Domain Name System Operations (dnsop) Internet Drafts
| DNS Referral Response Size Issues | |||||||||||||||||
|
With a mandated default minimum maximum UDP message size of 512 octets, the DNS protocol presents some special problems for zones wishing to expose a moderate or high number of authority servers (NS RRs). This document explains the operational issues caused by, or related to this response size limit, and suggests ways to optimize the use of this limited space. Guidance is offered to DNS server implementors and to DNS zone operators. | ||||||||||||||||
| Preventing Use of Recursive Nameservers in Reflector Attacks | |||||||||||||||||
|
This document describes ways to prevent the use of default configured recursive nameservers as reflectors in Denial of Service (DoS) attacks. Recommended configuration as measures to mitigate the attack are given. | ||||||||||||||||
| Locally-served DNS Zones | |||||||||||||||||
|
Experience has shown that there are a number of DNS zones all iterative resolvers and recursive nameservers should, unless configured otherwise, automatically serve. RFC 4193 specifies that this should occur for D.F.IP6.ARPA. This document extends the practice to cover the IN-ADDR.ARPA zones for RFC 1918 address space and other well known zones with similar characteristics. | ||||||||||||||||
| Considerations for the use of DNS Reverse Mapping | |||||||||||||||||
|
Mapping of addresses to names is a feature of DNS. Many sites implement it, many others do not. Some applications attempt to use it as a part of a security strategy. This document outlines what should be taken into account when deciding whether to implement reverse mappings of addresses to names, suggests that site administrators implement reverse mappings if there are no strong considerations against such mappings, and provides considerations to be taken into account when using reverse mappings. | ||||||||||||||||
| DNSSEC Trust Anchor Configuration and Maintenance | |||||||||||||||||
|
This document recommends a preferred format for specifying trust anchors in DNSSEC validating security-aware resolvers and describes how such a resolver should initialize trust anchors for use. This document also describes different mechanisms for keeping trust anchors up to date over time. | ||||||||||||||||
 |
 |
 |
 |
|
 |
|
 |
|
 |
|
 |
Domain Name System Operations (dnsop)
Last Modified: 2008-04-22
Additional information is available at tools.ietf.org/wg/dnsop
Chair(s):
Operations and Management Area Director(s):
Operations and Management Area Advisor:
Mailing Lists:
General Discussion: dnsop@ietf.orgTo Subscribe: http://www1.ietf.org/mailman/listinfo/dnsop
Archive: http://www1.ietf.org/mail-archive/web/dnsop/current/index.html
Description of Working Group:
The DNS Operations Working Group will develop guidelines for theoperation of DNS software servers and the administration of DNS zone
files. These guidelines will provide technical information
relating to the implementation of the DNS protocol by the
operators and administrators of DNS zones. The group will
perform the following activities:
1. Define the processes by which Domain Name System (DNS) software
may be efficiently and correctly administered, configured, and
operated on Internet networks. This will include root zone
name servers, gTLD name servers, name servers for other DNS
zones, iterative DNS resolvers, and recursive DNS resolvers.
As part of this effort, the group will produce documents
explaining to the general Internet community what processes
and mechanisms should be employed for the effective management
and operation of DNS software.
2. Publish documents concerning DNSSEC operational procedures.
3. Publish documents concerning the IPv6 DNS operational
procedures and DNS-related IPv6 transition and coexistence
issues.
4. Publish documents concerning the operations of the root and
TLD services, and DNS resolvers.
Goals and Milestones:
| Done | Submit I-D: revised Root Server Requirements. | |
| Done | Submit I-D: revised version of Key Handling. | |
| Done | Submit I-D: first version of Servers Sharing IP#. | |
| Done | Submit I-D: first version of Performance and Measuring. | |
| Done | Submit I-D: revised version of Key Handling. | |
| Done | Submit I-D: revised version of Servers Sharing IP#. | |
| Done | Submit Root Server Requirements to the IESG for consideration as Informational (BCP?). | |
| Done | Submit I-D: 2nd revised version of Servers Sharing IP#. | |
| Done | Distributing Authoritative Name Servers via Shared Unicast Addresses to the IESG for Informational | |
| Done | Submit Observed DNS Resolution Misbehavior to the IESG for Informational | |
| Done | Submit document describing the outstanding problems and issues with DNS discovery for IPv6 to the IESG for Informational. | |
| Done | Submit Operational Guidelines for 'local' zones in the DNS to IESG. Category to be determined. | |
| Done | Submit Operational Considerations and Issues with IPv6 DNS to the IESG for Informational | |
| Done | Submit Common Misbehavior against DNS Queries for IPv6 Addresses to the IESG for Informational | |
| Done | Submit DNSSEC Operational Procedures to IESG for BCP | |
| Done | Submit Identifying an Authoritative Name Server to IESG for Informational | |
| Done | Submit I-D: revised version of Considerations for the use of DNS Reverse Mapping | |
| Done | Submit I-D: revised version of Considerations for the use of DNS Reverse Mapping | |
| Sep 2007 | Submit I-D: revised version of Considerations for the use of DNS Reverse Mapping | |
| Sep 2007 | Submit I'm Being Attacked by PRISONER.IANA.ORG! to IESG for FYI | |
| Sep 2007 | Submit Locally-served DNS Zones to IESG for BCP | |
| Oct 2007 | Submit DNS Response Size Issues to IESG for Informational | |
| Dec 2007 | Submit Considerations for the use of DNS Reverse Mapping to IESG for BCP | |
| Dec 2007 | Submit AS112 Nameserver Operations to IESG for Informational | |
| Feb 2008 | Submit Initializing a DNS Resolver with Priming Queries to IESG for BCP |
Internet-Drafts:
DNS Referral Response Size Issues (27245 bytes)Preventing Use of Recursive Nameservers in Reflector Attacks (15834 bytes)
Locally-served DNS Zones (24808 bytes)
Considerations for the use of DNS Reverse Mapping (34446 bytes)
DNSSEC Trust Anchor Configuration and Maintenance (21426 bytes)
Request For Comments:
Root Name Server Operational Requirements (RFC 2870) (21133 bytes) obsoletes RFC 2010Distributing Authorittative Name Servers via Shared Unicast Addresses (RFC 3258) (22195 bytes)
DNS IPv6 transport operational guidelines (RFC 3901) (10025 bytes)
Common Misbehavior against DNS Queries for IPv6 Addresses (RFC 4074) (13073 bytes)
IPv6 Host Configuration of DNS Server Information Approaches (RFC 4339) (60803 bytes)
Operational Considerations and Issues with IPv6 DNS (RFC 4472) (68882 bytes)
DNSSEC Operational Practices (RFC 4641) (79894 bytes) obsoletes RFC 2541
Observed DNS Resolution Misbehavior (RFC 4697) (45187 bytes)
Requirements for a Mechanism Identifying a Name Server Instance (RFC 4892) (17605 bytes)
IETF Secretariat - Please send questions, comments, and/or suggestions to ietf-web@ietf.org.
Return to working group directory. 
