[dns-operations] Looping wildcard CNAMEs can be an obstacle for DANE, (googledomains.com-hosted example)

[Petr Špaček]

On 16.4.2018 20:04, Viktor Dukhovni wrote:
>> On Apr 16, 2018, at 1:36 PM, John Levine <johnl at taugh.com> wrote:
>>
>> 1.1.1.1, 8.8.8.8, and 9.9.9.9 all return SERVFAIL
>>
>> 1.1.1.1 helpfully puts the looping CNAME in the answer section.
> 
> This sadly does not help a DANE client that needs to avoid downgrade
> attacks, because there's no way to know whether ServFail is because
> the response is "bogus" or because of the loop.  I'd be reluctant,
> to assume that data in the answer section implies the latter and
> not the former...

Speaking with my Knot Resolver manager hat on, I'm not willing to absorb
even higher cost (in terms of code complexity) to handle *even more*
broken domains.

The DNS history already shown us that breakage is not going to be fixed
if nobody feels pain, so exposing breakage in DNS to upper layers is the
only way to get things fixed.

This is consistent with our coordinated effort to stop workarounding
EDNS incompatibilities, details can be found here:

https://en.blog.nic.cz/2018/03/14/together-for-better-stability-speed-and-further-extensibility-of-the-dns-ecosystem/

-- 
Petr Špaček  @  CZ.NIC