RFC 8553

DNS Attrleaf Changes: Fixing Specifications That Use Underscored Node Names

📅 published March 2019, from ietf

DNS AttrLeaf Changes: Fixing Specifications That Use Underscored Node Names ✨

Okay bestie, this one is a Best Current Practice (BCP 222) 💅 It's by D. Crocker and Brandenburg InternetWorking, dated March 2019, and it's in the "Best Current Practice" category. It updates a whole list of RFCs: RFC 2782, RFC 3263, RFC 3529, RFC 3620, RFC 3832, RFC 3887, RFC 3958, RFC 4120, RFC 4227, RFC 4386, RFC 4387, RFC 4976, RFC 5026, RFC 5328, RFC 5389, RFC 5415, RFC 5518, RFC 5555, RFC 5617, RFC 5679, RFC 5766, RFC 5780, RFC 5804, RFC 5864, RFC 5928, RFC 6120, RFC 6186, RFC 6376, RFC 6733, RFC 6763, RFC 7208, RFC 7489, and RFC 8145. It doesn't obsolete anything. The ISSN is 2070-1721, and it's RFC 8553 🦋

Abstract 🌸

Okay so underscores at the start of a name carve out a little lane for resource records to do their thing in a constrained way. The thing is, the original underscore names were made without any IANA registry, so everyone was just grabbing from the same namespace with zero coordination 😭 Now there's a registry (from RFC 8552), but the older specs that use underscored names still need updating to match it. This doc lays out those changes, and the good news is it keeps existing software and real-world practice working exactly as they are 🫶

Status of This Memo 💜

This memo documents an Internet Best Current Practice.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on BCPs is available in Section 2 of RFC 7841.

Info about the current status of this doc, any errata, and how to send feedback lives at https://www.rfc-editor.org/info/rfc8553.

Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents 🧚

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Underscored RRset Use in Specifications . . . . . . . . . . .   3
  2.1.  TXT RRset . . . . . . . . . . . . . . . . . . . . . . . .   4
  2.2.  SRV RRset . . . . . . . . . . . . . . . . . . . . . . . .   5
  2.3.  URI RRset . . . . . . . . . . . . . . . . . . . . . . . .   6
3.  Underscored Template Specifications . . . . . . . . . . . . .   7
  3.1.  SRV Specification Changes . . . . . . . . . . . . . . . .   7
  3.2.  URI Specification Changes . . . . . . . . . . . . . . . .   8
  3.3.  DNSSEC Signaling Specification Changes  . . . . . . . . .  10
4.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  11
5.  Security Considerations . . . . . . . . . . . . . . . . . . .  11
6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  11
  6.1.  Normative References  . . . . . . . . . . . . . . . . . .  11
  6.2.  Informative References  . . . . . . . . . . . . . . . . .  12
Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .  15
Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  15

1. Introduction ✨

Okay so original uses of an underscore as a domain node name prefix [RFC1035] make a space for constrained interpretation of resource records. Those got specified before there was an IANA registry for them [IANA-reg], which led to a totally uncoordinated free-for-all in one namespace 💀 A registry exists now (see Section 4 of [RFC8552]), and that RFC also talks about the background of underscored domain names [RFC8552].

The basic model for underscored name registration, per [RFC8552], is that each registry entry is unique by the combo of a resource record type and a "global" (highest-level) underscored node name. That just means the underscored name closest to the DNS root 🌈

The specs describing the existing underscored names don't mention this integrated registry at all. So if you're a new reader or a new editor of one of those docs, there's nothing telling you these names now go through an IANA registry. This document fixes that by marking each published doc with an update that shows what changed 🎀

It also gets into the SRV [RFC2782] and URI [RFC7553] DNS resource records, which give a meta-template for underscored names, partly based on separate registries [RFC6335]. For the part that picks the global (highest-level) underscored node name, that setup keeps separate tech specs assigning names from the same namespace without coordination. This document gives the details for revising the SRV and URI specs so they line up with the single, integrated "Underscored and Globally Scoped DNS Node Names" registry 👑

Everything here keeps existing software and operations practice working while bringing the tech specs over to the newer underscore registry model 🍓

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

2. Underscored RRset Use in Specifications 🌸

The use of underscored node names is specific to each RR TYPE being scoped. Each name marks a spot, but it doesn't decide what goes underneath it, whether that's more underscored naming or a leaf node with resource records. The rules for that stuff live in the specs for each individual RR TYPE. The sections below describe how the existing underscored names get used with the RR TYPEs they name 💖

2.1. TXT RRset 🦋

NOTE - Documents falling into this category include: [RFC5518], [RFC5617], [RFC6120], [RFC6376], [RFC6763], [RFC7208], and [RFC7489].

This section gives a generic approach for changing existing specs that define straightforward use of underscored node names when scoping the use of a TXT RRset. It gives the info needed to adapt those specs to the IANA "Underscored and Globally Scoped DNS Node Names" registry [RFC8552]. So this approach works both as an update to these existing specs and as guidance for changes whenever those docs get revised ✨

For any doc that specifies the use of a TXT RRset under one or more underscored names, the global node name is expected to be registered in the IANA "Underscored and Globally Scoped DNS Node Names" registry [RFC8552]. People made an effort to find existing docs that do this, register their global underscored node names, and list them in the initial set of names added to the registry 🫶

If a public spec defines the use of a TXT RRset and calls for an underscored node name, here's a suggested template you can use through the IANA Considerations section of the spec. It's for registering the global underscored node name, the one closest to the root:

"Per [RFC8552], please add the following entry to the "Underscored
and Globally Scoped DNS Node Names" registry:"

+--------+----------------+-----------------------------------------+
| RR     | _NODE NAME     | Reference                               |
| Type   |                |                                         |
+--------+----------------+-----------------------------------------+
| TXT    | _{DNS node     | {citation for the document making the   |
|        | name}          | addition}                               |
+--------+----------------+-----------------------------------------+

Table 1: Entry for the "Underscored and Globally Scoped DNS Node Names" Registry for TXT RR Use

2.2. SRV RRset 💅

NOTE - Documents falling into this category include: [RFC3263], [RFC3529], [RFC3620], [RFC3832], [RFC3887], [RFC3958], [RFC4120], [RFC4227], [RFC4386], [RFC4387], [RFC4976], [RFC5026], [RFC5328], [RFC5389], [RFC5415], [RFC5555], [RFC5679], [RFC5766], [RFC5780], [RFC5804], [RFC5864], [RFC5928], and [RFC6186].

Okay so the SRV resource record spec [RFC2782] already gives a template for using underscored node names. The global node name is described as referring to the 'protocol' tied to SRV RRset usage 🧚

This section gives a generic approach for changing existing specs that define the use of an SRV RRset. It has the info needed to adapt those specs to the IANA "Underscored and Globally Scoped DNS Node Names" registry [RFC8552]. So, same as before, the approach is meant both as an update to these existing specs and as guidance for when those docs get revised 💜

For any doc that specifies the use of an SRV RRset, the global ('protocol') underscored node name is expected to be registered in the IANA "Underscored and Globally Scoped DNS Node Names" registry [RFC8552]. People made an effort to find existing docs doing this, register the global underscored node names, and list them in the initial set of names added to the registry 🌈

If a public spec defines the use of an SRV RRset and calls for an underscored node name, here's the suggested template for registering the global underscored node name (the one closest to the root) through the IANA Considerations section of the spec:

"Per [RFC8552], please add the following entry to the "Underscored
and Globally Scoped DNS Node Names" registry:

+--------+----------------------+-----------------------------------+
| RR     | _NODE NAME           | Reference                         |
| Type   |                      |                                   |
+--------+----------------------+-----------------------------------+
| SRV    | _{DNS 'protocol'     | {citation for the document making |
|        | node name}           | the addition}                     |
+--------+----------------------+-----------------------------------+

Table 2: Entry for the "Underscored and Globally Scoped DNS Node Names" Registry for SRV RR Use

2.3. URI RRset ✨

okay so the URI resource record [RFC7553] already has its own template for underscored node names 🎀. The global node name names the 'protocol' tied to URI RR usage, or you get it by reversing an Enumservice sequence [RFC6117] 🧚.

This section is the generic game plan for updating existing specs that already use a URI RRset 💅. It gives you what you need to adapt those specs to the IANA "Underscored and Globally Scoped DNS Node Names" registry [RFC8552]. So it's an update to those specs AND guidance for whenever they get revised later 🫶.

For any document that specifies the use of a URI RRset, the global ('protocol' or highest-level Enumservice) underscored node name is expected to be registered in the IANA "Underscored and Globally Scoped DNS Node Names" registry [RFC8552]. Someone went hunting for existing docs that already do this, registered their global names, and added them to the initial set in the registry 🔍✨.

If a public specification defines use of a URI RRset and calls for an underscored node name, here's suggested text for registering the global name (the one closest to the root) through the IANA Considerations section of that spec. It's giving template 📝:

   "Per [RFC8552], please add the following entry to the "Underscored
   and Globally Scoped DNS Node Names" registry:

   +-------+----------------------------+------------------------------+
   | RR    | _NODE NAME                 | Reference                    |
   | Type  |                            |                              |
   +-------+----------------------------+------------------------------+
   | URI   | _{DNS 'protocol' or        | {citation for the document   |
   |       | Enumservice node name}     | making the addition}         |
   +-------+----------------------------+------------------------------+

     Table 3: Entry for the "Underscored and Globally Scoped DNS Node
                      Names" Registry for URI RR Use

3. Underscored Template Specifications 🦋

3.1. SRV Specification Changes

so the domain name where an SRV resource record [RFC2782] shows up already has a template for underscored node names 💖. The global underscored node name is basically the 'protocol' tied to SRV RR usage.

Here's the deal: [RFC2782] gets changed as described below 🌸. There's also a normative reference to RFC 8552 getting added to the References section of RFC 2782, so it's all connected 🔗.

OLD:

The format of the SRV RR

 Here is the format of the SRV RR, whose DNS type code is 33:
       _Service._Proto.Name TTL Class SRV Priority Weight Port Target
 ...
 Proto
      The symbolic name of the desired protocol, with an underscore
      (_) prepended to prevent collisions with DNS labels that occur
      in nature.  _TCP and _UDP are at present the most useful values
      for this field, though any name defined by Assigned Numbers or
      locally may be used (as for Service).  The Proto is case
      insensitive.

NEW:

      The format of the SRV RR

      Here is the format of the SRV RR, whose DNS type code is 33:

         "_Service._Proto.Name TTL Class SRV Priority Weight Port
         Target"

         _..._

      Proto

         The symbolic name of the desired protocol with an underscore
         (e.g., "_name") prepended to prevent collisions with DNS
         labels that occur in nature. _TCP and _UDP are at present
         the most useful values for this field.  The Proto is case
         insensitive.

         The SRV RRset 'protocol' (global) underscored node name
         SHOULD be registered in the IANA "Underscored and Globally
         Scoped DNS Node Names" registry [RFC8552].

3.2. URI Specification Changes

the domain name where a URI resource record [RFC7553] lives is pretty similar to the SRV one [RFC2782] 🎀. The big difference is that the URI spec only talks about a 'service' name, not splitting it into 'service' and 'protocol' 🤏.

On top of that, the URI RR spec allows two different underscored naming schemes 🌈:

  • One matches what SRV does, with the global underscored node name called 'protocol'.
  • The other is based on reversing an Enumservice [RFC6117] sequence.

Text of [RFC7553] gets changed as described below 💅. A normative reference to RFC 8552 is also added to the References section of RFC 7553 ✨.

OLD:

4.1.  Owner Name, Class, and Type

The URI owner name is subject to special conventions.

Just like the SRV RR [RFC2782], the URI RR has service information
encoded in its owner name.  In order to encode the service for a
specific owner name, one uses service parameters.  Valid service
parameters are those registered by IANA in the "Service Name and
Transport Protocol Port Number Registry" [RFC6335] or as "Enumservice
---
Registrations [RFC6117].  The Enumservice Registration parameters are
reversed (i.e., subtype(s) before type), prepended with an underscore
(_), and prepended to the owner name in separate labels.  The
underscore is prepended to the service parameters to avoid collisions
with DNS labels that occur in nature, and the order is reversed to
make it possible to do delegations, if needed, to different zones
(and therefore providers of DNS).

For example, suppose we are looking for the URI for a service with
ENUM Service Parameter "A:B:C" for host example.com.  Then we would
query for (QNAME,QTYPE)=("_C._B._A.example.com","URI").

As another example, suppose we are looking for the URI for a service
with Service Name "A" and Transport Protocol "B" for host
example.com.  Then we would query for
(QNAME,QTYPE)=("_A._B.example.com","URI").

NEW:

      4.1.  Owner Name, Class, and Type

      The URI owner name is subject to special conventions.

      As for the SRV RRset [RFC2782], the URI RRset global (highest-
      level) underscored node name SHOULD be registered in the IANA
      "Underscored and Globally Scoped DNS Node Names" registry
      [RFC8552].

      Just like the SRV RRset, the URI RRset has service information
      encoded in its owner name.  In order to encode the service for
      a specific owner name, one uses service parameters.  Valid
      service parameters are:

      +  Those registered by IANA in the "Service Name and Transport
         Protocol Port Number Registry" [RFC6335].  The underscore is
         prepended to the service parameters to avoid collisions with
         DNS labels that occur in nature, and the order is reversed
         to make it possible to do delegations, if needed, to
         different zones (and therefore providers of DNS).

      +  Those listed in "Enumservice Registrations" [RFC6117].  The
         Enumservice Registration parameters are reversed (i.e.,
         subtype(s) before type), prepended with an underscore (e.g.,
         "_name"), and prepended to the owner name in separate
         labels.  The highest-level (global) underscored Enumservice
         name becomes the global name per RFC 8552 to register.

      For example, suppose we are looking for the URI for a service
      with ENUM Service Parameter "A:B:C" for host example.com.  Then
      we would query for
      (QNAME,QTYPE)=("_C._B._A.example.com","URI").

      As another example, suppose we are looking for the URI for a
      service with Service Name "A" and Transport Protocol "B" for
      host example.com.  Then we would query for
      (QNAME,QTYPE)=("_A._B.example.com","URI").

3.3. DNSSEC Signaling Specification Changes

"Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC)" [RFC8145] uses DNS node names in a way that effectively takes over every name beginning with the string "_ta-" when the NULL RR is used in the query 🕵️‍♀️.

Section 5.1, "Query Format", of RFC 8145 gets changed as described below 📖. There's also a normative reference to RFC 8552 added to the References section of RFC 8145 🫶.

OLD:

For example, a validating DNS resolver ...
                           QNAME=_ta-4444.

NEW:

      For example, a validating DNS resolver ...  "QNAME=_ta-4444".

      Under the NULL RR, an entry is registered in the IANA
      "Underscored and Globally Scoped DNS Node Names" registry
      [RFC8552] for all node names beginning with "_ta-".

4. IANA Considerations 📋

this document does reference IANA registries, but it doesn't create any new IANA registries or procedures 🌸.

5. Security Considerations 🙈

this memo raises no security issues 🔒✨. Not a single one, bestie. Lowkey iconic 💅.

6. References 📚

6.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC6117]  Hoeneisen, B., Mayrhofer, A., and J. Livingood, "IANA
           Registration of Enumservices: Guide, Template, and IANA
           Considerations", RFC 6117, DOI 10.17487/RFC6117, March
           2011, <https://www.rfc-editor.org/info/rfc6117>.

[RFC6335]  Cotton, M., Eggert, L., Touch, J., Westerlund, M., and S.
           Cheshire, "Internet Assigned Numbers Authority (IANA)
           Procedures for the Management of the Service Name and
           Transport Protocol Port Number Registry", BCP 165,
           RFC 6335, DOI 10.17487/RFC6335, August 2011,
           <https://www.rfc-editor.org/info/rfc6335>.

[RFC7553]  Faltstrom, P. and O. Kolkman, "The Uniform Resource
           Identifier (URI) DNS Resource Record", RFC 7553,
           DOI 10.17487/RFC7553, June 2015,
           <https://www.rfc-editor.org/info/rfc7553>.

[RFC8145]  Wessels, D., Kumari, W., and P. Hoffman, "Signaling Trust
           Anchor Knowledge in DNS Security Extensions (DNSSEC)",
           RFC 8145, DOI 10.17487/RFC8145, April 2017,
           <https://www.rfc-editor.org/info/rfc8145>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[RFC8552]  Crocker, D., "Scoped Interpretation of DNS Resource
           Records through "Underscored" Naming of Attribute Leaves",
           RFC 8552, DOI 10.17487/RFC8552, March 2019,
           <https://www.rfc-editor.org/info/rfc8552>.

6.2. Informative References ✨

Okay, bestie, now we're in the "good to know" section 🦋 These are the extra reads that help you understand the bigger picture. Here they are, all of them, exactly as they're cited:

Acknowledgements ✨

Huge thank-yous to Bill Fenner, Dick Franks, Tony Hansen, Peter Koch, Olaf Kolkman, and Andrew Sullivan 🫶 for their super careful review of the (much) earlier draft versions. 💖 For the later enhancements, the love goes to Tim Wicinski, John Levine, Bob Harold, Joel Jaeggli, Ondrej Sury, and Paul Wouters. 👑

Special thanks to Ray Bellis 🌈 for constantly cheering this effort on, and for suggesting an essential simplification to the registration model. Iconic. 💅

Author's Address 🎀

Dave Crocker
Brandenburg InternetWorking
675 Spruce Dr.
Sunnyvale, CA  94086
United States of America

Phone: +1.408.246.8253
Email: dcrocker@bbiw.net
URI:   http://bbiw.net/
📦 where this page comes from