<html><head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000"><br>
<br>
<blockquote style="border: 0px none;"
cite="mid:14F8423C-8803-467F-8AF6-0DCCCC777361@conundrum.com"
type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="matt@conundrum.com" photoname="Matthew Pounsett"
src="cid:part1.07060101.08050302@redbarn.org"
name="compose-unknown-contact.jpg" height="25px" width="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:matt@conundrum.com"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Matthew Pounsett</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">Wednesday,
October 22, 2014 10:29 AM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div><!----><br>The paper also
appears to make the assumption that eliminating existing resolvers is a
thing we can do. Open recursive resolvers won’t go away simply because
we, as an industry, decide to stop setting up new ones. There’s no way
to prevent them from sending queries (or to selectively block them), and
they are almost by definition unmanaged, so we cannot expect they will
be taken offline by their respective administrators.</div></div>
</blockquote>
<br>
well, yes, and the fact that the vast majority current stub resolvers
have at least one layer of NAT between them and the internet core (where
the authority servers) are, as well as IPS and firewall, means that
responses to RD=0 queries usually won't get in, and RD=0 queries will
even more often not go out. (UDP is evil, didn't you know.) we can move
the stubs to an HTTPS transport if we can agree on a RESTful query API
and either JSON or XML schema for responses, but it is not in our power
to make UDP, especially fragmented UDP as in EDNS, work in the last
mile.<br>
<br>
given that this came from ICIR, they ought to have known that. so it's
going to be an interesting debate, methinks.<br>
<br>
<div class="moz-signature">-- <br>Paul Vixie<br>
</div>
</body></html>