RFC 2317

Classless IN-ADDR.ARPA delegation

📅 published March 1998, from ietf

RFC 2317: Classless IN-ADDR.ARPA delegation 🎀

Okay bestie, this one is a whole vibe. Here's the title block, all in one spot:

Series: Network Working Group
Number: RFC 2317 ✨
Title: Classless IN-ADDR.ARPA delegation
Authors: H. Eidnes (SINTEF RUNIT), G. de Groot (Berkeley Software Design, Inc.), and P. Vixie (Internet Software Consortium)
Category: Best Current Practice (BCP: 20) 👑
Date: March 1998
Obsoletes / Updates: the title block doesn't list anything it obsoletes or updates 🙈

Status of this Memo 📜

So this document is an Internet Best Current Practice for the whole Internet Community 🌍, and the authors are literally asking everyone to talk about it and send in ideas for making it better. Distribution of this memo is unlimited, so share away 💖

Copyright Notice 💜

Copyright (C) The Internet Society (1998).  All Rights Reserved.

2. Introduction 🌸

Okay so this doc describes a way to do IN-ADDR.ARPA delegation on non-octet boundaries, for address spaces that cover fewer than 256 addresses. 🦋 Basically, the method takes out one of the big objections to subnetting on non-octet boundaries. But honestly the bigger deal is that it lets people hand out IP address space in chunks smaller than 24-bit prefixes, without losing the ability to delegate authority for the matching IN-ADDR.ARPA mappings. ✨

The method is fully compatible with the original DNS lookup mechanisms in [1]. That means there's no need to change the lookup algorithm, and there should be no need to change any software that does DNS lookups. 🫶

The document also talks through some operational considerations, to give a bit of guidance on putting this method into practice. 🧚

3. Motivation 💅

With classless routing tech everywhere now, it's become doable to assign address space on non-octet boundaries. 🔥 For a really small org with only a few hosts, handing them a full 24-bit prefix (the thing people used to call a "class C network number") is super wasteful with address space. 💀

The annoying part of giving out a longer prefix (so less address space) is that it seems impossible for that little org to run its own reverse ("IN-ADDR.ARPA") zone on its own. 😭 With the reverse delegation method below, the biggest objection to handing longer prefixes to unrelated organizations can be removed. 🌈

Let's say we've assigned these address spaces to three different parties:

192.0.2.0/25   to organization A
192.0.2.128/26 to organization B
192.0.2.192/26 to organization C

With the classic approach, you'd end up with one zone that looks like this:

$ORIGIN 2.0.192.in-addr.arpa.
;
1               PTR     host1.A.domain.
2               PTR     host2.A.domain.
3               PTR     host3.A.domain.
;
129             PTR     host1.B.domain.
130             PTR     host2.B.domain.
131             PTR     host3.B.domain.
;
193             PTR     host1.C.domain.
194             PTR     host2.C.domain.
195             PTR     host3.C.domain.

This zone is a mess to administer, not gonna lie. Authority for it can only be delegated once, which usually means "only one organization gets to run this zone." Everyone else whose address space lines up with entries in there would have to lean on another org for their address-to-name translation. 🥲 The proposed method is designed to avoid that problem. 🎀

4. Classless IN-ADDR.ARPA delegation 🦄

Since a single zone can only be delegated once, we need more delegation points to solve the problem above. ✨ These extra points can be created by pushing the IN-ADDR.ARPA tree further down. For example, you can use the first address, or the first address plus the network mask length (shown below) of the address space, as the first component of the name for the zones. 🧩 The four zone files below show how the problem from the motivation section could be solved this way.

$ORIGIN 2.0.192.in-addr.arpa.
@       IN      SOA     my-ns.my.domain. hostmaster.my.domain. (...)
;...
;  <<0-127>> /25
0/25            NS      ns.A.domain.
0/25            NS      some.other.name.server.
;
1               CNAME   1.0/25.2.0.192.in-addr.arpa.
2               CNAME   2.0/25.2.0.192.in-addr.arpa.
3               CNAME   3.0/25.2.0.192.in-addr.arpa.
;
;  <<128-191>> /26
128/26          NS      ns.B.domain.
128/26          NS      some.other.name.server.too.
;
129             CNAME   129.128/26.2.0.192.in-addr.arpa.
130             CNAME   130.128/26.2.0.192.in-addr.arpa.
131             CNAME   131.128/26.2.0.192.in-addr.arpa.
;
;  <<192-255>> /26
192/26          NS      ns.C.domain.
192/26          NS      some.other.third.name.server.
;
193             CNAME   193.192/26.2.0.192.in-addr.arpa.
194             CNAME   194.192/26.2.0.192.in-addr.arpa.
195             CNAME   195.192/26.2.0.192.in-addr.arpa.

$ORIGIN 0/25.2.0.192.in-addr.arpa.
@       IN      SOA     ns.A.domain. hostmaster.A.domain. (...)
@               NS      ns.A.domain.
@               NS      some.other.name.server.
;
1               PTR     host1.A.domain.
2               PTR     host2.A.domain.
3               PTR     host3.A.domain.

$ORIGIN 128/26.2.0.192.in-addr.arpa.
@       IN      SOA     ns.B.domain. hostmaster.B.domain. (...)
@               NS      ns.B.domain.
@               NS      some.other.name.server.too.
;
129             PTR     host1.B.domain.
130             PTR     host2.B.domain.
131             PTR     host3.B.domain.

$ORIGIN 192/26.2.0.192.in-addr.arpa.
@       IN      SOA     ns.C.domain. hostmaster.C.domain. (...)
@               NS      ns.C.domain.
@               NS      some.other.third.name.server.
;
193             PTR     host1.C.domain.
194             PTR     host2.C.domain.
195             PTR     host3.C.domain.

For every size-256 chunk you split up with this method, you need to install close to 256 CNAME records in the parent zone. 😬 Some people might find that ugly, and we won't fight them on that one. 🙃 BUT it's pretty easy to auto-generate those CNAME resource records in the parent zone once and for all, as long as you know how the address space is partitioned. 🤖

The big win over the other proposed approaches is that there should be no need to change any software that's already deployed. ✨ The DNS lookup mechanism doesn't have to be modified to handle splitting responsibility for IPv4 address-to-name translation on "non-dot" boundaries. 🦋 Also, this technique has been used for several years in plenty of installations, apparently with no ill effects. 💅

Now, a resource record like this:

$ORIGIN 2.0.192.in-addr.arpa.
129             CNAME   129.128/26.2.0.192.in-addr.arpa.

can be conveniently abbreviated to:

$ORIGIN 2.0.192.in-addr.arpa.
129             CNAME   129.128/26

Heads up, though: some DNS implementations aren't kind to special characters in domain names, like the "/" used in the examples above. 🙈 As [3] makes clear, these characters are legal, even if some people think they look unsightly. Since these aren't host names, the restriction in [2] doesn't apply. Modern clients and servers have an option to act in the liberal and correct fashion. 🌸

We used "/" in the examples because it was felt to be more visible, and pedantic reviewers felt the "these are not hostnames" argument needed to be repeated. 🤓 Our advice is: don't be so pedantic. Feel free to swap in a more conservative character, such as a hyphen, for the "/" instead of copying the examples exactly. 🫶

5.3 Other operational issues ✨

okay bestie, read this part carefully 🧐💅 you cannot give out CNAME referrals twice for the same address space. so say you hand a /25 to one org and set up IN-ADDR.ARPA this way, then that org subnets the /25 into longer prefixes and tries the same trick so each subnet gets control of its own number space. nope 🙅‍♀️. that makes a CNAME record point at another CNAME record, and that is less robust overall 💀

Also, some old beta releases of the popular DNS name server implementation BIND 4.9.3 had a bug. If a CNAME record showed up during a reverse lookup, things broke 😭 Those beta releases have since been obsoleted, and the issue is fixed in the released code ✨ BUT some software manufacturers shipped that defective beta code in their products 🙈 In the few cases anyone knows about, the manufacturers have patches available or planned to replace the obsolete beta code.

6. Security Considerations 🔐

okay so this part is important, so pay attention 👀

With this scheme, the "leaf sites" will need to rely on one more site running its DNS name service correctly than they would if they had a /24 allocation of their own. That might add an extra component that has to work for name resolution to be reliable 🫠

Other than that, the authors aren't aware of any additional security issues introduced by this mechanism. 🛡️

7. Conclusion 🌸

the scheme gives more flexibility when delegating authority in the IN-ADDR.ARPA domain 🦋 That means address space can be assigned more efficiently, and you STILL keep the ability to delegate DNS authority over the matching address-to-name mappings. main character energy fr 👑

8. Acknowledgments 🫶

Glen A. Herrmannsfeldt described this trick on comp.protocols.tcp-ip.domains some time ago, so he gets the first shoutout ✨ Alan Barrett and Sam Wilson gave valuable comments on the newsgroup 💖

We would also like to thank Rob Austein, Randy Bush, Matt Crawford, Robert Elz, Glen A. Herrmannsfeldt, Daniel Karrenberg, David Kessens, Tony Li, Paul Mockapetris, Eric Wassenaar, Michael Patton, Hans Maurer, and Peter Koch for reviewing the document and giving constructive comments 🎀 iconic reviewers, all of them 🙌

9. References 📚

[1] Mockapetris, P., "Domain Names - Concepts and Facilities", STD 13, RFC 1034, November 1987.

[2] Harrenstien, K., Stahl, M., and E. Feinler, "DoD Internet Host Table Specification", RFC 952, October 1985.

[3] Elz, R., and R. Bush, "Clarifications to the DNS Specification", RFC 2181, July 1997.

10. Authors' Addresses 💌

Havard Eidnes SINTEF RUNIT N-7034 Trondheim Norway

Phone: +47 73 59 44 68 Fax: +47 73 59 17 00 EMail: Havard.Eidnes@runit.sintef.no

Geert Jan de Groot Berkeley Software Design, Inc. (BSDI) Hendrik Staetslaan 69 5622 HM Eindhoven The Netherlands

Phone: +31 40 2960509 Fax: +31 40 2960309 EMail: GeertJan.deGroot@bsdi.com

Paul Vixie Internet Software Consortium Star Route Box 159A Woodside, CA 94062 USA

Phone: +1 415 747 0204 EMail: paul@vix.com

11. Full Copyright Statement ⚖️

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 💜

📦 where this page comes from

ietf: rfc2317 1998-03
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms