idnits 2.17.1 draft-ietf-dnsop-as112-dname-00.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- == There are 20 instances of lines with non-RFC2606-compliant FQDNs in the document. -- The document has examples using IPv4 documentation addresses according to RFC6890, but does not use any IPv6 documentation addresses. Maybe there should be IPv6 examples, too? -- The draft header indicates that this document updates RFC6304, but the abstract doesn't seem to mention this, which it should. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year (Using the creation date from RFC6304, updated by this document, for RFC5378 checks: 2007-02-28) -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (November 5, 2013) is 3824 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- ** Obsolete normative reference: RFC 6304 (Obsoleted by RFC 7534) Summary: 1 error (**), 0 flaws (~~), 2 warnings (==), 4 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Abley 3 Internet-Draft Dyn, Inc. 4 Updates: 6304 (if approved) B. Dickson 5 Intended status: Informational Verisign Labs 6 Expires: May 9, 2014 W. Kumari 7 Google 8 G. Michaelson 9 APNIC 10 November 5, 2013 12 AS112 Redirection using DNAME 13 draft-ietf-dnsop-as112-dname-00 15 Abstract 17 Many sites connected to the Internet make use of IPv4 addresses that 18 are not globally unique. Examples are the addresses designated in 19 RFC 1918 for private use within individual sites. 21 Devices in such environments may occasionally originate Domain Name 22 System (DNS) queries (so-called "reverse lookups") corresponding to 23 those private-use addresses. Since the addresses concerned have only 24 local significance, it is good practice for site administrators to 25 ensure that such queries are answered locally. However, it is not 26 uncommon for such queries to follow the normal delegation path in the 27 public DNS instead of being answered within the site. 29 It is not possible for public DNS servers to give useful answers to 30 such queries. In addition, due to the wide deployment of private-use 31 addresses and the continuing growth of the Internet, the volume of 32 such queries is large and growing. The AS112 project aims to provide 33 a distributed sink for such queries in order to reduce the load on 34 the IN-ADDR.ARPA authoritative servers. The AS112 project is named 35 after the Autonomous System Number (ASN) that was assigned to it. 37 The AS112 project does not accommodate the addition and removal of 38 DNS zones elegantly. Since additional zones of definitively local 39 significance are known to exist, this presents a problem. This 40 document describes modifications to the deployment and use of AS112 41 infrastructure that will allow zones to be added and dropped much 42 more easily. 44 Status of this Memo 46 This Internet-Draft is submitted in full conformance with the 47 provisions of BCP 78 and BCP 79. 49 Internet-Drafts are working documents of the Internet Engineering 50 Task Force (IETF). Note that other groups may also distribute 51 working documents as Internet-Drafts. The list of current Internet- 52 Drafts is at http://datatracker.ietf.org/drafts/current/. 54 Internet-Drafts are draft documents valid for a maximum of six months 55 and may be updated, replaced, or obsoleted by other documents at any 56 time. It is inappropriate to use Internet-Drafts as reference 57 material or to cite them other than as "work in progress." 59 This Internet-Draft will expire on May 9, 2014. 61 Copyright Notice 63 Copyright (c) 2013 IETF Trust and the persons identified as the 64 document authors. All rights reserved. 66 This document is subject to BCP 78 and the IETF Trust's Legal 67 Provisions Relating to IETF Documents 68 (http://trustee.ietf.org/license-info) in effect on the date of 69 publication of this document. Please review these documents 70 carefully, as they describe your rights and restrictions with respect 71 to this document. Code Components extracted from this document must 72 include Simplified BSD License text as described in Section 4.e of 73 the Trust Legal Provisions and are provided without warranty as 74 described in the Simplified BSD License. 76 Table of Contents 78 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 79 2. Design Overview . . . . . . . . . . . . . . . . . . . . . . . 5 80 3. AS112 Operations . . . . . . . . . . . . . . . . . . . . . . . 6 81 3.1. Extensions to Support DNAME Redirection . . . . . . . . . 6 82 3.2. Redirection of Query Traffic to AS112 Servers . . . . . . 6 83 4. Continuity of AS112 Operations . . . . . . . . . . . . . . . . 8 84 5. Candidate Zones for AS112 Redirection . . . . . . . . . . . . 9 85 6. DNAME Deployment Considerations . . . . . . . . . . . . . . . 10 86 7. IAB Considerations . . . . . . . . . . . . . . . . . . . . . . 11 87 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 88 8.1. Address Assignment . . . . . . . . . . . . . . . . . . . . 12 89 8.2. Hosting of AS112.ARPA . . . . . . . . . . . . . . . . . . 12 90 8.3. Delegation of AS112.ARPA . . . . . . . . . . . . . . . . . 13 91 9. Security Considerations . . . . . . . . . . . . . . . . . . . 14 92 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 15 93 11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 16 94 11.1. Normative References . . . . . . . . . . . . . . . . . . . 16 95 11.2. Informative References . . . . . . . . . . . . . . . . . . 16 96 Appendix A. Assessing Support for DNAME in the Real World . . . . 17 97 A.1. Methodology . . . . . . . . . . . . . . . . . . . . . . . 17 98 A.2. Results . . . . . . . . . . . . . . . . . . . . . . . . . 19 99 Appendix B. Updates to RFC6304 . . . . . . . . . . . . . . . . . 20 100 B.1. Changes to Section 2.1, Zones . . . . . . . . . . . . . . 20 101 B.2. Changes to Section 2.2, Nameservers . . . . . . . . . . . 20 102 B.3. Changes to Section 3.4, Routing Software . . . . . . . . . 20 103 B.4. Changes to Section 3.5, DNS Software . . . . . . . . . . . 20 104 B.5. Changes to Section 3.6, Testing a Newly Installed Node . . 20 105 B.6. Changes to Section 6, On the Future of AS112 Nodes . . . . 20 106 B.7. Changes to Section 8, Security Considerations . . . . . . 21 107 B.8. Changes to Appendix A, History . . . . . . . . . . . . . . 21 108 Appendix C. Editorial Notes . . . . . . . . . . . . . . . . . . . 22 109 C.1. Change History . . . . . . . . . . . . . . . . . . . . . . 22 110 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 23 112 1. Introduction 114 The AS112 project is described in detail in [RFC6304]. 116 The AS112 nameservers (PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and 117 BLACKHOLE-2.IANA.ORG) are required to answer authoritatively for each 118 and every zone that is delegated to them. 120 If a zone is delegated to AS112 nameservers without those nameservers 121 being configured ahead of time to answer authoritatively for that 122 zone, there is a detrimental impact on clients following referrals 123 for queries within that zone. This misconfiguration is colloquially 124 known as a "lame delegation". 126 AS112 nameserver operators are only loosely-coordinated, and hence 127 adding support for a new zone (or, correspondingly, removing support 128 for a zone that is no longer delegated to the AS112 nameservers) is 129 difficult to accomplish with accuracy; testing AS112 nameservers 130 remotely to see whether they are configured to answer authoritatively 131 for a particular zone is similarly challenging since AS112 nodes are 132 distributed using anycast [RFC4786]. 134 This document proposes that instead of delegating individual zones to 135 AS112 nameservers, DNAME [RFC6672] redirection be used instead. This 136 approach has the advantage that query traffic for arbitrary parts of 137 the namespace can be directed to AS112 servers without those servers 138 having to be reconfigured every time a zone is added or removed. 140 2. Design Overview 142 A new zone, EMPTY.AS112.ARPA, is delegated to a single nameserver 143 BLACKHOLE.AS112.ARPA (IPv4 address TBAv4-1, IPv6 address TBAv6-1). 145 The IPv4 address TBAv4-1 has been assigned by the IANA such that the 146 address is coverable by a single IPv4 /24 prefix, and that no other 147 address covered by that prefix is in use. The IPv6 address TBAv6-1 148 has been similarly assigned such that no other address within a 149 covering /48 is in use. This addressing plan accommodates the 150 anycast distribution of the BLACKHOLE.AS112.ARPA service using a 151 single IPv4 service prefix and a single IPv6 service prefix. See 152 [RFC4786] for more discussion of anycast service distribution; see 153 Section 8 for the specific requests this document makes of the IANA. 155 Some or all of the existing AS112 nodes should be extended to support 156 these new nameserver addresses, and to host the EMPTY.AS112.ARPA 157 zone. See Section 3.1 for guidance to AS112 server operators. 159 Each part of the DNS namespace for which it is desirable to sink 160 queries at AS112 nameservers should be redirected to the 161 EMPTY.AS112.ARPA zone using DNAME [RFC6672]. See Section 3.2 for 162 guidance to zone administrators. 164 3. AS112 Operations 166 3.1. Extensions to Support DNAME Redirection 168 The guidance provided in [RFC6304] is extended to include 169 configuration of the TBAv4-1, and TBAv6-1 addresses, and the 170 corresponding announcement of covering routes for those addresses, 171 and to host the EMPTY.AS112.ARPA zone. 173 IPv4-only AS112 nodes should only configure the TBAv4-1 nameserver 174 address; IPv6-only AS112 nodes should only configure the TBAv6-1 175 nameserver address. 177 It is only necessary for a single AS112 server operator to implement 178 these extensions for this mechanism to function as intended. It is 179 beneficial if many more than one AS112 server operators make these 180 changes, however, since that provides for greater distribution and 181 capacity for the nameservers serving the EMPTY.AS112.ARPA zone. It 182 is not necessary for all AS112 server operators to make these changes 183 for the mechanism to be viable. 185 Detailed instructions for the implementation of these extensions is 186 included in Appendix B. 188 3.2. Redirection of Query Traffic to AS112 Servers 190 Once the EMPTY.AS112.ARPA zone has been deployed using the 191 nameservers described in Section 3.1, redirections may be installed 192 in the DNS namespace for queries that are intended to be answered by 193 the AS112 infrastructure. 195 For example, reverse queries corresponding to TEST-NET-1 196 (192.0.2.0/24) [RFC5737] could be redirected to AS112 nameservers by 197 installing a DNAME resource record in the 192.IN-ADDR.ARPA zone, as 198 illustrated in Figure 1. 200 $ORIGIN 192.IN-ADDR.ARPA. 201 ... 202 2.0.IN-ADDR.ARPA. IN DNAME EMPTY.AS112.ARPA. 203 ... 205 Figure 1 207 There is no practical limit to the number of redirections that can be 208 configured in this fashion. Redirection of a particular part of the 209 namespace to EMPTY.AS112.ARPA can be removed at any time, under the 210 control of the administrators of the corresponding part of the DNS 211 namespace. No changes to deployed AS112 nodes incorporating the 212 extensions described in this document are required to support 213 additional redirections. A list of possible candidates for AS112 214 redirection can be found in Section 5. 216 DNAME resource records deployed for this purpose can be signed with 217 DNSSEC [RFC4033], providing a secure means of authenticating the 218 legitimacy of each redirection. 220 4. Continuity of AS112 Operations 222 Existing guidance to AS112 server operators to accept and respond to 223 queries directed at the PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and 224 BLACKHOLE-2.IANA.ORG nameservers should continue to be followed, and 225 no changes to the delegation of existing zones hosted on AS112 226 servers should occur. These measures are intended to provide 227 continuity of operations for zones currently delegated to AS112 228 servers and avoid any accidental client impact due to the changes 229 proposed in this document. 231 Once it has become empirically and quantitatively clear that the 232 EMPTY.AS112.ARPA zone is well-hosted to the extent that it is thought 233 that the existing, unmodified AS112 servers host 10.IN-ADDR.ARPA, the 234 decision might be made to replace the delegation of those [RFC1918] 235 zones with DNAME redirection. Once implemented, the 236 PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and BLACKHOLE-2.IANA.ORG 237 nameservers could be retired. This document gives no such direction 238 to the IANA, however. 240 5. Candidate Zones for AS112 Redirection 242 All zones listed in [RFC6303] are candidates for AS112 redirection. 244 Since no pre-provisioning is required on the part of AS112 operators 245 to facilitate sinking of any name in the DNS namespace by AS112 246 infrastructure, this mechanism supports AS112 redirection by any zone 247 owner in the DNS. 249 This document is simply concerned with provision of the AS112 250 redirection service, and does not specify that any particular AS112 251 redirection be put in place. 253 6. DNAME Deployment Considerations 255 DNAME was specified a significant time following the original 256 implementations of [RFC1035], and hence universal deployment cannot 257 be expected. [RFC6672] specifies a fall-back mechanism which makes 258 use of synthesised CNAME RRSets for this reason. The expectation 259 that design choices in the DNAME specification ought to mitigate any 260 lack of deployment is reviewed below. Experimental validation of 261 those expectations is included in Appendix A. 263 It is a fundamental design requirement of AS112 service that 264 responses be cached. We can safely declare DNAME support on the 265 authoritative server to be a prerequisite for DNAME redirection, but 266 the cases where individual elements in resolver chains do not support 267 DNAME processing deserve closer examination. 269 The expected behaviour when a DNAME response is supplied to a 270 resolver that does not support DNAME is that the accompanying, 271 synthesised CNAME will be accepted and cached. Re-query frequency 272 will be determined by the TTLs returned by the DNAME-responding 273 authoritative servers. 275 Resolution of the CNAME target is straightforward and functions 276 exactly as the AS112 project has operated since it was deployed. The 277 negative caching [RFC2308] of the CNAME target follows the parameters 278 defined in the target zone, EMPTY.AS112.ARPA. This has the side- 279 effects that all redirected names ultimately landing on an AS112 node 280 will be negatively-cached with the same parameters, but this lack of 281 flexibility seems non-controversial; the effect of reducing the 282 negative cache TTL would be increased query volume on the AS112 node 283 operator concerned, and hence controls seem well-aligned with 284 operation. 286 Validating resolvers (i.e. those requesting and processing DNSSEC 287 [RFC4033] metadata) are required to implement DNAME, and hence should 288 not make use of synthesised CNAME RRs. The lack of signature over a 289 received CNAME RR should hence not limit the ability to sign the 290 redirection point, and for those signatures to be validated. 292 In the case where a recursive server implements DNAME, but DNAME is 293 not implemented in a stub resolver, CNAME synthesis will again 294 provide a viable path. 296 DNAME support on AS112 nodes themselves is never required under this 297 proposal. 299 7. IAB Considerations 301 This document proposes a delegation within the ARPA domain, and, in 302 accordance with [RFC3172], IAB review and approval of the delegation 303 of AS112.ARPA as described in Section 8 is required. 305 Once IAB approval has been obtained, this section may be removed 306 prior to publication or updated to include text that confirms the 307 IAB's decision, at the IAB's discretion. 309 8. IANA Considerations 311 8.1. Address Assignment 313 The IANA is requested to assign one IPv4 /24 netblock and one IPv6 314 /48 netblock that, to the best of their knowledge, should be suitable 315 for announcement as a single IPv4 /24 prefix and a single IPv6 prefix 316 on the global Internet, respectively. 318 Once assigned, all occurrences of TBAv4 in this document should be 319 replaced by the IPv4 netblock assigned, in conventional notation. 320 Occurrences of TBAv4-1 should be replaced with an address from the 321 netblock with lowest octet set to 1. Similarly, all occurrences of 322 TBAv6 in this document should be replaced by the IPv6 netblock 323 assigned, in conventional notation, and TBAv6-1 replaced with an 324 address from that netblock with the lowest 48 bits set to the value 325 1. Once those changes are made, this paragraph may be removed prior 326 to publication. 328 The netblocks assigned by the IANA for this purpose are TBAv4 and 329 TBAv6. 331 8.2. Hosting of AS112.ARPA 333 The IANA is requested to host and sign the zone AS112.ARPA using 334 nameservers and DNSSEC signing infrastructure of their choosing, as 335 shown in Figure 2. SOA RDATA may be adjusted by the IANA to suit 336 their operational requirements. 338 $ORIGIN AS112.ARPA. 339 $TTL 3600 341 @ IN SOA BLACKHOLE.AS112.ARPA. NOC.DNS.ICANN.ORG. ( 342 1 ; serial 343 10800 ; refresh 344 3600 ; retry 345 1209600 ; expire 346 3600 ) ; negative cache TTL 348 NS A.IANA-SERVERS.NET. 349 NS B.IANA-SERVERS.NET. 350 NS C.IANA-SERVERS.NET. 352 BLACKHOLE A TBAv4-1 353 AAAA TBAv6-1 355 EMPTY NS BLACKHOLE 356 Figure 2 358 8.3. Delegation of AS112.ARPA 360 Once the AS112.ARPA zone is being hosted in production, the IANA is 361 requested to arrange delegation from the ARPA zone according to 362 normal IANA procedure for ARPA zone management, to the nameservers 363 used in carrying out the direction in Section 8.2. The following 364 metadata is suggested for the delegation, but may be changed by the 365 IANA if required: 367 +----------------+--------------------------------------------------+ 368 | Name | Value | 369 +----------------+--------------------------------------------------+ 370 | Domain: | AS112.ARPA | 371 | | | 372 | Administrative | Internet Architecture Board (IAB) c/o IETF | 373 | Contact: | Administrative Support Activity, ISOC | 374 | | | 375 | Technical | Internet Assigned Numbers Authority (IANA) | 376 | Contact: | | 377 | | | 378 | Nameservers: | As chosen by the IANA, see Section 8.2 | 379 | | | 380 | DS-RDATA: | As chosen by the IANA, see Section 8.2 | 381 +----------------+--------------------------------------------------+ 383 9. Security Considerations 385 This document presents no known additional security concerns to the 386 Internet. 388 For security considerations relating to AS112 service in general, see 389 [RFC6304]. 391 10. Acknowledgements 393 Your name here, etc. 395 11. References 397 11.1. Normative References 399 [RFC1035] Mockapetris, P., "Domain names - implementation and 400 specification", STD 13, RFC 1035, November 1987. 402 [RFC2308] Andrews, M., "Negative Caching of DNS Queries (DNS 403 NCACHE)", RFC 2308, March 1998. 405 [RFC6304] Abley, J. and W. Maton, "AS112 Nameserver Operations", 406 RFC 6304, July 2011. 408 [RFC6672] Rose, S. and W. Wijngaards, "DNAME Redirection in the 409 DNS", RFC 6672, June 2012. 411 11.2. Informative References 413 [RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and 414 E. Lear, "Address Allocation for Private Internets", 415 BCP 5, RFC 1918, February 1996. 417 [RFC3172] Huston, G., "Management Guidelines & Operational 418 Requirements for the Address and Routing Parameter Area 419 Domain ("arpa")", BCP 52, RFC 3172, September 2001. 421 [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. 422 Rose, "DNS Security Introduction and Requirements", 423 RFC 4033, March 2005. 425 [RFC4786] Abley, J. and K. Lindqvist, "Operation of Anycast 426 Services", BCP 126, RFC 4786, December 2006. 428 [RFC5737] Arkko, J., Cotton, M., and L. Vegoda, "IPv4 Address Blocks 429 Reserved for Documentation", RFC 5737, January 2010. 431 [RFC6303] Andrews, M., "Locally Served DNS Zones", BCP 163, 432 RFC 6303, July 2011. 434 Appendix A. Assessing Support for DNAME in the Real World 436 To measure the extent to which the DNAME construct is supported in 437 the Internet, we have used an experimental technique to test the DNS 438 resolvers used by end hosts, and derive from the test a measurement 439 of DNAME support within the Internet. 441 A.1. Methodology 443 The test was conducted by loading a user's browser with 4 URLs to 444 retrieve. The first three comprise the test setup, while the final 445 URL communicates the result the the experiment controller. The URLs 446 are: 448 A http://a..dname.example.com/1x1.png? 449 a..dname 451 B http://b.dname.example.com/1x1.png? 452 b..dname 454 C http://c..target.example.net/1x1.png? 455 c..target 457 D http://results.recorder.example.net/1x1.png? 458 results.?za=&zb=&zc= 460 The A URL is designed to test the end users capability to resolve a 461 name that has never been seen before, so that the resolution of this 462 domain name will reliably result in a query at the authoritative name 463 server. This is intended to test the use of domain names where there 464 is a dynamic component that also uses the DNAME construct. 466 The B URL is deliberately designed to be cached by caching resolvers 467 that are used in the process of resolving the domain name. 469 The C URL is a control URL. This is a unique URL, similar to A, but 470 does not refer to a DNAME structure. 472 The D URL uses a static cacheable domain name. 474 The value is common to the four URLs used in each 475 individual instance of this test, but varies from test to test. The 476 result is that each end user is presented with a unique string. 478 The contents of the EXAMPLE.COM, TARGET.EXAMPLE.NET and 479 RECORDER.EXAMPLE.NET zones are shown in Figure 3. 481 $ORIGIN EXAMPLE.COM. 482 ... 483 DNAME. IN DNAME TARGET.EXAMPLE.NET. 484 ... 486 $ORIGIN TARGET.EXAMPLE.NET. 487 ... 488 B IN A 192.0.2.0 489 * IN A 192.0.2.0 490 ... 492 $ORIGIN RECORDER.EXAMPLE.NET. 493 ... 494 RESULTS IN A 192.0.2.0 495 ... 497 Figure 3 499 The first three URLs (A, B and C) are loaded as tasks into the user's 500 browser upon execution of the test's script. The script starts a 501 timer with each of these URLs to measure the elapsed time to fetch 502 the URL. The script then waits for the three fetches to complete, or 503 10 seconds, whichever occurs first. The script then loads the 504 results of the three timers into the GET arguments of the D URL, and 505 performs a fetch to pass these results back to the experiment's 506 server. 508 Logs on the web server reached at RESULTS.EXAMPLE.NET will include 509 entries of the form shown in Figure 4. If any of the URLs fail to 510 load within 10 secords the D URL will report the failure as a "null" 511 timer value. 513 GET /1x1.png?results.?za=1822&zb=1674&zc=1582 514 GET /1x1.png?results.?za=null&zb=null&zc=161 516 Figure 4 518 The script has been encoded in Adobe Flash with a simple image in the 519 form of an online advertisement. An online advertisement network has 520 been used to distribute the script. The script is invoked when the 521 advertisement is presented in the end user's browser or application, 522 and does not require the user to click on the supplied image in any 523 way. The advertisement placement parameters were set to to broadest 524 possible scope to sample users from across the entire internet. 526 A.2. Results 528 The test was loaded into an advertisement distributed on the 529 2013-10-10 and 2013-10-11. 531 +--------------------+---------+------------+ 532 | | Count | Percentage | 533 +--------------------+---------+------------+ 534 | Recorded Results: | 338,478 | | 535 | | | | 536 | A or B Loaded: | 331,896 | 98.1% | 537 | | | | 538 | A Fail and B Fail: | 6,492 | 1.9% | 539 | | | | 540 | A Fail and B Load: | 4,249 | 1.3% | 541 | | | | 542 | A Load and B Fail: | 1,624 | 0.5% | 543 | | | | 544 | C Fail: | 9,355 | 2.8% | 545 +--------------------+---------+------------+ 547 Table 1 549 These results indicate that at most 1.9% of tested clients use DNS 550 resolvers that fail to resolve a domain name that contains a DNAME 551 redirection. However the failure rate of slightly lower than 3% for 552 the control URL indicates that the failure rate for the DNAME 553 construct lies within the bounds of error within the experimental 554 framework. We conclude that there is no evidence of a consistent 555 failure on the part of deployed DNS resolvers to correctly resolve a 556 DNAME construct. 558 This experiment was conducted by Geoff Huston and George Michaelson. 560 Appendix B. Updates to RFC6304 562 The following changes are required to [RFC6304] to provide support 563 for AS112 redirection. It is proposed that a successor document to 564 [RFC6304] be prepared for joint publication with this document in the 565 interests of providing clear advice to prospective new AS112 566 operators. The following sub-sections are hence provided mainly only 567 to describe the scope of the changes required for 6304bis, and are 568 not intended for publication in this document. References to this 569 section in this document should ultimately be replaced with 570 references to 6304bis. 572 B.1. Changes to Section 2.1, Zones 574 The list of zones that the AS112 nameserver should answer 575 authoritatively for is extended to include EMPTY.AS112.ARPA. 577 B.2. Changes to Section 2.2, Nameservers 579 The nameserver BLACKHOLE.AS112.ARPA (IPv4 address TBAv4-1, IPv6 580 address TBAv6-1) is added to the list of nameserver addresses that 581 the AS112 node should support. The IPv4 prefix TBAv4/24 and the IPv6 582 prefix TBAv6/48 are added as new prefixes to be originated. 584 B.3. Changes to Section 3.4, Routing Software 586 The sample configuration provided in this section is extended to 587 accommodate the IPv4 and IPv6 service prefixes associated with AS112 588 redirection, TBAv4/24 and TBAv6/48, respectively. 590 B.4. Changes to Section 3.5, DNS Software 592 The sample configuration provided in this section is extended to 593 accommodate the TBAv4-1 and TBAv6-1 addresses and the 594 EMPTY.AS112.ARPA zone. The contents of the EMPTY.AS112.ARPA zone 595 should be specified (nameservers differ from that included as 596 "db.empty"). 598 B.5. Changes to Section 3.6, Testing a Newly Installed Node 600 Testing should be extended to test for correct hosting of the 601 EMPTY.AS112.ARPA zone. 603 B.6. Changes to Section 6, On the Future of AS112 Nodes 605 A reference to this document should be included. 607 B.7. Changes to Section 8, Security Considerations 609 Mention should be made that AS112 redirection, as specified in this 610 document, supports DNSSEC in the sense that the DNAME records which 611 signal the redirection can be signed. 613 B.8. Changes to Appendix A, History 615 A reference to this document should be included. 617 Appendix C. Editorial Notes 619 This section (and sub-sections) to be removed prior to publication. 621 C.1. Change History 623 00 Initial write-up of Brian's idea, circulated for the purposes of 624 entertainment. 626 01 Some particularly egregious spelling mistakes fixed. Warren 627 Kumari and George Michaelson added as co-authors. Intended status 628 changed to informational. Appendix on DNAME testing added, 629 describing an experiment conducted by Geoff Huston and George 630 Michaelson. 632 00 Adopted by dnsop in IETF88, Vancouver; resubmitted as 633 draft-ietf-dnsop-as112-dname. Changed contact info for Brian. 635 Authors' Addresses 637 Joe Abley 638 Dyn, Inc. 639 470 Moore Street 640 London, ON N6C 2C2 641 Canada 643 Phone: +1 519 670 9327 644 Email: jabley@dyn.com 646 Brian Dickson 647 Verisign Labs 648 12061 Bluemont Way 649 Reston, VA 20190 651 Email: bdickson@verisign.com 653 Warren Kumari 654 Google 655 1600 Amphitheatre Parkway 656 Mountain View, CA 94043 658 Email: warren@kumari.net 660 George Michaelson 661 APNIC 663 Email: ggm@apnic.net