1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
|
<pre>Internet Engineering Task Force (IETF) J. Abley
Request for Comments: 7535 Dyn, Inc.
Category: Informational B. Dickson
ISSN: 2070-1721 Twitter, Inc.
W. Kumari
Google
G. Michaelson
APNIC
May 2015
<span class="h1">AS112 Redirection Using DNAME</span>
Abstract
AS112 provides a mechanism for handling reverse lookups on IP
addresses that are not unique (e.g., <a href="./rfc1918">RFC 1918</a> addresses). This
document describes modifications to the deployment and use of AS112
infrastructure that will allow zones to be added and dropped much
more easily, using DNAME resource records.
This approach makes it possible for any DNS zone administrator to
sink traffic relating to parts of the global DNS namespace under
their control to the AS112 infrastructure without coordination with
the operators of AS112 infrastructure.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are a candidate for any level of Internet
Standard; see <a href="./rfc5741#section-2">Section 2 of RFC 5741</a>.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
<a href="http://www.rfc-editor.org/info/rfc7535">http://www.rfc-editor.org/info/rfc7535</a>.
<span class="grey">Abley, et al. Informational [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and the IETF Trust's Legal
Provisions Relating to IETF Documents
(<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
<a href="#section-1">1</a>. Introduction ....................................................<a href="#page-3">3</a>
<a href="#section-2">2</a>. Design Overview .................................................<a href="#page-4">4</a>
<a href="#section-3">3</a>. AS112 Operations ................................................<a href="#page-5">5</a>
<a href="#section-3.1">3.1</a>. Extensions to Support DNAME Redirection ....................<a href="#page-5">5</a>
<a href="#section-3.2">3.2</a>. Redirection of Query Traffic to AS112 Servers ..............<a href="#page-5">5</a>
<a href="#section-4">4</a>. Continuity of AS112 Operations ..................................<a href="#page-6">6</a>
<a href="#section-5">5</a>. Candidate Zones for AS112 Redirection ...........................<a href="#page-6">6</a>
<a href="#section-6">6</a>. DNAME Deployment Considerations .................................<a href="#page-7">7</a>
<a href="#section-7">7</a>. IAB Statement Regarding This .ARPA Request ......................<a href="#page-8">8</a>
<a href="#section-8">8</a>. IANA Considerations .............................................<a href="#page-8">8</a>
<a href="#section-8.1">8.1</a>. Address Assignment .........................................<a href="#page-8">8</a>
<a href="#section-8.2">8.2</a>. Hosting of AS112.ARPA .....................................<a href="#page-10">10</a>
<a href="#section-8.3">8.3</a>. Delegation of AS112.ARPA ..................................<a href="#page-10">10</a>
<a href="#section-9">9</a>. Security Considerations ........................................<a href="#page-10">10</a>
<a href="#section-10">10</a>. References ....................................................<a href="#page-11">11</a>
<a href="#section-10.1">10.1</a>. Normative References .....................................<a href="#page-11">11</a>
<a href="#section-10.2">10.2</a>. Informative References ...................................<a href="#page-11">11</a>
<a href="#appendix-A">Appendix A</a>. Assessing Support for DNAME in the Real World .........<a href="#page-13">13</a>
<a href="#appendix-A.1">A.1</a>. Methodology ................................................<a href="#page-13">13</a>
<a href="#appendix-A.2">A.2</a>. Results ....................................................<a href="#page-15">15</a>
Acknowledgements ..................................................<a href="#page-16">16</a>
Authors' Addresses ................................................<a href="#page-16">16</a>
<span class="grey">Abley, et al. Informational [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
Many sites connected to the Internet make use of IPv4 addresses that
are not globally unique. Examples are the addresses designated in
[<a href="./rfc1918" title=""Address Allocation for Private Internets"">RFC1918</a>] for private use within individual sites.
Devices in such environments may occasionally originate Domain Name
System (DNS) queries (so-called "reverse lookups") corresponding to
those private-use addresses. Since the addresses concerned have only
local significance, it is good practice for site administrators to
ensure that such queries are answered locally. However, it is not
uncommon for such queries to follow the normal delegation path in the
public DNS instead of being answered within the site.
It is not possible for public DNS servers to give useful answers to
such queries. In addition, due to the wide deployment of private-use
addresses and the continuing growth of the Internet, the volume of
such queries is large and growing. The AS112 project aims to provide
a distributed sink for such queries in order to reduce the load on
the IN-ADDR.ARPA authoritative servers. The AS112 project is named
after the Autonomous System Number (ASN) that was assigned to it.
Prior to implementation of this technique, the AS112 project did not
accommodate the addition and removal of DNS zones elegantly. Since
additional zones of definitively local significance are known to
exist, this presents a problem. This document describes
modifications to the deployment and use of AS112 infrastructure that
will allow zones to be added and dropped much more easily.
The AS112 project is described in detail in [<a href="./rfc7534" title=""AS112 Nameserver Operations"">RFC7534</a>].
The AS112 nameservers (PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG, and
BLACKHOLE-2.IANA.ORG) are required to answer authoritatively for each
and every zone that is delegated to them. If a zone is delegated to
AS112 nameservers without those nameservers being configured ahead of
time to answer authoritatively for that zone, there is a detrimental
impact on clients following referrals for queries within that zone.
This misconfiguration is colloquially known as a "lame delegation".
AS112 nameserver operators are only loosely coordinated, and hence
adding support for a new zone (or, correspondingly, removing support
for a zone that is no longer delegated to the AS112 nameservers) is
difficult to accomplish with accuracy. Testing AS112 nameservers
remotely to see whether they are configured to answer authoritatively
for a particular zone is similarly challenging, since AS112 nodes are
distributed using anycast [<a href="./rfc4786" title=""Operation of Anycast Services"">RFC4786</a>].
<span class="grey">Abley, et al. Informational [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
This document defines a more flexible approach for sinking queries on
AS112 infrastructure that can be deployed alongside unmodified,
existing AS112 nodes. Instead of delegating additional zones
directly to AS112 nameservers, DNAME [<a href="./rfc6672" title=""DNAME Redirection in the DNS"">RFC6672</a>] redirection is used.
This approach has the advantage that query traffic for arbitrary
parts of the namespace can be directed to AS112 servers without those
servers having to be reconfigured every time a zone is added or
removed.
This approach makes it possible for any DNS zone administrator to
sink traffic relating to parts of the global DNS namespace under
their control to the AS112 infrastructure without coordination with
the operators of AS112 infrastructure.
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Design Overview</span>
A new zone, EMPTY.AS112.ARPA, is delegated to a single nameserver
BLACKHOLE.AS112.ARPA (IPv4 address 192.31.196.1, IPv6 address
2001:4:112::1).
The IPv4 address 192.31.196.1 has been selected from the prefix
assigned by the IANA such that the address is coverable by a single
IPv4 /24 prefix, and that no other address covered by that prefix is
in use. The IPv6 address 2001:4:112::1 has been similarly assigned
such that no other address within a covering /48 is in use. This
addressing plan accommodates the anycast distribution of the
BLACKHOLE.AS112.ARPA service using a single IPv4 service prefix and a
single IPv6 service prefix. See [<a href="./rfc4786" title=""Operation of Anycast Services"">RFC4786</a>] for more discussion of
anycast service distribution; see <a href="#section-8">Section 8</a> for the specific actions
completed by IANA per this document.
Some or all of the existing AS112 nodes should be extended to support
these new nameserver addresses and to host the EMPTY.AS112.ARPA zone.
See [<a href="./rfc7534" title=""AS112 Nameserver Operations"">RFC7534</a>] for revised guidance to AS112 server operators.
Each part of the DNS namespace for which it is desirable to sink
queries at AS112 nameservers should be redirected to the
EMPTY.AS112.ARPA zone using DNAME [<a href="./rfc6672" title=""DNAME Redirection in the DNS"">RFC6672</a>]. See <a href="#section-3.2">Section 3.2</a> for
guidance to zone administrators.
<span class="grey">Abley, et al. Informational [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. AS112 Operations</span>
<span class="h3"><a class="selflink" id="section-3.1" href="#section-3.1">3.1</a>. Extensions to Support DNAME Redirection</span>
Guidance to operators of AS112 nodes is extended to include
configuration of the 192.31.196.1 and 2001:4:112::1 addresses, and
the corresponding announcement of covering routes for those
addresses, and to host the EMPTY.AS112.ARPA zone.
IPv4-only AS112 nodes should only configure the 192.31.196.1
nameserver address; IPv6-only AS112 nodes should only configure the
2001:4:112::1 nameserver address.
It is only necessary for a single AS112 server operator to implement
these extensions for this mechanism to function as intended. It is
beneficial if many more than one AS112 server operator makes these
changes, however, since that provides for greater distribution and
capacity for the nameservers serving the EMPTY.AS112.ARPA zone. It
is not necessary for all AS112 server operators to make these changes
for the mechanism to be viable.
Detailed instructions for the implementation of these extensions are
included in [<a href="./rfc7534" title=""AS112 Nameserver Operations"">RFC7534</a>].
<span class="h3"><a class="selflink" id="section-3.2" href="#section-3.2">3.2</a>. Redirection of Query Traffic to AS112 Servers</span>
Once the EMPTY.AS112.ARPA zone has been deployed using the
nameservers described in <a href="#section-3.1">Section 3.1</a>, redirections may be installed
in the DNS namespace for queries that are intended to be answered by
the AS112 infrastructure.
For example, reverse queries corresponding to TEST-NET-1
(192.0.2.0/24) [<a href="./rfc5737" title=""IPv4 Address Blocks Reserved for Documentation"">RFC5737</a>] could be redirected to AS112 nameservers by
installing a DNAME resource record in the 192.IN-ADDR.ARPA zone, as
illustrated in Figure 1.
$ORIGIN 192.IN-ADDR.ARPA.
...
2.0 IN DNAME EMPTY.AS112.ARPA.
...
Figure 1
There is no practical limit to the number of redirections that can be
configured in this fashion. Redirection of a particular part of the
namespace to EMPTY.AS112.ARPA can be removed at any time, under the
control of the administrators of the corresponding part of the DNS
namespace. No changes to deployed AS112 nodes incorporating the
<span class="grey">Abley, et al. Informational [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
extensions described in this document are required to support
additional redirections. A list of possible candidates for AS112
redirection can be found in <a href="#section-5">Section 5</a>.
DNAME resource records deployed for this purpose can be signed with
DNSSEC [<a href="./rfc4033" title=""DNS Security Introduction and Requirements"">RFC4033</a>], providing a secure means of authenticating the
legitimacy of each redirection.
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Continuity of AS112 Operations</span>
Existing guidance to AS112 server operators to accept and respond to
queries directed at the PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG, and
BLACKHOLE-2.IANA.ORG nameservers should continue to be followed, and
no changes to the delegation of existing zones hosted on AS112
servers should occur. These measures are intended to provide
continuity of operations for zones currently delegated to AS112
servers and avoid any accidental client impact due to the changes
proposed in this document.
Once it has become empirically and quantitatively clear that the
EMPTY.AS112.ARPA zone is well hosted to the extent that it is thought
that the existing, unmodified AS112 servers host 10.IN-ADDR.ARPA, the
decision might be made to replace the delegation of those [<a href="./rfc1918" title=""Address Allocation for Private Internets"">RFC1918</a>]
zones with DNAME redirection. Once implemented, the
PRISONER.IANA.ORG, BLACKHOLE-1.IANA.ORG, and BLACKHOLE-2.IANA.ORG
nameservers could be retired. This document gives no such direction
to the IANA, however.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Candidate Zones for AS112 Redirection</span>
All zones listed in [<a href="./rfc6303" title=""Locally Served DNS Zones"">RFC6303</a>] are candidates for AS112 redirection.
Since no pre-provisioning is required on the part of AS112 operators
to facilitate sinking of any name in the DNS namespace by AS112
infrastructure, this mechanism supports AS112 redirection by any zone
owner in the DNS.
This document is simply concerned with provision of the AS112
redirection service and does not specify that any particular AS112
redirection be put in place.
<span class="grey">Abley, et al. Informational [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. DNAME Deployment Considerations</span>
DNAME was specified years after the original implementations of
[<a href="./rfc1035" title=""Domain names - implementation and specification"">RFC1035</a>], and hence universal deployment cannot be expected.
[<a href="./rfc6672" title=""DNAME Redirection in the DNS"">RFC6672</a>] specifies a fallback mechanism that makes use of
synthesised CNAME RRSets for this reason. The expectation that
design choices in the DNAME specification ought to mitigate any lack
of deployment is reviewed below. Experimental validation of those
expectations is included in <a href="#appendix-A">Appendix A</a>.
It is a fundamental design requirement of AS112 service that
responses be cached. We can safely declare DNAME support on the
authoritative server to be a prerequisite for DNAME redirection, but
the cases where individual elements in resolver chains do not support
DNAME processing deserve closer examination.
The expected behaviour when a DNAME response is supplied to a
resolver that does not support DNAME is that the accompanying,
synthesised CNAME will be accepted and cached. Re-query frequency
will be determined by the TTLs (Time to Live) returned by the
DNAME-responding authoritative servers.
Resolution of the CNAME target is straightforward and functions
exactly as the AS112 project has operated since it was deployed. The
negative caching [<a href="./rfc2308" title=""Negative Caching of DNS Queries (DNS NCACHE)"">RFC2308</a>] of the CNAME target follows the parameters
defined in the target zone, EMPTY.AS112.ARPA. This has the side
effects that all redirected names ultimately landing on an AS112 node
will be negatively cached with the same parameters, but this lack of
flexibility seems non-controversial; the effect of reducing the
negative cache TTL would be increased query volume on the AS112 node
operator concerned, and hence controls seem well aligned with
operation.
Validating resolvers (i.e., those requesting and processing DNSSEC
[<a href="./rfc4033" title=""DNS Security Introduction and Requirements"">RFC4033</a>] metadata) are required to implement DNAME and hence should
not make use of synthesised CNAME RRs. The lack of signature over a
received CNAME RR should hence not limit the ability to sign the
(DNAME) redirection point, and for those (DNAME) signatures to be
validated.
In the case where a recursive server implements DNAME but DNAME is
not implemented in a stub resolver, CNAME synthesis will again
provide a viable path.
DNAME support on AS112 nodes themselves is never required under this
proposal.
<span class="grey">Abley, et al. Informational [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>. IAB Statement Regarding This .ARPA Request</span>
With the publication of this document, the IAB approves of the
delegation of 'AS112' in the ARPA domain. Under [<a href="./rfc3172" title=""Management Guidelines & Operational Requirements for the Address and Routing Parameter Area Domain ("">RFC3172</a>], the IAB
has requested that IANA delegate and provision "AS112.ARPA" as
specified in this specification. However, the IAB does not take any
architectural or technical position about this specification.
<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>. IANA Considerations</span>
<span class="h3"><a class="selflink" id="section-8.1" href="#section-8.1">8.1</a>. Address Assignment</span>
Per this document, IANA has assigned IPv4 and IPv6 number resources
in conformance with <a href="./rfc2860#section-4">Section 4 of [RFC2860]</a>.
The IANA has assigned one IPv4 /24 netblock and registered its use in
the "IANA IPv4 Special-Purpose Address Registry" [<a href="./rfc6890" title=""Special-Purpose IP Address Registries"">RFC6890</a>] as
follows:
+----------------------+-----------------+
| Name | Value |
+----------------------+-----------------+
| Address Block | 192.31.196.0/24 |
| | |
| Name | AS112-v4 |
| | |
| RFC | <a href="./rfc7535">RFC 7535</a> |
| | |
| Allocation Date | 2014-12 |
| | |
| Termination Date | N/A |
| | |
| Source | True |
| | |
| Destination | True |
| | |
| Forwardable | True |
| | |
| Global | True |
| | |
| Reserved-by-Protocol | False |
+----------------------+-----------------+
<span class="grey">Abley, et al. Informational [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
IANA has assigned one IPv6 /48 netblock and registered its use in the
"IANA IPv6 Special-Purpose Address Registry" [<a href="./rfc6890" title=""Special-Purpose IP Address Registries"">RFC6890</a>] as follows:
+----------------------+-----------------+
| Name | Value |
+----------------------+-----------------+
| Address Block | 2001:4:112::/48 |
| | |
| Name | AS112-v6 |
| | |
| RFC | <a href="./rfc7535">RFC 7535</a> |
| | |
| Allocation Date | 2014-12 |
| | |
| Termination Date | N/A |
| | |
| Source | True |
| | |
| Destination | True |
| | |
| Forwardable | True |
| | |
| Global | True |
| | |
| Reserved-by-Protocol | False |
+----------------------+-----------------+
<span class="grey">Abley, et al. Informational [Page 9]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-10" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
<span class="h3"><a class="selflink" id="section-8.2" href="#section-8.2">8.2</a>. Hosting of AS112.ARPA</span>
The IANA hosts and signs the zone AS112.ARPA using nameservers and
DNSSEC signing infrastructure of their choosing, as shown in
Figure 2. SOA RDATA may be adjusted by the IANA to suit their
operational requirements.
$ORIGIN AS112.ARPA.
$TTL 3600
@ IN SOA BLACKHOLE.AS112.ARPA. NOC.DNS.ICANN.ORG. (
1 ; serial
10800 ; refresh
3600 ; retry
1209600 ; expire
3600 ) ; negative cache TTL
NS A.IANA-SERVERS.NET.
NS B.IANA-SERVERS.NET.
NS C.IANA-SERVERS.NET.
BLACKHOLE A 192.31.196.1
AAAA 2001:4:112::1
HOSTNAME NS BLACKHOLE
EMPTY NS BLACKHOLE
Figure 2
<span class="h3"><a class="selflink" id="section-8.3" href="#section-8.3">8.3</a>. Delegation of AS112.ARPA</span>
The IANA has arranged delegation from the ARPA zone according to
normal IANA procedure for ARPA zone management, to the nameservers
used in carrying out the direction in <a href="#section-8.2">Section 8.2</a>. The whois contact
information for the new record is specified by the IAB under
[<a href="./rfc3172" title=""Management Guidelines & Operational Requirements for the Address and Routing Parameter Area Domain ("">RFC3172</a>].
<span class="h2"><a class="selflink" id="section-9" href="#section-9">9</a>. Security Considerations</span>
This document presents no known additional security concerns to the
Internet.
For security considerations relating to AS112 service in general, see
[<a href="./rfc7534" title=""AS112 Nameserver Operations"">RFC7534</a>].
<span class="grey">Abley, et al. Informational [Page 10]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-11" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
<span class="h2"><a class="selflink" id="section-10" href="#section-10">10</a>. References</span>
<span class="h3"><a class="selflink" id="section-10.1" href="#section-10.1">10.1</a>. Normative References</span>
[<a id="ref-RFC1035">RFC1035</a>] Mockapetris, P., "Domain names - implementation and
specification", STD 13, <a href="./rfc1035">RFC 1035</a>, DOI 10.17487/RFC1035,
November 1987, <<a href="http://www.rfc-editor.org/info/rfc1035">http://www.rfc-editor.org/info/rfc1035</a>>.
[<a id="ref-RFC2308">RFC2308</a>] Andrews, M., "Negative Caching of DNS Queries (DNS
NCACHE)", <a href="./rfc2308">RFC 2308</a>, DOI 10.17487/RFC2308, March 1998,
<<a href="http://www.rfc-editor.org/info/rfc2308">http://www.rfc-editor.org/info/rfc2308</a>>.
[<a id="ref-RFC6672">RFC6672</a>] Rose, S. and W. Wijngaards, "DNAME Redirection in the
DNS", <a href="./rfc6672">RFC 6672</a>, DOI 10.17487/RFC6672, June 2012,
<<a href="http://www.rfc-editor.org/info/rfc6672">http://www.rfc-editor.org/info/rfc6672</a>>.
[<a id="ref-RFC7534">RFC7534</a>] Abley, J. and W. Sotomayor, "AS112 Nameserver Operations",
<a href="./rfc7534">RFC 7534</a>, DOI 10.17487/RFC7534, May 2015,
<<a href="http://www.rfc-editor.org/info/rfc7534">http://www.rfc-editor.org/info/rfc7534</a>>.
<span class="h3"><a class="selflink" id="section-10.2" href="#section-10.2">10.2</a>. Informative References</span>
[<a id="ref-RFC1918">RFC1918</a>] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.,
and E. Lear, "Address Allocation for Private Internets",
<a href="https://www.rfc-editor.org/bcp/bcp5">BCP 5</a>, <a href="./rfc1918">RFC 1918</a>, DOI 10.17487/RFC1918, February 1996,
<<a href="http://www.rfc-editor.org/info/rfc1918">http://www.rfc-editor.org/info/rfc1918</a>>.
[<a id="ref-RFC2860">RFC2860</a>] Carpenter, B., Baker, F., and M. Roberts, "Memorandum of
Understanding Concerning the Technical Work of the
Internet Assigned Numbers Authority", <a href="./rfc2860">RFC 2860</a>,
DOI 10.17487/RFC2860, June 2000,
<<a href="http://www.rfc-editor.org/info/rfc2860">http://www.rfc-editor.org/info/rfc2860</a>>.
[<a id="ref-RFC3172">RFC3172</a>] Huston, G., Ed., "Management Guidelines & Operational
Requirements for the Address and Routing Parameter Area
Domain ("arpa")", <a href="https://www.rfc-editor.org/bcp/bcp52">BCP 52</a>, <a href="./rfc3172">RFC 3172</a>, DOI 10.17487/RFC3172,
September 2001, <<a href="http://www.rfc-editor.org/info/rfc3172">http://www.rfc-editor.org/info/rfc3172</a>>.
[<a id="ref-RFC4033">RFC4033</a>] Arends, R., Austein, R., Larson, M., Massey, D., and S.
Rose, "DNS Security Introduction and Requirements",
<a href="./rfc4033">RFC 4033</a>, DOI 10.17487/RFC4033, March 2005,
<<a href="http://www.rfc-editor.org/info/rfc4033">http://www.rfc-editor.org/info/rfc4033</a>>.
[<a id="ref-RFC4786">RFC4786</a>] Abley, J. and K. Lindqvist, "Operation of Anycast
Services", <a href="https://www.rfc-editor.org/bcp/bcp126">BCP 126</a>, <a href="./rfc4786">RFC 4786</a>, DOI 10.17487/RFC4786,
December 2006, <<a href="http://www.rfc-editor.org/info/rfc4786">http://www.rfc-editor.org/info/rfc4786</a>>.
<span class="grey">Abley, et al. Informational [Page 11]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-12" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
[<a id="ref-RFC5737">RFC5737</a>] Arkko, J., Cotton, M., and L. Vegoda, "IPv4 Address Blocks
Reserved for Documentation", <a href="./rfc5737">RFC 5737</a>,
DOI 10.17487/RFC5737, January 2010,
<<a href="http://www.rfc-editor.org/info/rfc5737">http://www.rfc-editor.org/info/rfc5737</a>>.
[<a id="ref-RFC6303">RFC6303</a>] Andrews, M., "Locally Served DNS Zones", <a href="https://www.rfc-editor.org/bcp/bcp163">BCP 163</a>,
<a href="./rfc6303">RFC 6303</a>, DOI 10.17487/RFC6303, July 2011,
<<a href="http://www.rfc-editor.org/info/rfc6303">http://www.rfc-editor.org/info/rfc6303</a>>.
[<a id="ref-RFC6890">RFC6890</a>] Cotton, M., Vegoda, L., Bonica, R., Ed., and B. Haberman,
"Special-Purpose IP Address Registries", <a href="https://www.rfc-editor.org/bcp/bcp153">BCP 153</a>,
<a href="./rfc6890">RFC 6890</a>, DOI 10.17487/RFC6890, April 2013,
<<a href="http://www.rfc-editor.org/info/rfc6890">http://www.rfc-editor.org/info/rfc6890</a>>.
<span class="grey">Abley, et al. Informational [Page 12]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-13" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
<span class="h2"><a class="selflink" id="appendix-A" href="#appendix-A">Appendix A</a>. Assessing Support for DNAME in the Real World</span>
To measure the extent to which the DNAME construct is supported in
the Internet, we have used an experimental technique to test the DNS
resolvers used by end hosts and derive from the test a measurement of
DNAME support within the Internet.
<span class="h3"><a class="selflink" id="appendix-A.1" href="#appendix-A.1">A.1</a>. Methodology</span>
The test was conducted by loading a user's browser with four URLs
to retrieve. The first three comprise the test setup, while the
final URL communicates the result to the experiment controller.
The URLs are:
A http://a.<unique_string>.dname.example.com/1x1.png?
a.<unique_string>.dname
B <a href="http://b.dname.example.com/1x1.png?">http://b.dname.example.com/1x1.png?</a>
b.<unique_string>.dname
C http://c.<unique_string>.target.example.net/1x1.png?
c.<unique_string>.target
D <a href="http://results.recorder.example.net/1x1.png?">http://results.recorder.example.net/1x1.png?</a>
results.<unique_string>?za=<a_result>&zb=<b_result>&zc=<c_result>
The A URL is designed to test the end user's capability to resolve a
name that has never been seen before, so that the resolution of this
domain name will reliably result in a query at the authoritative
nameserver. This is intended to test the use of domain names where
there is a dynamic component that also uses the DNAME construct.
The B URL is deliberately designed to be cached by caching resolvers
that are used in the process of resolving the domain name.
The C URL is a control URL. This is a unique URL, similar to A, but
does not refer to a DNAME structure.
The D URL uses a static cacheable domain name.
The <unique_string> value is common to the four URLs used in each
individual instance of this test but varies from test to test. The
result is that each end user is presented with a unique string.
<span class="grey">Abley, et al. Informational [Page 13]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-14" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
The contents of the EXAMPLE.COM, TARGET.EXAMPLE.NET, and
RECORDER.EXAMPLE.NET zones are shown in Figure 3.
$ORIGIN EXAMPLE.COM.
...
DNAME. IN DNAME TARGET.EXAMPLE.NET.
...
$ORIGIN TARGET.EXAMPLE.NET.
...
B IN A 192.0.2.0
* IN A 192.0.2.0
...
$ORIGIN RECORDER.EXAMPLE.NET.
...
RESULTS IN A 192.0.2.0
...
Figure 3
The first three URLs (A, B, and C) are loaded as tasks into the
user's browser upon execution of the test's script. The script
starts a timer with each of these URLs to measure the elapsed time to
fetch the URL. The script then waits for the three fetches to
complete, or 10 seconds, whichever occurs first. The script then
loads the results of the three timers into the GET arguments of the
D URL and performs a fetch to pass these results back to the
experiment's server.
Logs on the web server reached at RESULTS.RECORDER.EXAMPLE.NET will
include entries of the form shown in Figure 4. If any of the URLs
fail to load within 10 seconds, the D URL will report the failure as
a "null" timer value.
GET /1x1.png?results.<unique_string>?za=1822&zb=1674&zc=1582
GET /1x1.png?results.<unique_string>?za=null&zb=null&zc=161
Figure 4
The script has been encoded in Adobe Flash with a simple image in the
form of an online advertisement. An online advertisement network has
been used to distribute the script. The script is invoked when the
advertisement is presented in the end user's browser or application
and does not require the user to click on the supplied image in any
way. The advertisement placement parameters were set to the broadest
possible scope to sample users from across the entire Internet.
<span class="grey">Abley, et al. Informational [Page 14]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-15" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
<span class="h3"><a class="selflink" id="appendix-A.2" href="#appendix-A.2">A.2</a>. Results</span>
The test was loaded into an advertisement distributed on 2013-10-10
and 2013-10-11.
+--------------------+---------+------------+
| | Count | Percentage |
+--------------------+---------+------------+
| Recorded Results: | 338,478 | |
| | | |
| A or B Loaded: | 331,896 | 98.1% |
| | | |
| A Fail and B Fail: | 6,492 | 1.9% |
| | | |
| A Fail and B Load: | 4,249 | 1.3% |
| | | |
| A Load and B Fail: | 1,624 | 0.5% |
| | | |
| C Fail: | 9,355 | 2.8% |
+--------------------+---------+------------+
Table 1
These results indicate that at most 1.9% of tested clients use DNS
resolvers that fail to resolve a domain name that contains a DNAME
redirection. However, the failure rate of slightly lower than 3% for
the control URL indicates that the failure rate for the DNAME
construct lies within the bounds of error within the experimental
framework. We conclude that there is no evidence of a consistent
failure on the part of deployed DNS resolvers to correctly resolve a
DNAME construct.
This experiment was conducted by Geoff Huston and George Michaelson.
<span class="grey">Abley, et al. Informational [Page 15]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-16" ></span>
<span class="grey"><a href="./rfc7535">RFC 7535</a> AS112 Redirection Using DNAME May 2015</span>
Acknowledgements
The authors acknowledge the valuable contributions of Bob Harold and
other participants in the DNSOP working group in the preparation of
this document.
Authors' Addresses
Joe Abley
Dyn, Inc.
103-186 Albert Street
London, ON N6A 1M1
Canada
Phone: +1 519 670 9327
EMail: jabley@dyn.com
Brian Dickson
Twitter, Inc.
EMail: bdickson@twitter.com
Warren Kumari
Google
1600 Amphitheatre Parkway
Mountain View, CA 94043
United States
EMail: warren@kumari.net
George Michaelson
APNIC
EMail: ggm@apnic.net
Abley, et al. Informational [Page 16]
</pre>
|
