1. qname-minimisation

Contents

qname-minimisation

/RIPE Measure qmin yourself

https://www.sidnlabs.nl/en/news-and-blogs/taking-another-look-at-query-name-minimization-in-the-dns

1.1. RFC

S. Bortzmeyer: DNS Query Name Minimisation to Improve Privacy

Category: Experimental https://tools.ietf.org/html/rfc7816

QNAME minimisation is legal, since the original DNS RFC do not mandate sending the full QNAME.

/possible-issues

watch-www/japanweb.ne.jp のような設定？は問題が起きる。-- ToshinoriMaeno 2017-03-15 00:35:42

DNS/RFC/8020 NXDOMAIN: There Really Is Nothing Underneath

/CNAME返答との関連で、注意が必要か。

DNS Query Privacy

By Geoff Huston on 12 Aug 2019 https://blog.apnic.net/2019/08/12/dns-query-privacy/

https://okuranagaimo.blogspot.com/2019/08/dns.html (日本語訳)

privacy保護よりも、/毒盛対策としての価値を認めたい。

Shumon Huque: https://indico.dns-oarc.net/event/21/contribution/9/material/slides/0.pdf Query-name minimization and authoritative DNS server behavior Venue: DNS-OARC, May 9th 2015, Amsterdam, NL

1.2. 実装

Knot resolverのソースを読んでいる。（後述）

/unboundでも使えるらしい。

1.3. NS query

NS queryに対する返事がおかしいサーバー博物館

broken middleboxes

Some broken name servers do not react properly to qtype=NS requests.

For instance, some authoritative name servers embedded in load balancers 
  reply properly to A queries but send REFUSED to NS queries.
This behaviour is a protocol violation, and there is no need to stop improving 
  the DNS because of such behaviour.

Aは答えるのに、NSにはREFUSEDを返すload balancerがある。

NSを問い合わせているのに、Aを答えてくるサーバもある。(あきれる）

Knot resolverがおもしろい。（実装、試行中のようだ。）/検索例

Will this algorithm will be harder to deploy because of middleboxes
that might trap NS queries as unexpected, or 
broken authority servers that don’t respond correctly to explicit NS queries?

watch-www/japanweb.ne.jp を検索するとなにが起きるだろう。-- ToshinoriMaeno 2016-10-12 00:22:04