RFC 8324
DNS Privacy, Authorization, Special Uses, Encoding, Characters, Matching, and Root Structure: Time for Another Look?
RFC 8324: DNS Privacy, Authorization, Special Uses, Encoding, Characters, Matching, and Root Structure: Time for Another Look? 🔥
Okay bestie, RFC 8324 is giving big DNS reconsideration energy 🦋. It's an Independent Submission by J. Klensin, published in February 2018 under the Informational category 🎀. The ISSN is 2070-1721. It doesn't obsolete or update any other RFCs, so it's a standalone vibe check ✨.
Abstract 🌸
So the DNS was basically finished almost 30 years ago 💀. The last half of that time has brought a ton of changes in what people need and expect from it. Some of those changes either mean we have to change how the DNS gets used, or the DNS can only handle them badly, or not at all 😭. This document asks whether it's time to redesign and replace the DNS so it matches today's needs. The alternative is to stop trying to bolt on incremental patches that never fully work out. Or we could draw some clear lines around functionality that isn't really needed, or that should happen some other way 🧚.
Status of This Memo 📝
Real talk, this document is not an Internet Standards Track specification. It's published just for informational purposes 💅.
This is a contribution to the RFC Series, and it's independent of any other RFC stream. The RFC Editor chose to publish it at their discretion, and they make no statement about how useful it is for implementation or deployment 🙈. Documents the RFC Editor approves for publication can't be candidates for any level of Internet Standard. See Section 2 of RFC 7841 for the details 🌈.
Info about this document's current status, any errata, and how to give feedback on it lives at https://www.rfc-editor.org/info/rfc8324 🫶.
Copyright Notice 🔐
Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved ✨.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stood on the publication date. Please read these carefully, because they describe your rights and restrictions for this document 💜.
Table of Contents 📚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Background and Hypothesis . . . . . . . . . . . . . . . . . . 5
3. Warts and Tensions with the Current DNS . . . . . . . . . . . 6
3.1. Multi-type Queries . . . . . . . . . . . . . . . . . . . 6
3.2. Matching Part I: Case Sensitivity in Labels and Other
Anomalies . . . . . . . . . . . . . . . . . . . . . . . . 7
3.3. Matching Part II: Non-ASCII ("Internationalized") Domain
Name Labels . . . . . . . . . . . . . . . . . . . . . . . 7
3.4. Matching Part III: Label Synonyms, Equivalent Names, and
Variants . . . . . . . . . . . . . . . . . . . . . . . . 8
3.5. Query Privacy . . . . . . . . . . . . . . . . . . . . . . 10
3.6. Alternate Namespaces for Public Use in the DNS Framework:
The CLASS Problem . . . . . . . . . . . . . . . . . . . . 10
3.7. Loose Synchronization . . . . . . . . . . . . . . . . . . 10
3.8. Private Namespaces and Special Names . . . . . . . . . . 11
3.9. Alternate Query or Response Encodings . . . . . . . . . . 12
3.10. Distribution and Management of Root Servers . . . . . . . 12
3.11. Identifiers versus Brands and Other Convenience Names . . 13
3.12. A Single Hierarchy with a Centrally Controlled Root . . . 14
3.13. Newer Application Protocols, New Requirements, and DNS
Evolution . . . . . . . . . . . . . . . . . . . . . . . . 14
3.13.1. The Extensions . . . . . . . . . . . . . . . . . . . 15
3.13.2. Extensions and Deployment Pressures -- The TXT
RRTYPE . . . . . . . . . . . . . . . . . . . . . . . 15
3.13.3. Periods and Zone Cut Issues . . . . . . . . . . . . 16
3.14. Scaling of Reputation and Other Ancillary Information . . 17
3.15. Tensions among Transport, Scaling, and Content . . . . . 18
4. The Inverse Lookup Requirement . . . . . . . . . . . . . . . 19
5. Internet Scale, Function Support, and Incremental Deployment 20
6. Searching and the DNS -- An Historical Note . . . . . . . . . 20
7. Security Considerations . . . . . . . . . . . . . . . . . . . 21
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 22
8.1. Normative References . . . . . . . . . . . . . . . . . . 22
8.2. Informative References . . . . . . . . . . . . . . . . . 22
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 29
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 291. Introduction ✨
Okay so this document looks at what people expect from the Internet's Domain Name System (DNS) today, and compares those expectations to the assumptions and properties of the DNS design. That includes what's written down in the RFC Series, an important early paper by the principal author of the original RFCs [Mockapetris-1988], and a certain amount of oral tradition 🍓. The main question is whether the gap between then and now is putting enough stress on the system that patching it further won't cut it. If so, the Internet community should maybe be thinking about designing a new system that fits current needs and expectations, plus a plan for deploying it and transitioning to it 🦋. For the majority of us, actually replacing the DNS is way too radical to be realistic 🙈. For those folks, the document could still be useful in two other ways. First, it could be a foundation for talking about which functions the DNS shouldn't be expected to support, and how those functions could be supported some other way. That might be an intermediate system that calls on the DNS, or some other kind of database technology handling some set of functions while the basic DNS functions stay intact 💅. Second, it could give us a basis for "better just get used to that and the way it works" conversations, which replace fantasies about what the DNS might do in some alternate reality 😭.
There's a key design or philosophical question tied to the analysis here that this document doesn't actually answer 🤔. The question is whether the changes in perceived DNS requirements described here are mostly evolutionary. Or are many of them cases of people trying to use the DNS for new jobs just because it already exists and is already deployed, whether or not it's really a good fit? The second option might be an example of a problem the IETF often describes as "when all you have is a hammer, everything looks like a nail" 🔨.
Other recent work, including a short article by Vint Cerf [Cerf2017], has covered an overlapping set of considerations from a different angle. That reinforces the idea that it may be time to ask fundamental questions about where the DNS is headed 🌈.
This document doesn't assume you have deep technical or operational DNS knowledge, but it does assume some knowledge and at least general familiarity with the concepts in RFC 1034 [RFC1034] and RFC 1035 [RFC1035], plus the terminology in RFC 7719 [RFC7719] and elsewhere 📚. Some of the comments might be taken as hints or examples of different ways to think about these design issues. Still, the document doesn't try to explore alternate naming systems or database technologies, let alone give a tutorial on them 🧚.
It's also worth noting that, even though the perspective is different and more than a dozen years have passed, many of the issues discussed here were analyzed and described in a 2005 US National Research Council report [NRC-Signposts]. Most of them got more extensive explanations there 💜.
Heads up: several references point to obsolete documents. That's on purpose, because those documents show which documents and dates introduced particular features or concepts. When current versions are the intended target, those are the ones referenced ✨.
2. Background and Hypothesis 🕰️
The Domain Name System (DNS) [RFC1034] was designed starting in the early 1980s [RFC0799] [RFC0881] [RFC0882] [RFC0883]. The main goal was to replace the flat, centrally administered host table system [RFC0810] [RFC0952] [RFC0953] with a hierarchical, administratively distributed system 🌸. Some DNS features turned out to be unworkable after initial implementation and deployment. Some got replaced, like the mail destination (MD) and mail forwarder (MF) approach [RFC0882], which was replaced by the MX approach [RFC0974]. Some got abandoned, like the mechanism for using email local parts as labels described in RFC 1034, Section 3.3. And some got deprecated, like the WKS RR TYPE [RFC1123] 💀. Newer ideas and requirements have since identified a bunch of other features, and some of those were less developed than others. Of course, the original designers couldn't have anticipated everything that's been expected of the DNS over the last 30 years 😭.
In recent years, the demand for new and extended DNS services and uses has led to proposals for DNS extensions or changes of various sorts 🔥. Some got adopted, including a model for negotiating extended functionality [RFC2671] (commonly known as EDNS(0)) and support for IPv6 [RFC3596]. Others were found to be impracticable, and still others are still under consideration. A couple of examples from the last two categories get discussed below 👑. A few features of the original DNS specification, like the CLASS property and label types, have also been suggested as so badly specified that they should be deprecated [Sullivan-Class] 🙈.
Then there's the difference from earlier changes, like the Internationalized Domain Names for Applications (IDNA) mechanisms. Those helped incorporate non-ASCII labels without changing the DNS structure itself [RFC3490] [RFC5890] 🌈. Some recent proposals, though, require or strongly suggest changes to APIs, formats, or interfaces used by programs that need to retrieve information from the DNS or interpret that information 🧚. The gap between the DNS architecture and what those proposals need suggests it may be time to stop patching the DNS or trying to extend it in small increments ✨. Instead, we should be thinking about moving some current or proposed functionality somewhere else, or developing a new system that better meets today's needs, along with a transition strategy to get there 🦋.
The next section discusses a number of issues with the current DNS design that a different, newer design model could appropriately address 💅. In at least some cases, changing the model and protocols could bring significant benefits to the Internet and/or its administration 💖.
This document is not a proposal for a new protocol 🙅♀️. It's meant to get people thinking about how far we want to push the existing DNS. It's also meant to check whether our expectations of it are already going past its plausible capabilities, and to start a discussion about redesigning it, or about alternatives, if the time for that decision has come 🎀.
3. Warts and Tensions with the Current DNS 💅
As suggested above, there are many signs that the DNS can't meet contemporary expectations for how it should work or for the functionality it should support 😭. Some of those expectations are unrealistic under any imaginable circumstances. Others are impossible, or just problematic, in the current DNS structure, but a redesign could accommodate them 🔮. These are examples, not a comprehensive list, and they don't appear in any particular order 🌈.
3.1. Multi-type Queries 💅
okay so the DNS does not handle multi-type queries gracefully 😭 The place this shows up is when people try to build solutions that hand back both TYPE A (IPv4) and type AAA (IPv6) addresses together. The first time this went sideways was with QTYPE=MAILA [RFC0882], back when the original MA and MD RRTYPEs were around. That experience is a big hint that you need some really careful thinking about cache effects (and maybe additional DNS changes too) 🧠 Other solutions might look just as good or even better on paper. What they all have in common, including the "two types of addresses" idea, is that they show off the stresses on the system, and changing the DNS to deal with those stresses is not straightforward or likely to be problem-free ✨
3.2. Matching Part I: Case Sensitivity in Labels and Other Anomalies 🎀
so the DNS specs assume that labels are octet strings, and that octets with the high bit set to zero carry seven-bit ASCII codes in the remaining bits 🌸 When a domain name in a query gets matched against one stored in the database, those ASCII characters have to be interpreted in a case-independent way. In other words, upper- and lower-case letters count as equivalent, while digits and symbols aren't affected [RFC4343]. For non-ASCII octets (the ones in labels with the first bit turned on), there are no assumptions about which character coding is being used, let alone any rules about case equivalence. Strings have to be compared by matching bits in sequence 🔍
Now, even though the current model for handling non-ASCII ("internationalized") domain name labels (IDNs) [RFC5890] encodes information so the DNS isn't directly affected (see Section 3.3 below), the idea that some characters in labels are handled case-insensitively while others are case sensitive (or that upper case has to be banned entirely, like IDNA does) has caused a lot of confusion and resentment 😤 People keep complaining about inconsistent behavior and about mishandling (or just suboptimal handling) of case relationships for some languages. Repeated explanations haven't really calmed things down, even when they point out that the relationships between "decorated" lower-case characters and their upper-case equivalents are often sensitive to language and locality. That means they aren't deterministic with the information DNS servers have available 🥲
3.3. Matching Part II: Non-ASCII ("Internationalized") Domain Name Labels 🦋
this one is totally separate from the case-sensitivity drama. A fundamental property of Unicode [Unicode] is that some abstract characters can be represented in multiple ways, like a single precomposed code point, or a base code point followed by one or more code points that specify combining characters 🌈 Unicode Normalization can clear up many (but not all) of those differences for comparison (matching) purposes, and it's best applied during matching rather than by changing one string into another 🙌
Here's the tea. The first version of IDNA ("IDNA2003") chose to change strings during processing, for either storage or retrieval [RFC3490] [RFC3491]. The second one ("IDNA2008") required that all strings be normalized and that upper-case characters are not allowed at all [RFC5891]. Neither one is optimal 💀 Even if you ignore where the change happens (or whether it happens at all), transforming the strings themselves means the input string in an application may not be the same as the string used in processing and maybe later display 😵💫
It would almost certainly be preferable, and more consistent with Unicode recommendations, to use normalization (and maybe other techniques, if they're appropriate) at matching time instead of altering the strings at all. That would be true even if there were still only one matching algorithm, meaning normalization was just added on top of the existing ASCII-only case folding ✨ But even Unicode's own discussion of normalization [Unicode-UAX15] points out that there are special, language-dependent cases. The most commonly cited example is the dotless "i" (U+0131) 🙈 The DNS doesn't have any information about languages that could feed into a mapping algorithm. And as long as there's a requirement for only one mapping algorithm for the entire system, that information couldn't be used even if it were available. One could imagine a successor system that stores information at nodes in the hierarchy to specify different matching rules for subsidiary nodes (or equivalent arrangements for non-hierarchical systems). It isn't clear whether that would be a good idea, but it definitely isn't possible with the DNS as we know it 🫠
3.4. Matching Part III: Label Synonyms, Equivalent Names, and Variants 🌸
as the early phases of work on IDNs started wrapping up, it became super obvious that the nature and evolution of human language and writing systems meant some names had to be treated as "the same as" others 💜 The first big example was the relatively recent effort to simplify the Chinese writing system, which created a distinction between "Simplified" and "Traditional" Chinese, even though the meaning of the characters stayed the same in almost all cases. (In so-called ideographic character sets, characters have meaning rather than exclusively representing sounds.) A joint effort among the relevant Country Code Top-Level Domain (ccTLD) registries and some other interested parties produced a set of recommendations for handling the issues with that script [RFC3743]. It also introduced the concept of "variant" characters and domain names 🎀
However, once names are seen as having meanings instead of just being mnemonics, especially when they represent brands or something equivalent, or when spelling for a particular written language isn't completely standardized, demands to treat different strings as exact equivalents become obvious and inevitable 📣 A trivial English example: everyone knows "colour" and "color" are the same word. So does that mean that if they're used as DNS labels in domain names where all the other labels are identical, the two domain names should be treated as identical? 🤔 Examples from other languages or writing systems are often way more numerous and more problematic than national spelling differences in English. This is especially true for scripts where some or all of the markings that distinguish characters or words by sound or tone (or that change the pronunciation of words) are optional. They're also harder to explain to people who aren't familiar with those languages or writing systems, and they're hard to illustrate in ASCII-only Internet-Drafts and RFCs 🥹
Approximations are possible, but the DNS can't really handle this requirement. Its aliasing mechanisms (CNAME, DNAME, and various proposals for newer and different types of aliasing [DNS-Aliases] [DNS-BNAME]) don't provide a strong enough binding. On top of that, the ability to use those aliases from a subtree controlled by one administrative entity inside another one means there's little or no possibility that the owner of a particular name (in either the DNS sense or the registrar-registrant sense) can control the synonyms for it 😬 Some of this can be dealt with at the application level, for example with redirects in web protocols. But that approach, which is the essential characteristic of "if both names belong to the same owner, everything is OK" approaches, leads to names being handled in inconsistent ways across different protocols 🙃
Another way to look at part of this (and, to some degree, the issue discussed above in Section 3.3) is that these perceived equivalences and desired transformations are context-dependent, but the DNS resolution process is not [RFC6912] 🧩
Similar problems pop up when people notice that some characters are easily mistaken for others, which could be an opportunity for user confusion and attacks 👀 Commonly cited examples include the Latin and Cyrillic script "a" characters, which are identical [CACM-Homograph]. There are also characters in many scripts that look like open circles or vertical or horizontal lines, and even the Latin script letter "l" and the European digit "1". Examples abound in other scripts and combinations of scripts too 🌀 The most common proposed fix within the DNS context has been to treat these cases, along with those involving orthographic variations, as "variants" (though different from the system for Chinese characters mentioned above). Then you either ban all but one (or a few) of the possible labels from the DNS (possibly on a first come, first served basis), or you make sure any collection of such strings that gets delegated as assigned to the same ownership (see above) stays together. Neither solution is completely satisfactory 😩 If all but one string is excluded, users who guess at a different form (maybe while transcribing characters from a written or printed source) won't find what they're looking for. And as pointed out above, "same ownership" only works with carefully designed and administered applications protocol support, and sometimes not even then 💔
Some of these issues are discussed at greater length in an ICANN report [ICANN-VIP] 📚
3.5. Query Privacy 🔒
there's been growing concern in recent years that DNS queries happen in cleartext on the public Internet. If those queries can be intercepted, they can expose a lot of information about interests and contacts, which could compromise individual privacy 😰 A number of proposals have been made to mitigate this, including query name minimization [RFC7816] and running DNS over an encrypted tunnel [RFC7858]. But they all appear to share the common properties of security patches rather than designed-in security or privacy mechanisms 🩹 Experience may prove otherwise once (and if) they're widely deployed. Still, it doesn't look like any of them are as satisfying as a system with query privacy designed in from the start 🥺 More general tutorials on this issue have appeared recently [Huston2017a] 📖
3.6. Alternate Namespaces for Public Use in the DNS Framework: The CLASS Problem 🧚
the DNS standards include a CLASS value, which "identifies a protocol family or instance of a protocol" (RFC 1034, Section 3.6, and elsewhere) 🍓 CLASS was used really effectively in the early days of the DNS to manage different protocol families within the same administrative environment. But recent attempts to use it to partition the DNS namespace in other ways (like for non-ASCII names, partly to address the issues in Sections 3.2 and 3.3) or to use DNS mechanisms for entirely different namespaces have exposed fundamental problems with the mechanism [Sullivan-Class] 🚨 Maybe the most fundamental of those problems is the disagreement about whether multiple CLASSes were meant to exist within a given zone (with records within RRSETs), or whether different CLASSes implied different zones. Different implementations make different assumptions [Faltstrom-2004] [Vixie-20170704] 🤷♀️ These problems have led to recommendations that CLASS be dropped entirely [Sullivan-Class]. But discussions on the IETF list and in WGs in mid-2017 made it clear that there's no clear consensus on that matter 🫶
3.7. Loose Synchronization 🫶
okay so the DNS has this whole vibe called "loose synchronization" 💅 which basically means there is NO expectation that every server that could answer your query has exactly the same data, unless that data has been unchanged for a rather long period. Put differently, if some or all of the records tied to a particular node in the DNS (informally, a fully qualified domain name (FQDN)) change, you can't expect those changes to spread immediately 🌸
That model has honestly worked super well since the DNS first launched ✨ It kept the system away from needing the heavy stuff that's usually required when you update multiple systems at once: elaborate locking, complex update procedures and handshaking, or journaling. As people have often pointed out about the Internet, implementation and operational complexity are often the enemy of stability, security, and robustness 💀 Loose synchronization helped keep the DNS as simple and robust as possible. iconic 👑
But a bunch of recent ideas about using the DNS to store data that changes VERY rapidly are, sadly, largely incompatible with loose synchronization 😭 Trying to use very short (or zero) refresh times (in SOA records for slave updates from masters) and TTLs (for caches) to fake nearly simultaneous updating might work up to a point, but it seems to put very heavy loads on servers and distribution mechanisms that were never designed for that style of working 🙈 Similar observations apply to using the NOTIFY extension [RFC1996] or dynamic, "server-push", updating instead of the traditional DNS mechanisms. While the NOTIFY and push mechanisms normally give you faster refresh times and update mechanisms than those specified in RFCs 1034 and 1035, they imply that a "master" server must know the identities of (and have good connectivity to all of) its slaves. That defeats at least some of the advantages of stealth slaves, particularly the ones about reducing query traffic across the Internet 🦋
And those mechanisms do nothing for caches. Unless servers keep track of the source of every query for names in a specific zone and then somehow notify the query source systems, the only alternative to having possibly obsolete info sitting in caches is very short or zero TTLs. That way the cached data times out almost immediately after being stored (or isn't stored at all), requiring a new query to an authoritative server each time a resolver tries to look up a name. main character drama 💜
3.8. Private Namespaces and Special Names 🧚
Almost since the DNS first launched, people have wanted DNS-like names, and often DNS resolution mechanisms or tweaks of them, for namespaces where globally available and consistent resolution using the public DNS is either unfeasible or undesirable (and where using CLASS isn't an appropriate mechanism). Isolating names and addresses on LANs from the public Internet, typically via "split horizon" approaches, is one example of this need, even though it often isn't recognized as such. Another example that has caused a LOT of controversy involves "special names" -- labels or pseudo-labels, often in TLD positions, that signal the full name should not be subject to normal DNS resolution or other processing [RFC6761] [RFC8244] 🙃
Independent of the messy policy questions about who should allocate such names and what procedures to use, they almost inherently need either a syntax convention to identify them (there actually was one, but it was abandoned many years ago and there's no plausible way to bring it back) or tables of such names that are known to, and kept updated on, every resolver on the Internet, at least if spurious queries to the root servers are to be avoided 😩
If the DNS were redesigned and replaced, we could treat this requirement as part of the design and handle it way better than we can today ✨
3.9. Alternate Query or Response Encodings 🎀
The DNS specifies formats for queries and data responses, based on the state of the art and best practices at the time it was designed. Recent work has suggested there would be significant advantages to supporting at least a description of DNS messages in one or more alternate formats, such as JSON [Hoffman-DNS-JSON] [Hoffman-SimpleDNS-JSON]. While that work was carefully done to avoid requiring changes to the DNS, a lot of the argument for a JSON-based description format could easily be flipped into an argument that, if the DNS were being revised, that format might be preferable as a more direct alternative to having DNS queries and responses in the original form 💖
3.10. Distribution and Management of Root Servers 🌈
The DNS model requires a collection of root servers that hold, at minimum, information about top-level domains. Over the years, that requirement has gone from a technically pretty minor function, normally carried out as a service to the broader Internet community and its users and systems, to a topic that is intensely controversial when it comes to control of those servers, including how they should be distributed and where they should be located 😤 While a number of mechanisms, most recently including making the information more local [RFC7706], have been proposed, and one (anycast [RFC7094]) is in very active use to mitigate some of the real and perceived problems, it seems obvious that a DNS successor, designed for today's global Internet and perceived requirements, could handle these problems in a technically more appropriate and less controversial way. Some additional discussion of the issues appears in a recent paper [Huston2017b] 📄
3.11. Identifiers versus Brands and Other Convenience Names 💅
A key design element of the original network object naming systems for the ARPANET, largely inherited by the DNS, was that the names, while expected to be mnemonic, were identifiers, and their being highly distinguishable and not prone to ambiguity was important. That led to restrictive rules about what could appear in a name. Those restrictions originated with the host table and even earlier [RFC0236] [RFC0247], and came to the DNS (largely via SMTP) as the "preferred syntax" (RFC 1034, Section 3.5) or what we now often call the letter-digit-hyphen (LDH) rule. Similar rules to make identifiers easier to use, less prone to ambiguity, or less likely to interfere with syntax occur frequently in more formal languages. For example, almost every programming language has restrictions on what can appear in an identifier, and Unicode provides general recommendations about identifier composition [Unicode-USA31]. Both are quite restrictive compared to the number of characters and total number of strings that can be written using that character coding system.
That model, which originally prohibited labels starting with digits in order to avoid any possible confusion with IP addresses, began to break down in 1987 or 1988 when a company named 3Com wanted to use its corporate name as a label within the COM TLD, and the rule was relaxed [RFC1123].
In the last decade or two, the perspective that company names should be supported if possible has expanded, and it has done so largely without its limits, if any, being explicitly understood or acknowledged. In the current form, the DNS is really (and primarily) a system for expressing thoughts and concepts. Those include free expression of ideas in as close to natural language as possible, as well as representation of product names and brands. That view requires letter-like characters that might not be reasonable in identifiers, along with a variety of symbols and punctuation. It may also require indicators of preferred type styles to provide information in a form that exactly matches personal or legal preferences. At least if carried to an extreme, that perspective would argue for standardizing word and sentence separators, removing the limit of 63 octets per label and probably the limit of 255 octets on the total length of a domain name, and perhaps even eliminating the hierarchy or allowing separators for labels in presentation form (now fixed at "." for the DNS) to be different according to context. It suggests that, at least, the original design was defective in not prioritizing those uses over the more restrictive approach associated with prioritizing unique and unambiguous identifiers.
So we have two or, depending on how one counts, three very different use cases. The historical one is support for unique identifiers. The other is expression of ideas and, if one considers them separate, presentation of brand and product names. Because they inherently involve different constraints, priorities, and success criteria, these perspectives are, at best, only loosely compatible.
We cannot simultaneously optimize both the identifier perspective and either or both of the others in the same system. At best, there are some complex trade-offs involved. Even then, it is not clear that the same DNS (or other system) can accommodate all of them. Until we come to terms with that, the differences manifest themselves with friction among communities, most often with tension between "we want to do (or use or sell) these types of labels" and "not good for the operational Internet or the DNS".
3.12. A Single Hierarchy with a Centrally Controlled Root 👑
A good many Internet policy discussions in the last two decades have revolved around questions of how many top-level domains there should be, what they should be, who should control them and how, how (or if) their individual operations and policy decisions should be accountable to others, and what processes should be used (and by what entities or organizational structures) to make those decisions. Several people have pointed out that, if we were designing a next-generation DNS using today's technology, it should be possible to remove the technical requirement for a central authority over the root. (Some people have suggested that blockchain approaches would be helpful for this purpose; others believe they just would not scale adequately, at least at acceptable cost, but that other options are possible.) Whether elimination of a single, centrally controlled, root would be desirable or not is fairly obviously a question of perspective and priorities. 🧐
3.13. Newer Application Protocols, New Requirements, and DNS Evolution 🦋
okay so, new work in other areas keeps demanding new DNS features 😤, and a LOT of those involve data values that make the DNS recursively reference itself 💅. Early record types that did this came with restrictions to reduce the risk of looping references or other difficulties. For example, the MX RRTYPE has a fully qualified domain name as its data, but SMTP imposes "primary name" restrictions that stop the name used from being, e.g., a CNAME. Loops with CNAMEs are possible, and Section 3.6 of RFC 1034 has a discussion about ways to avoid problems and how they should be handled. Some newer protocols and conventions cause way more stress 😭. There are also separate issues with additions, and with how the DNS has been extended to try to deal with them.
3.13.1. The Extensions ✨
Some examples of DNS extensions for new protocol demands that illustrate, or have led to, increased stress include:
- NAPTR: Requires far more complex data in the DNS for ENUM (e.g., Voice over IP (VoIP), specifically SIP) support, including URI information and hence recursive or repeated lookups, than any of the RRTYPEs originally supported. The RRSET associated with these records can become quite large because the separator between the various records is part of the RDATA, and not the
{owner, class, type}triple (a problem slightly related to the problem with overloading of TXT RRTYPE discussed in Section 3.13.2). This problem, and similar ones for some of the cases below, may suggest that any future design is in need of a different TYPE model such as systematic arrangements for subtypes or some explicit hierarchy in the TYPEs. - URI: Has a URI as its data, typically also requiring recursive or repeated lookups. 🔗
- Service location (SRV) and credential information (including Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM)): Require structured data and, especially for the latter two, significantly more data than most original RRTYPEs.
- URI/URL: The early design decision for the World Wide Web that its mechanism for identifying digital web content (now known as Uniform Resource Identifiers [RFC3986]) did so by using domain names and hence the network location of the information or other material. That, in turn, has required systems intended to improve web performance by locating and retrieving a "nearest copy" (rather than the single copy designated by the URL) to intercept DNS queries and respond with values that are not precisely those stored for the designated domain name in the DNS, or to otherwise access information in a way not supported by the DNS itself. 🌍
3.13.2. Extensions and Deployment Pressures -- The TXT RRTYPE 🍓
Unfortunately (but unsurprisingly), and despite IETF efforts to make things easier [RFC6895], DNS support libraries have often been slow to add full support for new RRTYPEs. This has impeded deployment of applications that depend on those types and that must ask (query) explicitly for them. Both to get faster deployment and, at least until recently, to avoid burdensome IETF approval procedures, many application designers have chosen to push protocol-critical information into records with TXT RRTYPE, a record type that was originally intended to include only information equivalent to comments. 🙈
This causes two problems. First, TXT records used this way tend to get long and complex, which is a problem in itself if one is trying to minimize TCP connections. Second, applications that are attempting to obtain data cannot merely ask for the relevant QTYPE; they must obtain all of the records with QTYPE TXT and parse them to determine which ones are of interest. That would be easier if there was some standard for how to do that parsing, but, at least in part because the clear preference in the DNS design is for distinct RRTYPEs for different kinds of information, there is no such standard. (There was a proposal in 1993 to structure the TXT DATA in a way that would have addressed the issue [RFC1464], but it apparently never went anywhere. 🥲)
On the other hand, this issue is somewhat different from most of the others described in this document because (as the IETF has recommended several times) the problem is easily solved within the current DNS design by allocating and supporting new RRTYPEs when needed, rather than using TXT as a workaround (that does not mean that other solutions are impossible, either with the current DNS or with some other design). The problem then lies in the implementations and/or mechanisms that deter or impede rapid deployment of support for new RRTYPEs.
3.13.3. Periods and Zone Cut Issues 🧚
One of the DNS characteristics that is poorly understood by non-experts is that the period (., U+002E) character can be used in four different ways:
- As a label separator in the presentation form that also designates a "zone break" (delegation boundary). For example,
foo.bar.example.comindicates the owner, "foo", of records in the "bar.example.com" zone. - As a label separator in the presentation form that does not designate a zone break. For example,
foo.bar.example.comindicates the owner, "foo.bar", of records in the "example.com" zone. - As a character within a label, including as a substitute for an at-sign (
@) when an email address appears in an SOA record or in a label that denotes such an address (see Section 2 above). The ability to embed periods in labels in this way has also led to attacks in which, e.g., a domain name consisting of the labels "example" followed by "com" is deliberately confused with the single label "example.com" with an embedded period. 😈 - At the end of a fully qualified domain name to designate the root zone, e.g., "example.com." (RFC 1034, Section 3.1).
In general, these cases cannot be distinguished by looking at them. The third is problematic for non-DNS reasons, e.g., john.doe.example.net can be interpreted as either a simple FQDN or as a notation for john@doe.example.net, john.doe@example.net, or even (at least in principle) john.doe.example@net. 🤯
The distinction between the FQDN interpretation and the first email-like one was probably not important as the DNS was originally intended to be used. However, as soon as RRTYPEs (other than NS records that define the zone cut) are used that are sensitive to the boundaries between zones, the distinctions become important to people other than the relevant zone administrators. DNSSEC [RFC4033] involves one such set of relationships. It increases the importance of questions about what should go in a parent zone and what should go in child zones, and how much difference it makes if NS records in a parent zone for a child zone are consistent with the records and data in the child zone. This also causes application issues and may raise questions about relationships between registrars and one or more registries or, if they are separate, DNS operators.
3.14. Scaling of Reputation and Other Ancillary Information 💜
The original design for DNS administration, reflected in RFC 1591 [RFC1591] and elsewhere, assumed that all domains would exhibit a very high level of responsibility toward and for the community, and that level of responsibility would be enforced if necessary. 🥰
More recent decisions, many of them associated with commercialization of the DNS, have eroded those very strong assumptions of registry responsibility and accountability to the point that many consider decisions about delegation of names, identification of registrants, and relationships among names to be matters of "registrant beware" and even "user and applications beware". 😬 While some recent protocols and proposals at least partially reflect that original model of a high level of responsibility (see, e.g., IDNA [RFC5890] and a more recent discussion [Klensin-5891bis]), other decisions and actions tend to shift responsibility to the registrant or try to avoid accountability entirely. One possible approach to the problems, especially security problems, that are enabled by those new trends and the associated environment is to establish reputation systems associated with clearly defined administrative boundaries and with warnings to users, even if those reputation systems are managed by parties not directly associated with the DNS. this is the kind of plan that gives me hope ✨
The IETF DBOUND WG [IETF-DBOUND] addressed ways to establish and document boundaries more precise than simple dependencies on TLDs, but it was not successful in producing a standard. 🥀
A TLD reputation-based approach was adopted by some web browsers after IDNs and a growing number of Generic Top-Level Domains (gTLDs) were introduced. That approach was based on a simple list and does not scale to the current size of the DNS or even the DNS root. 📜
3.15. Tensions among Transport, Scaling, and Content 🎀
The original design for the DNS envisaged a simple query and response protocol where both the command and the response could be readily mapped into a single IP packet. The host requirements specification [RFC1123] required all DNS applications to accept a UDP query or response over UDP with up to 512 octets of DNS payload. TCP was seen as a fallback when the response was greater than this 512-octet limit, and this fallback to use TCP as the transport protocol was considered to be the exception rather than the rule. 📦
Over the intervening years, we have seen the rise of a common assumption of an Internet-wide Maximum Transmission Unit (MTU) size of 1,500 octets, accompanied with an assumption that UDP fragmentation is generally viable. This underpins the adoption of the Extension Mechanisms for DNS (EDNS(0)) [RFC6891] to, among other things, specify a UDP buffer size larger than 512 octets, and a suggestion within that specification to use 4,096 as a suitable compromise for the UDP payload size. This has proved to be fortuitous for the DNSSEC security extensions, where the addition of DNSSEC security credentials in DNS responses [RFC4034] can lead to the use of large DNS responses. However, this exposes some tensions over the handling of fragmentation in IP, where UDP fragments have been observed to be filtered by various firewalls. Additionally for IPv6, there are the factors of filtering the ICMPv6 Packet Too Big diagnostic messages and discarding the IPv6 packets that contain extension headers [RFC7872]. More generally, fragmented UDP packets appear to have a lower level of reliability than unfragmented TCP packets. 😵💫
Behind this observation about relative reliability of delivery is the tension between the lightweight load of UDP and the downside of elevated probability of discarding packet fragments as compared to TCP, which offers increased levels of assurance of content delivery, but with the associated imposition of TCP session state and the downside of reduced DNS scalability and increased operational cost. it's all a trade-off, bestie 🌈
4. The Inverse Lookup Requirement ✨
okay so bestie, the need for inverse lookup 🔍 was spotted way back in RFC 882. That means being able to find a domain name when you've got an address, and in theory finding the owner of a record by any of its data elements. 💅 It was marked optional, but it got carried forward into RFCs 1034 and 1035 anyway. Then RFC 1034 explicitly deprecated it for address-to-hostname lookup, even though RFC 1035 literally uses that exact kind of lookup in an example 💀. It's giving mixed signals, ngl. Even though RFC 1035 talks about inverted forms of the database, inverse lookup has rarely, if ever, been implemented, at least in its general form 🙈. The big problems with inverse lookup, whether in the RFC 882 form or the "in-addr.arpa" approach I'll mention below, match the issues in classic database management papers [Codd1970]. But RFC 1035 and related IETF docs from that time never actually called them out 😭.
It's honestly so interesting to imagine how many of the current requirements to treat aliases as one integrated set of synonyms (for example, variant handling) would have been handled if inverse lookups could reliably give you the owners of CNAME records 🧚.
Still, it was obviously important to have some way to do address-to-name resolution 🌸. That job went to PTR RRTYPE entries in the IN-ADDR.ARPA zone, with delegations on octet boundaries. The catch is that this meant keeping the information in parallel, in separate zones, for the name-to-address and address-to-name mappings 💔. That synchronization requirement for two copies of basically the same data was a super popular topic in database management literature a decade or more before the DNS even existed, and, predictably, it led to lots of inconsistencies and other failures 🙃.
Then came Classless Inter-Domain Routing (CIDR) [RFC1518] and Provider-Dependent addresses, and things got even messier 😩. It was no longer possible to delegate reverse mapping records for small networks to the actual operators of those networks. ISPs and other aggregators often had no incentive to keep reverse mapping records consistent with the domain names that network operators assigned 🙄. A proposal to use binary labels to work around that issue [RFC2673] was abandoned somewhat over three years later [RFC6891] 💀.
Here's the tea: however much or little harm the lack of a general inverse lookup facility has caused, and however well the "in-addr.arpa" approach has worked, inverse lookup is still a facility that was anticipated and known to be useful in the original DNS design. It just never got fully realized 🥲✨.
5. Internet Scale, Function Support, and Incremental Deployment 🌈
okay so on top of the stress from the new functions, including the ones described in Section 3.13, there's another problem 😤. When systems that use those functions get deployed bit by bit, some features work in some environments and not others. This has been especially rough with complex, multi-record capabilities like DNSSEC that provide or require special validation mechanisms 🔐. It's also been rough with some EDNS(0) extensions [RFC6891] that require both the client and the server to accept particular extensions. And when DNS functionality is needed in embedded devices, rolling out new features across the entire Internet in a reasonable amount of time is nearly impossible 😭.
If someone were redesigning the DNS from scratch, they could imagine ways to make these issues a little more manageable 🎀. And of course, the features we already know are necessary today could become part of the baseline: a "mandatory to implement" specification 👑.
6. Searching and the DNS -- An Historical Note 🦋
Some of the issues we've talked about might be fixed, not by changing the DNS itself, but by changing our model of what it's about and how people use it 💭. The key assumption when the DNS (and the host table system before it) was designed was that it was a naming system for network resources, not, say, digital content 🖥️. So exact matching was important, and it made sense for labels to be treated as mnemonics that didn't necessarily carry linguistic or semantic meaning, except to the people using them 🧠. Going back to that model, probably by having user-facing applications call on an intermediate layer to sort out friendly names and map them to DNS names (or to network object locators more generally), would seriously lighten the load on the DNS 🫶. It would also let us deal with kinds of matching, and similar or synonymous strings, that can't be handled algorithmically no matter how much the DNS matching rules get changed 🌸.
In some ways, search engines built on free-text analysis and linkages among information have ended up doing a lot of the jobs such an intermediate layer would do 🔎. Many studies and sources have pointed out that few users actually understand, let alone care about, the difference between a DNS name and a search term 🙈. Some recent web browsers have even noticed that this difference doesn't really work, and they've reinforced that by getting rid of the separation between "URL" and "search bar" 💀.
It's worth noting that, while that "search" approach, or some other approach that abstracted and separated several of the issues identified in Section 3 from the DNS protocol and database themselves, doesn't fix all of them 🙅♀️. At least some parts of several of those issues, like the synchronization ones described in Section 3.7 and the transport ones described in Section 3.15, are baked into the DNS design. And if we're not going to replace the DNS, we'd better get used to them 🫠.
Early in the last decade, the IETF did some preliminary exploring of the intermediate-layer approach in the context of IDNs and what were then called "Internet keywords" [DNS-search] 🧭. That exploratory effort met several times informally, but it never became an organized IETF activity 🥀. That was mostly because of the choice of what became the IDNA approach, though signs that the "Internet keywords" efforts were starting to fall apart also played a part 😬.
Maybe it's time to take another look at intermediate-layer approaches 👀. If so, the effort should look at how appropriate user-facing applications could use those approaches to address some of the issues identified above 💖. The Internet and the DNS have changed a lot since the 2000-2003 period 🚀. Several of those changes are discussed elsewhere in this document. Others, like repurposing the DNAME RRTYPE from supporting transitions [RFC2672] to a general-purpose mechanism for aliases of subtrees [RFC6672], and the addition of over a thousand new TLDs [IANA-TLD-registry], aren't covered there. They're still part of the context for intermediate-layer work that didn't exist in 2003 🌍✨.
7. Security Considerations 💀🔐
okay this section is serious, so buckle up 😭. A wide range of security issues has come up, both about securing the DNS and about abilities to use namespaces for nefarious purposes 😈. Issues with securing the DNS would obviously be essential to any replacement of the DNS 🛡️. Issues with preventing nefarious use of the namespace, like using a name that appears or disappears as a signal to bots, would seem to be harder to solve within the naming system itself 🤖. Stay safe out there, bestie 🫶.
8. References 📚
8.1. Normative References 💜
[RFC1034] Mockapetris, P., "Domain names - concepts and facilities",
STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987,
<https://www.rfc-editor.org/info/rfc1034>.
[RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
November 1987, <https://www.rfc-editor.org/info/rfc1035>.8.2. Informative References 🌸
[CACM-Homograph]
Gabrilovich, E. and A. Gontmakher, "The Homograph Attack",
Communications of the ACM, Volume 45, Issue 2, pp. 128,
DOI 10.1145/503124.503156, February 2002,
<http://www.cs.technion.ac.il/~gabr/papers/
homograph_full.pdf>.
[Cerf2017] Cerf, V., "Desirable Properties of Internet Identifiers",
IEEE Internet Computing, Volume 21, Issue 6, pp. 63-64,
DOI 10.1109/MIC.2017.4180839, November/December 2017.
[Codd1970] Codd, E., "A Relational Model of Data for Large Shared
Data Banks", Communications of the ACM, Volume 13, Issue
6, pp. 377-387, DOI 10.1145/362384.362685, June 1970,
<https://dl.acm.org/citation.cfm?id=362685>.
[DNS-Aliases]
Woolf, S., Lee, X., and J. Yao, "Problem Statement: DNS
Resolution of Aliased Names", Work in Progress,
draft-ietf-dnsext-aliasing-requirements-01, March 2011.
[DNS-BNAME]
Yao, J., Lee, X., and P. Vixie, "Bundled DNS Name
Redirection", Work in Progress, draft-yao-dnsext-bname-06,
May 2016.
[DNS-search]
IETF, "Internet Resource Name Search Service (IRNSS)",
2003, <https://datatracker.ietf.org/wg/irnss/about/>.
[Faltstrom-2004]
Faltstrom, P. and R. Austein, "Design Choices When
Expanding DNS", Work in Progress,
draft-ymbk-dns-choices-00, May 2004.
[Hoffman-DNS-JSON]
Hoffman, P., "Representing DNS Messages in JSON", Work in
Progress, draft-hoffman-dns-in-json-13, October 2017.
[Hoffman-SimpleDNS-JSON]
Hoffman, P., "Simple DNS Queries and Responses in JSON",
Work in Progress, draft-hoffman-simplednsjson-01, November
2017.
[Huston2017a]
Huston, G. and J. Silva Dama, "DNS Privacy", The Internet
Protocol Journal, Vol. 20, No. 1, March 2017,
<http://ipj.dreamhosters.com/wp-content/uploads/
issues/2017/ipj20-1.pdf>.
[Huston2017b]
Huston, G., "The Root of the Domain Name System", The
Internet Protocol Journal, Vol. 20, No. 2, pp. 15-25, June
2017, <http://ipj.dreamhosters.com/wp-content/uploads/
2017/08/ipj20-2.pdf>.
[IANA-TLD-registry]
Internet Assigned Numbers Authority (IANA), "Root Zone
Database", <https://www.iana.org/domains/root/db>.
[ICANN-VIP]
ICANN, "IDN Variant Issues Project: Final Integrated
Issues Report Published and Proposed Project Plan for Next
Steps is Now Open for Public Comment", February 2012,
<https://www.icann.org/news/announcement-2012-02-20-en>.
[IETF-DBOUND]
IETF, "Domain Boundaries (dbound)", 2017,
<https://datatracker.ietf.org/wg/dbound/about/>.
[Klensin-5891bis]
Klensin, J. and A. Freytag, "Internationalized Domain
Names in Applications (IDNA): Registry Restrictions and
Recommendations", Work in Progress,
draft-klensin-idna-rfc5891bis-01, September 2017.
[Mockapetris-1988]
Mockapetris, P. and K. Dunlap, "Development of the Domain
Name System", SIGCOMM '88 Symposium, pp. 123-133,
available from ISI Reprint Series, ISI/RS-88-219
<ftp://ftp.isi.edu/isi-pubs/rs-88-219.pdf>,
DOI 10.1145/52324.52338, August 1988,
<http://dl.acm.org/citation.cfm?id=52338>.Okay, the reference list is where we bow down 🙇♀️✨ Every single one of these is getting its full credit, bestie.
[NRC-Signposts] National Research Council, Signposts in Cyberspace: The Domain Name System and Internet Navigation, ISBN 0-309-54979-5, 2005, <https://www.nap.edu/catalog/11258/signposts-in-cyberspace-the-domain-name-system-and-internet-navigation>. 📚
[RFC0236] Postel, J., "Standard host names", RFC 236, DOI 10.17487/RFC0236, September 1971, <https://www.rfc-editor.org/info/rfc236>. 🌸
[RFC0247] Karp, P., "Proffered set of standard host names", RFC 247, DOI 10.17487/RFC0247, October 1971, <https://www.rfc-editor.org/info/rfc247>. 🌸
[RFC0799] Mills, D., "Internet name domains", RFC 799, DOI 10.17487/RFC0799, September 1981, <https://www.rfc-editor.org/info/rfc799>. 💜
[RFC0810] Feinler, E., Harrenstien, K., Su, Z., and V. White, "DoD Internet host table specification", RFC 810, DOI 10.17487/RFC0810, March 1982, <https://www.rfc-editor.org/info/rfc810>. 🎀
[RFC0881] Postel, J., "Domain names plan and schedule", RFC 881, DOI 10.17487/RFC0881, November 1983, <https://www.rfc-editor.org/info/rfc881>. 🦋
[RFC0882] Mockapetris, P., "Domain names: Concepts and facilities", RFC 882, DOI 10.17487/RFC0882, November 1983, <https://www.rfc-editor.org/info/rfc882>. 🦋
[RFC0883] Mockapetris, P., "Domain names: Implementation specification", RFC 883, DOI 10.17487/RFC0883, November 1983, <https://www.rfc-editor.org/info/rfc883>. 🦋
[RFC0952] Harrenstien, K., Stahl, M., and E. Feinler, "DoD Internet host table specification", RFC 952, DOI 10.17487/RFC0952, October 1985, <https://www.rfc-editor.org/info/rfc952>. 🎀
[RFC0953] Harrenstien, K., Stahl, M., and E. Feinler, "Hostname Server", RFC 953, DOI 10.17487/RFC0953, October 1985, <https://www.rfc-editor.org/info/rfc953>. 🎀
[RFC0974] Partridge, C., "Mail routing and the domain system", STD 10, RFC 974, DOI 10.17487/RFC0974, January 1986, <https://www.rfc-editor.org/info/rfc974>. ✉️
[RFC1123] Braden, R., Ed., "Requirements for Internet Hosts - Application and Support", STD 3, RFC 1123, DOI 10.17487/RFC1123, October 1989, <https://www.rfc-editor.org/info/rfc1123>. 🧚
[RFC1464] Rosenbaum, R., "Using the Domain Name System To Store Arbitrary String Attributes", RFC 1464, DOI 10.17487/RFC1464, May 1993, <https://www.rfc-editor.org/info/rfc1464>. 🍓
[RFC1518] Rekhter, Y. and T. Li, "An Architecture for IP Address Allocation with CIDR", RFC 1518, DOI 10.17487/RFC1518, September 1993, <https://www.rfc-editor.org/info/rfc1518>. 🌈
[RFC1591] Postel, J., "Domain Name System Structure and Delegation", RFC 1591, DOI 10.17487/RFC1591, March 1994, <https://www.rfc-editor.org/info/rfc1591>. 👑
[RFC1996] Vixie, P., "A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY)", RFC 1996, DOI 10.17487/RFC1996, August 1996, <https://www.rfc-editor.org/info/rfc1996>. 🔔
[RFC2671] Vixie, P., "Extension Mechanisms for DNS (EDNS0)", RFC 2671, DOI 10.17487/RFC2671, August 1999, <https://www.rfc-editor.org/info/rfc2671>. 🧩
[RFC2672] Crawford, M., "Non-Terminal DNS Name Redirection", RFC 2672, DOI 10.17487/RFC2672, August 1999, <https://www.rfc-editor.org/info/rfc2672>. 🦋
[RFC2673] Crawford, M., "Binary Labels in the Domain Name System", RFC 2673, DOI 10.17487/RFC2673, August 1999, <https://www.rfc-editor.org/info/rfc2673>. 💅
[RFC3490] Faltstrom, P., Hoffman, P., and A. Costello, "Internationalizing Domain Names in Applications (IDNA)", RFC 3490, DOI 10.17487/RFC3490, March 2003, <https://www.rfc-editor.org/info/rfc3490>. 🌍
[RFC3491] Hoffman, P. and M. Blanchet, "Nameprep: A Stringprep Profile for Internationalized Domain Names (IDN)", RFC 3491, DOI 10.17487/RFC3491, March 2003, <https://www.rfc-editor.org/info/rfc3491>. 🌍
[RFC3596] Thomson, S., Huitema, C., Ksinant, V., and M. Souissi, "DNS Extensions to Support IP Version 6", STD 88, RFC 3596, DOI 10.17487/RFC3596, October 2003, <https://www.rfc-editor.org/info/rfc3596>. 💜
[RFC3743] Konishi, K., Huang, K., Qian, H., and Y. Ko, "Joint Engineering Team (JET) Guidelines for Internationalized Domain Names (IDN) Registration and Administration for Chinese, Japanese, and Korean", RFC 3743, DOI 10.17487/RFC3743, April 2004, <https://www.rfc-editor.org/info/rfc3743>. 🌏
[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, <https://www.rfc-editor.org/info/rfc3986>. 🔗
[RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "DNS Security Introduction and Requirements", RFC 4033, DOI 10.17487/RFC4033, March 2005, <https://www.rfc-editor.org/info/rfc4033>. 🔐
[RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Resource Records for the DNS Security Extensions", RFC 4034, DOI 10.17487/RFC4034, March 2005, <https://www.rfc-editor.org/info/rfc4034>. 🔐
[RFC4343] Eastlake 3rd, D., "Domain Name System (DNS) Case Insensitivity Clarification", RFC 4343, DOI 10.17487/RFC4343, January 2006, <https://www.rfc-editor.org/info/rfc4343>. 🔤
[RFC5890] Klensin, J., "Internationalized Domain Names for Applications (IDNA): Definitions and Document Framework", RFC 5890, DOI 10.17487/RFC5890, August 2010, <https://www.rfc-editor.org/info/rfc5890>. 🌍
[RFC5891] Klensin, J., "Internationalized Domain Names in Applications (IDNA): Protocol", RFC 5891, DOI 10.17487/RFC5891, August 2010, <https://www.rfc-editor.org/info/rfc5891>. 🌍
[RFC6672] Rose, S. and W. Wijngaards, "DNAME Redirection in the DNS", RFC 6672, DOI 10.17487/RFC6672, June 2012, <https://www.rfc-editor.org/info/rfc6672>. 🦋
[RFC6761] Cheshire, S. and M. Krochmal, "Special-Use Domain Names", RFC 6761, DOI 10.17487/RFC6761, February 2013, <https://www.rfc-editor.org/info/rfc6761>. ⭐
[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms for DNS (EDNS(0))", STD 75, RFC 6891, DOI 10.17487/RFC6891, April 2013, <https://www.rfc-editor.org/info/rfc6891>. 🧩
[RFC6895] Eastlake 3rd, D., "Domain Name System (DNS) IANA Considerations", BCP 42, RFC 6895, DOI 10.17487/RFC6895, April 2013, <https://www.rfc-editor.org/info/rfc6895>. 📋
[RFC6912] Sullivan, A., Thaler, D., Klensin, J., and O. Kolkman, "Principles for Unicode Code Point Inclusion in Labels in the DNS", RFC 6912, DOI 10.17487/RFC6912, April 2013, <https://www.rfc-editor.org/info/rfc6912>. 🌈
[RFC7094] McPherson, D., Oran, D., Thaler, D., and E. Osterweil, "Architectural Considerations of IP Anycast", RFC 7094, DOI 10.17487/RFC7094, January 2014, <https://www.rfc-editor.org/info/rfc7094>. 📡
[RFC7706] Kumari, W. and P. Hoffman, "Decreasing Access Time to Root Servers by Running One on Loopback", RFC 7706, DOI 10.17487/RFC7706, November 2015, <https://www.rfc-editor.org/info/rfc7706>. 🏠
[RFC7719] Hoffman, P., Sullivan, A., and K. Fujiwara, "DNS Terminology", RFC 7719, DOI 10.17487/RFC7719, December 2015, <https://www.rfc-editor.org/info/rfc7719>. 📖
[RFC7816] Bortzmeyer, S., "DNS Query Name Minimisation to Improve Privacy", RFC 7816, DOI 10.17487/RFC7816, March 2016, <https://www.rfc-editor.org/info/rfc7816>. 🙈
[RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., and P. Hoffman, "Specification for DNS over Transport Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May 2016, <https://www.rfc-editor.org/info/rfc7858>. 🔐
[RFC7872] Gont, F., Linkova, J., Chown, T., and W. Liu, "Observations on the Dropping of Packets with IPv6 Extension Headers in the Real World", RFC 7872, DOI 10.17487/RFC7872, June 2016, <https://www.rfc-editor.org/info/rfc7872>. 💀
[RFC8244] Lemon, T., Droms, R., and W. Kumari, "Special-Use Domain Names Problem Statement", RFC 8244, DOI 10.17487/RFC8244, October 2017, <https://www.rfc-editor.org/info/rfc8244>. ⭐
[Sullivan-Class] Sullivan, A., "The DNS Is Not Classy: DNS Classes Considered Useless", Work in Progress, draft-sullivan-dns-class-useless-03, July 2016. 🫶
[Unicode] The Unicode Consortium, The Unicode Standard, Version 9.0.0, (Mountain View, CA: The Unicode Consortium, 2016. ISBN 978-1-936213-13-9), <http://www.unicode.org/versions/Unicode9.0.0/>. 🌈
[Unicode-UAX15] Davis, M. and K. Whistler, "Unicode Standard Annex #15: Unicode Normalization Forms", February 2016, <http://unicode.org/reports/tr15/>. 🌈
[Unicode-USA31] Davis, M., "Unicode Standard Annex #31: Unicode Identifier and Pattern Syntax", May 2016, <http://unicode.org/reports/tr31/>. 🌈
[Vixie-20170704] Vixie, P., "Subject: Re: new DNS classes", message to the IETF dnsop mailing list, 4 July 2017, <https://www.ietf.org/mail-archive/web/ietf/current/msg103486.html>. ✨ the end of the list, we made it! ✨ 💖
Acknowledgements 🫶
okay so the acknowledgements are where John Klensin gives shoutouts to everyone who helped him get this doc together, and honestly it's giving grateful mentor energy 🥹. He says a lot of the concerns and ideas here came from conversations over many, many years, some of them rooted in the DNS "keyword" and "search" discussions that were happening alongside the development of IDNs 🌸. He names Rob Austein, Christine Borgman, Carolina Carvalho, Vint Cerf, Lyman Chapin, Nazli Choucri, Patrik Faltstrom, Geoff Huston, Xiaodong Lee, Karen Liu, Gervase Markham, Yaqub Mueller, Andrew Sullivan, Paul Twomey, Nico Williams, Suzanne Woolf, and Jiankang Yao 💜. He also thanks the other people in the circa 2003 "DNS Search" effort and in the ICANN SSAC Working Party on IDNs, plus some folks whose names he sadly forgot 😭. Everyone on that list was super important to either what's in here or why he wrote it at all. The little disclaimer is iconic too: they might not agree with his conclusions, and they're not responsible for them 💅.
Klensin also says many of the subsections in Section 3 started out as comments made during recent email discussions ✨. Suzanne Woolf's comments on an earlier draft were a big deal, and so was the material Patrik Faltstrom helped develop, especially Section 3.13 🧚. Stephane Bortzmeyer, Tony Finch, Bob Harold, Warren Kumari, Craig Partridge, and George Sadowsky gave feedback and suggestions that made parts of the document clearer and more accurate, especially for a wider audience 🎀. Craig Partridge also wrote much of the material about queries for multiple types 🙌. Geoff Huston left several useful comments and wrote most of Section 3.15 🦋. Bill Manning pointed out some broader requirements about the integrity of information and about DNS management and operations 🍓.
Special thanks go to Karen Moore of the RFC Production Center 👑. She put in so much effort, patience, and persistence to get this doc published, and the process raised way more issues needing careful discussion than usual, which is saying something 💀.
Author's Address 🎀
Here's where you can reach John C. Klensin 💌:
John C. Klensin
1770 Massachusetts Ave, Ste 322
Cambridge, MA 02140
United States of America
Phone: +1 617 245 1457
Email: john-ietf@jck.comThat's the whole doc, bestie! 🌈✨ Thanks for reading all seven parts with me 🫶💖
📦 where this page comes from
- ietf: rfc8324 2018-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms