Wed Sep 17 12:43:46 2003
Aaron Dewell wrote:
The point is, this makes a reasonable backup plan. Far from ideal, but
we're dealing with a state-supported monopoly who can do whatever they
want. Get this in place, then think about how to throw the monopolies
out. This works in the meantime. They will likely compromise this far,
even if they won't back down.
I'm thinking security for the long term. Even if com and net are
returned to their non-wildcard states, there are other tld's which will
continue using wildcards. Subject to a wildcard bit being implemented to
DNS, my suggested method allows for optimum performance and
functionality when DNS is being used as part of a security model.
The TTL is 15 minutes, so your hypothetical server would be throwing away
it's cache every 15 minutes. Then re-querying everything. You'd have to
have a _lot_ of outgoing email to justify that.
I don't know about you, but I don't want to cache bogus information for
longer than 15 minutes. If someone sends random-string domains as the
envelope from to my mail server, I want the cache to purge itself
quickly. Yet, if they are sending the same bad address to my mail server
repetitively, I want my cache to hold the record briefly; say 15
minutes. I'd hate to see a spammer issuing jlkfsjklfsj.com 5,000 times
to my mail server in rapid succession and my recursor have to ask for it
every time. On the other side, I would hate to cache 100,000 bogus
domains for 1 day, wasting cache.
This solution still requires increased overhead, and more modifications
to BIND. Which has more impact on your server, this BIND overhead, or one
additional query from your MTA? My guess is the query is cheaper overall.
And you have to convince ISC to implement these changes, or write them
yourself, then you have the potential cost of an unstable nameserver.
Overall, I'd take the one addition query based on the compromise solution.
My mail server doesn't use a bind recursor, so I'll end up making the
change myself for that particular system. However, a solution needs to
be devised for the long term. The best solution is a wildcard bit.
Second to that, smart recursors and resolvers that can detect the wildcard.
-Jack
|
|
|
