<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">This issue comes up from time to time… <div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 1.03.2016 г., at 3:41, Mark Andrews <<a href="mailto:marka@isc.org" class="">marka@isc.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">In message <</span><a href="mailto:56D4E7A8.7060005@redbarn.org" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">56D4E7A8.7060005@redbarn.org</a><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">>, Paul Vixie writes:</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""><br class="">Mark Andrews wrote:<br class=""><blockquote type="cite" class="">In message<<a href="mailto:56D47005.20206@redbarn.org" class="">56D47005.20206@redbarn.org</a>>, Paul Vixie writes:<br class=""><blockquote type="cite" class="">it's never been practical for a registry to check the NS RR's of its<br class="">delegated child apexes. i think that both registrars and registrants<br class="">should do so, and would do so if there were better tooling available.<br class=""></blockquote><br class="">For each NS registered in whois / parent zone<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>dig NS +norec zone +short @NS | tr '[A-Z]' '[a-z]' | sort<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>if (NS set does not match)<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span><span class="Apple-tab-span" style="white-space: pre;"> </span>flag for followup where followup involved re-testing<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span><span class="Apple-tab-span" style="white-space: pre;"> </span><span class="Apple-tab-span" style="white-space: pre;"> </span>after X hours then sending email to contacts<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span><span class="Apple-tab-span" style="white-space: pre;"> </span><span class="Apple-tab-span" style="white-space: pre;"> </span>for zone.<br class=""><br class="">This is not rocket science. The tools have existed to do this for<br class="">decades now.<br class=""></blockquote><br class="">mark, we aren't working in the same company now, so let me say something<span class="Apple-converted-space"> </span><br class="">that's been on my mind for quite a few years now.<br class=""><br class="">you are smarter than almost everybody, and almost everything is easy for<span class="Apple-converted-space"> </span><br class="">you. please stop pretending that it isn't so, or that you don't know it.<br class=""><br class="">it god damned is god damned rocket god damned science. stop pretending<span class="Apple-converted-space"> </span><br class="">that these tools are adequate for any significant percentage of<span class="Apple-converted-space"> </span><br class="">registrars or registrants, because it's not, and i think you know it.<br class=""></blockquote><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">This boils down to checking two list of names to see if they are</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">the same. We have tools that will give you the lists. I could ask</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">a 12 year old if two list of names are the same and get the correct</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">answer.</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""></div></blockquote><div><br class=""></div><div>Paul is correct here. A significant percentage of those who are Registrants or Registrars in this ecosystem have no idea how to do these checks. What is worse, most of those also do not know why they need to care about this — even if the Registry finds out there are differences and passes down this information to Registrar/Registrant. Anything that slows the cash flow is bad for the business… this is the model.</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><blockquote type="cite" class="">As for whether the Registry / Registrar performs the actual looks<br class="">I don't care. The Registry is clearly responsible for ensuring<br class="">that they get performed as they are responsible for the overall<br class="">operations of the parent zone.<br class=""></blockquote><br class="">no, in two ways.<br class=""><br class="">if you're .DE and you have 50M delegations you're not going to be<span class="Apple-converted-space"> </span><br class="">checking them. for .COM at 100M delegations it's worse.<br class=""></blockquote><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">These are all checkable. It doesn't take massive resources to make</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">the checks.</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""></div></blockquote><div><br class=""></div><div>This is true. Eventually, you end up with millions of records “something is messed up with this domain”. Then what is an Registry supposed to do?</div><br class=""><blockquote type="cite" class=""><div class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">also, ICANN does not allow the registry to take action if it knows that<span class="Apple-converted-space"> </span><br class="">a delegation is bad. no action, including not notifying registrars or<span class="Apple-converted-space"> </span><br class="">registrants, and especially not including changing or suspending the<span class="Apple-converted-space"> </span><br class="">delegation.<br class=""></blockquote><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Which just means ICANN stuffed up.</span></div></blockquote><br class=""></div><div>There is no doubt about this. ICANN started this when they introduced Registrars in the sake of competition. They made things worse, when Registrars were made the focal point (of power) and Registries were left as appendixes that are responsible for the database. While according to RFC1951 Registrars don’t even exist and Registries are solely responsible for the proper delegation. And so it was… years ago, at lest with some ccTLDs. (one can argue this was because they were subject to less pressure to be “more like .COM” back then)</div><div><br class=""></div><div>Even if the Registrant and Registrar can make their own checks, the ultimate place for consistency checks like this is at the Registry.</div><div><br class=""></div><div>The WHOIS mess is again because of ICANN/Registrars — creating “inventions” such as “privacy guard”. </div><div><br class=""></div><div>You can’t put the cart before the horse and expect it will run just as before. DNS has great resiliency and still works, even after all the abuse. I guess we just need to wait until things break - DNSSEC wasn’t good enough for the task :-)</div><div><br class=""></div><div>Daniel</div><div><br class=""></div><div><br class=""></div></div></body></html>