idnits 2.17.1 draft-ietf-dnsop-as112-dname-04.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- == There are 21 instances of lines with non-RFC2606-compliant FQDNs in the document. == There are 1 instance of lines with non-RFC6890-compliant IPv4 addresses in the document. If these are example addresses, they should be changed. == There are 1 instance of lines with non-RFC3849-compliant IPv6 addresses in the document. If these are example addresses, they should be changed. -- The document has examples using IPv4 documentation addresses according to RFC6890, but does not use any IPv6 documentation addresses. Maybe there should be IPv6 examples, too? Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (June 27, 2014) is 3589 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- == Outdated reference: A later version (-06) exists of draft-ietf-dnsop-rfc6304bis-00 Summary: 0 errors (**), 0 flaws (~~), 5 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Abley 3 Internet-Draft Dyn, Inc. 4 Intended status: Informational B. Dickson 5 Expires: December 29, 2014 Verisign Labs 6 W. Kumari 7 Google 8 G. Michaelson 9 APNIC 10 June 27, 2014 12 AS112 Redirection using DNAME 13 draft-ietf-dnsop-as112-dname-04 15 Abstract 17 Many sites connected to the Internet make use of IPv4 addresses that 18 are not globally unique. Examples are the addresses designated in 19 RFC 1918 for private use within individual sites. 21 Devices in such environments may occasionally originate Domain Name 22 System (DNS) queries (so-called "reverse lookups") corresponding to 23 those private-use addresses. Since the addresses concerned have only 24 local significance, it is good practice for site administrators to 25 ensure that such queries are answered locally. However, it is not 26 uncommon for such queries to follow the normal delegation path in the 27 public DNS instead of being answered within the site. 29 It is not possible for public DNS servers to give useful answers to 30 such queries. In addition, due to the wide deployment of private-use 31 addresses and the continuing growth of the Internet, the volume of 32 such queries is large and growing. The AS112 project aims to provide 33 a distributed sink for such queries in order to reduce the load on 34 the IN-ADDR.ARPA authoritative servers. The AS112 project is named 35 after the Autonomous System Number (ASN) that was assigned to it. 37 The AS112 project does not accommodate the addition and removal of 38 DNS zones elegantly. Since additional zones of definitively local 39 significance are known to exist, this presents a problem. This 40 document describes modifications to the deployment and use of AS112 41 infrastructure that will allow zones to be added and dropped much 42 more easily. 44 Status of this Memo 46 This Internet-Draft is submitted in full conformance with the 47 provisions of BCP 78 and BCP 79. 49 Internet-Drafts are working documents of the Internet Engineering 50 Task Force (IETF). Note that other groups may also distribute 51 working documents as Internet-Drafts. The list of current Internet- 52 Drafts is at http://datatracker.ietf.org/drafts/current/. 54 Internet-Drafts are draft documents valid for a maximum of six months 55 and may be updated, replaced, or obsoleted by other documents at any 56 time. It is inappropriate to use Internet-Drafts as reference 57 material or to cite them other than as "work in progress." 59 This Internet-Draft will expire on December 29, 2014. 61 Copyright Notice 63 Copyright (c) 2014 IETF Trust and the persons identified as the 64 document authors. All rights reserved. 66 This document is subject to BCP 78 and the IETF Trust's Legal 67 Provisions Relating to IETF Documents 68 (http://trustee.ietf.org/license-info) in effect on the date of 69 publication of this document. Please review these documents 70 carefully, as they describe your rights and restrictions with respect 71 to this document. Code Components extracted from this document must 72 include Simplified BSD License text as described in Section 4.e of 73 the Trust Legal Provisions and are provided without warranty as 74 described in the Simplified BSD License. 76 Table of Contents 78 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 79 2. Design Overview . . . . . . . . . . . . . . . . . . . . . . . 5 80 3. AS112 Operations . . . . . . . . . . . . . . . . . . . . . . . 6 81 3.1. Extensions to Support DNAME Redirection . . . . . . . . . 6 82 3.2. Redirection of Query Traffic to AS112 Servers . . . . . . 6 83 4. Continuity of AS112 Operations . . . . . . . . . . . . . . . . 8 84 5. Candidate Zones for AS112 Redirection . . . . . . . . . . . . 9 85 6. DNAME Deployment Considerations . . . . . . . . . . . . . . . 10 86 7. IAB Considerations . . . . . . . . . . . . . . . . . . . . . . 11 87 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 88 8.1. Address Assignment . . . . . . . . . . . . . . . . . . . . 12 89 8.2. Hosting of AS112.ARPA . . . . . . . . . . . . . . . . . . 13 90 8.3. Delegation of AS112.ARPA . . . . . . . . . . . . . . . . . 14 91 9. Security Considerations . . . . . . . . . . . . . . . . . . . 15 92 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 16 93 11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 17 94 11.1. Normative References . . . . . . . . . . . . . . . . . . . 17 95 11.2. Informative References . . . . . . . . . . . . . . . . . . 17 96 Appendix A. Assessing Support for DNAME in the Real World . . . . 18 97 A.1. Methodology . . . . . . . . . . . . . . . . . . . . . . . 18 98 A.2. Results . . . . . . . . . . . . . . . . . . . . . . . . . 20 99 Appendix B. Editorial Notes . . . . . . . . . . . . . . . . . . . 21 100 B.1. Change History . . . . . . . . . . . . . . . . . . . . . . 21 101 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 22 103 1. Introduction 105 The AS112 project is described in detail in [RFC6304bis]. 107 The AS112 nameservers (PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and 108 BLACKHOLE-2.IANA.ORG) are required to answer authoritatively for each 109 and every zone that is delegated to them. 111 If a zone is delegated to AS112 nameservers without those nameservers 112 being configured ahead of time to answer authoritatively for that 113 zone, there is a detrimental impact on clients following referrals 114 for queries within that zone. This misconfiguration is colloquially 115 known as a "lame delegation". 117 AS112 nameserver operators are only loosely-coordinated, and hence 118 adding support for a new zone (or, correspondingly, removing support 119 for a zone that is no longer delegated to the AS112 nameservers) is 120 difficult to accomplish with accuracy; testing AS112 nameservers 121 remotely to see whether they are configured to answer authoritatively 122 for a particular zone is similarly challenging since AS112 nodes are 123 distributed using anycast [RFC4786]. 125 This document proposes a more flexibl approach for sinking queries on 126 AS112 infrastructure that can be deployed alongside unmodified, 127 existing AS112 nodes. Instead of delegating additional zones 128 directly to AS112 nameservers, DNAME [RFC6672] redirection is used 129 instead. This approach has the advantage that query traffic for 130 arbitrary parts of the namespace can be directed to AS112 servers 131 without those servers having to be reconfigured every time a zone is 132 added or removed. 134 2. Design Overview 136 A new zone, EMPTY.AS112.ARPA, is delegated to a single nameserver 137 BLACKHOLE.AS112.ARPA (IPv4 address TBAv4-1, IPv6 address TBAv6-1). 139 The IPv4 address TBAv4-1 has been assigned by the IANA such that the 140 address is coverable by a single IPv4 /24 prefix, and that no other 141 address covered by that prefix is in use. The IPv6 address TBAv6-1 142 has been similarly assigned such that no other address within a 143 covering /48 is in use. This addressing plan accommodates the 144 anycast distribution of the BLACKHOLE.AS112.ARPA service using a 145 single IPv4 service prefix and a single IPv6 service prefix. See 146 [RFC4786] for more discussion of anycast service distribution; see 147 Section 8 for the specific requests this document makes of the IANA. 149 Some or all of the existing AS112 nodes should be extended to support 150 these new nameserver addresses, and to host the EMPTY.AS112.ARPA 151 zone. See [RFC6304bis] for revised guidance to AS112 server 152 operators. 154 Each part of the DNS namespace for which it is desirable to sink 155 queries at AS112 nameservers should be redirected to the 156 EMPTY.AS112.ARPA zone using DNAME [RFC6672]. See Section 3.2 for 157 guidance to zone administrators. 159 3. AS112 Operations 161 3.1. Extensions to Support DNAME Redirection 163 Guidance to operators of AS112 nodes is extended to include 164 configuration of the TBAv4-1, and TBAv6-1 addresses, and the 165 corresponding announcement of covering routes for those addresses, 166 and to host the EMPTY.AS112.ARPA zone. 168 IPv4-only AS112 nodes should only configure the TBAv4-1 nameserver 169 address; IPv6-only AS112 nodes should only configure the TBAv6-1 170 nameserver address. 172 It is only necessary for a single AS112 server operator to implement 173 these extensions for this mechanism to function as intended. It is 174 beneficial if many more than one AS112 server operators make these 175 changes, however, since that provides for greater distribution and 176 capacity for the nameservers serving the EMPTY.AS112.ARPA zone. It 177 is not necessary for all AS112 server operators to make these changes 178 for the mechanism to be viable. 180 Detailed instructions for the implementation of these extensions is 181 included in [RFC6304bis]. 183 3.2. Redirection of Query Traffic to AS112 Servers 185 Once the EMPTY.AS112.ARPA zone has been deployed using the 186 nameservers described in Section 3.1, redirections may be installed 187 in the DNS namespace for queries that are intended to be answered by 188 the AS112 infrastructure. 190 For example, reverse queries corresponding to TEST-NET-1 191 (192.0.2.0/24) [RFC5737] could be redirected to AS112 nameservers by 192 installing a DNAME resource record in the 192.IN-ADDR.ARPA zone, as 193 illustrated in Figure 1. 195 $ORIGIN 192.IN-ADDR.ARPA. 196 ... 197 2.0 IN DNAME EMPTY.AS112.ARPA. 198 ... 200 Figure 1 202 There is no practical limit to the number of redirections that can be 203 configured in this fashion. Redirection of a particular part of the 204 namespace to EMPTY.AS112.ARPA can be removed at any time, under the 205 control of the administrators of the corresponding part of the DNS 206 namespace. No changes to deployed AS112 nodes incorporating the 207 extensions described in this document are required to support 208 additional redirections. A list of possible candidates for AS112 209 redirection can be found in Section 5. 211 DNAME resource records deployed for this purpose can be signed with 212 DNSSEC [RFC4033], providing a secure means of authenticating the 213 legitimacy of each redirection. 215 4. Continuity of AS112 Operations 217 Existing guidance to AS112 server operators to accept and respond to 218 queries directed at the PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and 219 BLACKHOLE-2.IANA.ORG nameservers should continue to be followed, and 220 no changes to the delegation of existing zones hosted on AS112 221 servers should occur. These measures are intended to provide 222 continuity of operations for zones currently delegated to AS112 223 servers and avoid any accidental client impact due to the changes 224 proposed in this document. 226 Once it has become empirically and quantitatively clear that the 227 EMPTY.AS112.ARPA zone is well-hosted to the extent that it is thought 228 that the existing, unmodified AS112 servers host 10.IN-ADDR.ARPA, the 229 decision might be made to replace the delegation of those [RFC1918] 230 zones with DNAME redirection. Once implemented, the 231 PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG and BLACKHOLE-2.IANA.ORG 232 nameservers could be retired. This document gives no such direction 233 to the IANA, however. 235 5. Candidate Zones for AS112 Redirection 237 All zones listed in [RFC6303] are candidates for AS112 redirection. 239 Since no pre-provisioning is required on the part of AS112 operators 240 to facilitate sinking of any name in the DNS namespace by AS112 241 infrastructure, this mechanism supports AS112 redirection by any zone 242 owner in the DNS. 244 This document is simply concerned with provision of the AS112 245 redirection service, and does not specify that any particular AS112 246 redirection be put in place. 248 6. DNAME Deployment Considerations 250 DNAME was specified a significant time following the original 251 implementations of [RFC1035], and hence universal deployment cannot 252 be expected. [RFC6672] specifies a fall-back mechanism which makes 253 use of synthesised CNAME RRSets for this reason. The expectation 254 that design choices in the DNAME specification ought to mitigate any 255 lack of deployment is reviewed below. Experimental validation of 256 those expectations is included in Appendix A. 258 It is a fundamental design requirement of AS112 service that 259 responses be cached. We can safely declare DNAME support on the 260 authoritative server to be a prerequisite for DNAME redirection, but 261 the cases where individual elements in resolver chains do not support 262 DNAME processing deserve closer examination. 264 The expected behaviour when a DNAME response is supplied to a 265 resolver that does not support DNAME is that the accompanying, 266 synthesised CNAME will be accepted and cached. Re-query frequency 267 will be determined by the TTLs returned by the DNAME-responding 268 authoritative servers. 270 Resolution of the CNAME target is straightforward and functions 271 exactly as the AS112 project has operated since it was deployed. The 272 negative caching [RFC2308] of the CNAME target follows the parameters 273 defined in the target zone, EMPTY.AS112.ARPA. This has the side- 274 effects that all redirected names ultimately landing on an AS112 node 275 will be negatively-cached with the same parameters, but this lack of 276 flexibility seems non-controversial; the effect of reducing the 277 negative cache TTL would be increased query volume on the AS112 node 278 operator concerned, and hence controls seem well-aligned with 279 operation. 281 Validating resolvers (i.e. those requesting and processing DNSSEC 282 [RFC4033] metadata) are required to implement DNAME, and hence should 283 not make use of synthesised CNAME RRs. The lack of signature over a 284 received CNAME RR should hence not limit the ability to sign the 285 redirection point, and for those signatures to be validated. 287 In the case where a recursive server implements DNAME, but DNAME is 288 not implemented in a stub resolver, CNAME synthesis will again 289 provide a viable path. 291 DNAME support on AS112 nodes themselves is never required under this 292 proposal. 294 7. IAB Considerations 296 This document proposes a delegation within the ARPA domain, and, in 297 accordance with [RFC3172], IAB review and approval of the delegation 298 of AS112.ARPA as described in Section 8 is required. 300 Once IAB approval has been obtained, this section may be removed 301 prior to publication or updated to include text that confirms the 302 IAB's decision, at the IAB's discretion. 304 8. IANA Considerations 306 8.1. Address Assignment 308 The IANA is requested to assign one IPv4 /24 netblock and register 309 its use in the IPv4 Special-Purpose Address Registry [RFC6890] as 310 follows: 312 +----------------------+--------------------------------+ 313 | Name | Value | 314 +----------------------+--------------------------------+ 315 | Address Block | As determined by IANA | 316 | | | 317 | Name | AS112-v4 | 318 | | | 319 | RFC | This document (when published) | 320 | | | 321 | Allocation Date | As determined by IANA | 322 | | | 323 | Termination Date | N/A | 324 | | | 325 | Source | True | 326 | | | 327 | Destination | True | 328 | | | 329 | Forwardable | True | 330 | | | 331 | Global | True | 332 | | | 333 | Reserved-by-Protocol | False | 334 +----------------------+--------------------------------+ 336 We suggest that IANA assign 192.31.196.0/24 from the IPv4 Recovered 337 Address Space Registry, but any /24 which has been unassigned and 338 unadvertised for at least twelve months is acceptable. 340 The IANA is requested to assign one IPv6 /48 netblock and register 341 its use in the IPv6 Special-Purpose Address Registry [RFC6890] as 342 follows: 344 +----------------------+--------------------------------+ 345 | Name | Value | 346 +----------------------+--------------------------------+ 347 | Address Block | As determined by IANA | 348 | | | 349 | Name | AS112-v6 | 350 | | | 351 | RFC | This document (when published) | 352 | | | 353 | Allocation Date | As determined by IANA | 354 | | | 355 | Termination Date | N/A | 356 | | | 357 | Source | True | 358 | | | 359 | Destination | True | 360 | | | 361 | Forwardable | True | 362 | | | 363 | Global | True | 364 | | | 365 | Reserved-by-Protocol | False | 366 +----------------------+--------------------------------+ 368 We suggest that IANA assign 2001:112::/48 from the IETF Protocol 369 Assignments allocation [RFC2928], but /48 which has been unassigned 370 and unadvertised for at least twelve months is acceptable. 372 Once assigned, all occurrences of TBAv4 in this document should be 373 replaced by the IPv4 netblock assigned, in conventional notation. 374 Occurrences of TBAv4-1 should be replaced with an address from the 375 netblock with lowest octet set to 1. Similarly, all occurrences of 376 TBAv6 in this document should be replaced by the IPv6 netblock 377 assigned, in conventional notation, and TBAv6-1 replaced with an 378 address from that netblock with the lowest 48 bits set to the value 379 1. Once those changes are made, this paragraph may be removed prior 380 to publication. 382 The netblocks assigned by the IANA for this purpose are TBAv4 and 383 TBAv6. 385 8.2. Hosting of AS112.ARPA 387 The IANA is requested to host and sign the zone AS112.ARPA using 388 nameservers and DNSSEC signing infrastructure of their choosing, as 389 shown in Figure 2. SOA RDATA may be adjusted by the IANA to suit 390 their operational requirements. 392 $ORIGIN AS112.ARPA. 393 $TTL 3600 395 @ IN SOA BLACKHOLE.AS112.ARPA. NOC.DNS.ICANN.ORG. ( 396 1 ; serial 397 10800 ; refresh 398 3600 ; retry 399 1209600 ; expire 400 3600 ) ; negative cache TTL 402 NS A.IANA-SERVERS.NET. 403 NS B.IANA-SERVERS.NET. 404 NS C.IANA-SERVERS.NET. 406 BLACKHOLE A TBAv4-1 407 AAAA TBAv6-1 409 HOSTNAME NS BLACKHOLE 411 EMPTY NS BLACKHOLE 413 Figure 2 415 8.3. Delegation of AS112.ARPA 417 Once the AS112.ARPA zone is being hosted in production, the IANA is 418 requested to arrange delegation from the ARPA zone according to 419 normal IANA procedure for ARPA zone management, to the nameservers 420 used in carrying out the direction in Section 8.2. The following 421 metadata is suggested for the delegation, but may be changed by the 422 IANA if required: 424 +----------------+--------------------------------------------------+ 425 | Name | Value | 426 +----------------+--------------------------------------------------+ 427 | Domain: | AS112.ARPA | 428 | | | 429 | Administrative | Internet Architecture Board (IAB) c/o IETF | 430 | Contact: | Administrative Support Activity, ISOC | 431 | | | 432 | Technical | Internet Assigned Numbers Authority (IANA) | 433 | Contact: | | 434 | | | 435 | Nameservers: | As chosen by the IANA, see Section 8.2 | 436 | | | 437 | DS-RDATA: | As chosen by the IANA, see Section 8.2 | 438 +----------------+--------------------------------------------------+ 440 9. Security Considerations 442 This document presents no known additional security concerns to the 443 Internet. 445 For security considerations relating to AS112 service in general, see 446 [RFC6304bis]. 448 10. Acknowledgements 450 The authors acknowledge the valuable contributions of Bob Harold and 451 other participants in the DNSOP working group in the preparation of 452 this document. 454 11. References 456 11.1. Normative References 458 [RFC1035] Mockapetris, P., "Domain names - implementation and 459 specification", STD 13, RFC 1035, November 1987. 461 [RFC2308] Andrews, M., "Negative Caching of DNS Queries (DNS 462 NCACHE)", RFC 2308, March 1998. 464 [RFC6304bis] 465 Abley, J. and W. Maton, "AS112 Nameserver Operations", 466 draft-ietf-dnsop-rfc6304bis-00 (work in progress), 467 February 2014. 469 [RFC6672] Rose, S. and W. Wijngaards, "DNAME Redirection in the 470 DNS", RFC 6672, June 2012. 472 11.2. Informative References 474 [RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and 475 E. Lear, "Address Allocation for Private Internets", 476 BCP 5, RFC 1918, February 1996. 478 [RFC2928] Hinden, R., Deering, S., Fink, R., and T. Hain, "Initial 479 IPv6 Sub-TLA ID Assignments", RFC 2928, September 2000. 481 [RFC3172] Huston, G., "Management Guidelines & Operational 482 Requirements for the Address and Routing Parameter Area 483 Domain ("arpa")", BCP 52, RFC 3172, September 2001. 485 [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. 486 Rose, "DNS Security Introduction and Requirements", 487 RFC 4033, March 2005. 489 [RFC4786] Abley, J. and K. Lindqvist, "Operation of Anycast 490 Services", BCP 126, RFC 4786, December 2006. 492 [RFC5737] Arkko, J., Cotton, M., and L. Vegoda, "IPv4 Address Blocks 493 Reserved for Documentation", RFC 5737, January 2010. 495 [RFC6303] Andrews, M., "Locally Served DNS Zones", BCP 163, 496 RFC 6303, July 2011. 498 [RFC6890] Cotton, M., Vegoda, L., Bonica, R., and B. Haberman, 499 "Special-Purpose IP Address Registries", BCP 153, 500 RFC 6890, April 2013. 502 Appendix A. Assessing Support for DNAME in the Real World 504 To measure the extent to which the DNAME construct is supported in 505 the Internet, we have used an experimental technique to test the DNS 506 resolvers used by end hosts, and derive from the test a measurement 507 of DNAME support within the Internet. 509 A.1. Methodology 511 The test was conducted by loading a user's browser with 4 URLs to 512 retrieve. The first three comprise the test setup, while the final 513 URL communicates the result the the experiment controller. The URLs 514 are: 516 A http://a..dname.example.com/1x1.png? 517 a..dname 519 B http://b.dname.example.com/1x1.png? 520 b..dname 522 C http://c..target.example.net/1x1.png? 523 c..target 525 D http://results.recorder.example.net/1x1.png? 526 results.?za=&zb=&zc= 528 The A URL is designed to test the end users capability to resolve a 529 name that has never been seen before, so that the resolution of this 530 domain name will reliably result in a query at the authoritative name 531 server. This is intended to test the use of domain names where there 532 is a dynamic component that also uses the DNAME construct. 534 The B URL is deliberately designed to be cached by caching resolvers 535 that are used in the process of resolving the domain name. 537 The C URL is a control URL. This is a unique URL, similar to A, but 538 does not refer to a DNAME structure. 540 The D URL uses a static cacheable domain name. 542 The value is common to the four URLs used in each 543 individual instance of this test, but varies from test to test. The 544 result is that each end user is presented with a unique string. 546 The contents of the EXAMPLE.COM, TARGET.EXAMPLE.NET and 547 RECORDER.EXAMPLE.NET zones are shown in Figure 3. 549 $ORIGIN EXAMPLE.COM. 550 ... 551 DNAME. IN DNAME TARGET.EXAMPLE.NET. 552 ... 554 $ORIGIN TARGET.EXAMPLE.NET. 555 ... 556 B IN A 192.0.2.0 557 * IN A 192.0.2.0 558 ... 560 $ORIGIN RECORDER.EXAMPLE.NET. 561 ... 562 RESULTS IN A 192.0.2.0 563 ... 565 Figure 3 567 The first three URLs (A, B and C) are loaded as tasks into the user's 568 browser upon execution of the test's script. The script starts a 569 timer with each of these URLs to measure the elapsed time to fetch 570 the URL. The script then waits for the three fetches to complete, or 571 10 seconds, whichever occurs first. The script then loads the 572 results of the three timers into the GET arguments of the D URL, and 573 performs a fetch to pass these results back to the experiment's 574 server. 576 Logs on the web server reached at RESULTS.EXAMPLE.NET will include 577 entries of the form shown in Figure 4. If any of the URLs fail to 578 load within 10 secords the D URL will report the failure as a "null" 579 timer value. 581 GET /1x1.png?results.?za=1822&zb=1674&zc=1582 582 GET /1x1.png?results.?za=null&zb=null&zc=161 584 Figure 4 586 The script has been encoded in Adobe Flash with a simple image in the 587 form of an online advertisement. An online advertisement network has 588 been used to distribute the script. The script is invoked when the 589 advertisement is presented in the end user's browser or application, 590 and does not require the user to click on the supplied image in any 591 way. The advertisement placement parameters were set to to broadest 592 possible scope to sample users from across the entire internet. 594 A.2. Results 596 The test was loaded into an advertisement distributed on the 597 2013-10-10 and 2013-10-11. 599 +--------------------+---------+------------+ 600 | | Count | Percentage | 601 +--------------------+---------+------------+ 602 | Recorded Results: | 338,478 | | 603 | | | | 604 | A or B Loaded: | 331,896 | 98.1% | 605 | | | | 606 | A Fail and B Fail: | 6,492 | 1.9% | 607 | | | | 608 | A Fail and B Load: | 4,249 | 1.3% | 609 | | | | 610 | A Load and B Fail: | 1,624 | 0.5% | 611 | | | | 612 | C Fail: | 9,355 | 2.8% | 613 +--------------------+---------+------------+ 615 Table 1 617 These results indicate that at most 1.9% of tested clients use DNS 618 resolvers that fail to resolve a domain name that contains a DNAME 619 redirection. However the failure rate of slightly lower than 3% for 620 the control URL indicates that the failure rate for the DNAME 621 construct lies within the bounds of error within the experimental 622 framework. We conclude that there is no evidence of a consistent 623 failure on the part of deployed DNS resolvers to correctly resolve a 624 DNAME construct. 626 This experiment was conducted by Geoff Huston and George Michaelson. 628 Appendix B. Editorial Notes 630 This section (and sub-sections) to be removed prior to publication. 632 B.1. Change History 634 00 Initial write-up of Brian's idea, circulated for the purposes of 635 entertainment. 637 01 Some particularly egregious spelling mistakes fixed. Warren 638 Kumari and George Michaelson added as co-authors. Intended status 639 changed to informational. Appendix on DNAME testing added, 640 describing an experiment conducted by Geoff Huston and George 641 Michaelson. 643 00 Adopted by dnsop in IETF88, Vancouver; resubmitted as 644 draft-ietf-dnsop-as112-dname. Changed contact info for Brian. 646 01 Minor updates following submission of 647 draft-jabley-dnsop-rfc6304bis. 649 02 Text in IANA Considerations section dealing with address 650 assignments modified following informal advice received from Leo 651 Vegoda. 653 03 Updated references to 6304 following guidance from working group 654 chairs. 656 04 Corrected an error picked up by Bob Harold. 658 Authors' Addresses 660 Joe Abley 661 Dyn, Inc. 662 470 Moore Street 663 London, ON N6C 2C2 664 Canada 666 Phone: +1 519 670 9327 667 Email: jabley@dyn.com 669 Brian Dickson 670 Verisign Labs 671 12061 Bluemont Way 672 Reston, VA 20190 673 USA 675 Email: bdickson@verisign.com 677 Warren Kumari 678 Google 679 1600 Amphitheatre Parkway 680 Mountain View, CA 94043 681 USA 683 Email: warren@kumari.net 685 George Michaelson 686 APNIC 688 Email: ggm@apnic.net