<html><head></head><body>Shane, that change is even easier, but even less likely, than wide scale blocking of ANY.<br>
<br>
The proponents of blocking ANY need to do some homework. There's a reason that DNS RRL was created.<br>
<br>
Blocking ANY is silly.<br>
<br>
Vixie<br><br><div class="gmail_quote">On September 3, 2016 9:30:59 AM PDT, Shane Kerr <shane@time-travellers.org> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Paul,<br /><br />At 2016-09-02 20:15:05 -0700<br />Paul Vixie <paul@redbarn.org> wrote:<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> % dig @ord.sns-pb.isc.org <a href="http://vixie.sf.ca.us">vixie.sf.ca.us</a> soa +dnssec<br /> ...<br /> ;; Query time: 56 msec<br /> ;; SERVER: 2001:500:71::30#53(2001:500:71::30)<br /> ;; WHEN: Sat Sep 03 03:13:19 UTC 2016<br /> ;; MSG SIZE rcvd: 2045<br /> <br /> (hint: this is sarcasm. banning ANY is silly.)<br /></blockquote><br />It almost seems like a bug that BIND is returning all that extra data<br />that you didn't ask for in your query.<br /><br />There's no need for anything in the authority or additional section in<br />that answer. You can encourage BIND to give you a shorter answer:<br /><br />$ dig @ord.sns-pb.isc.org <a href="http://vixie.sf.ca.us">vixie.sf.ca.us</a> soa +dnssec +bufsize=512<br />...<br />;; Query time: 257
msec<br />;; SERVER: <a href="http://199.6.0.30">199.6.0.30</a>#53(<a href="http://199.6.0.30">199.6.0.30</a>)<br />;; WHEN: Sun Sep 04 00:23:12 CST 2016<br />;; MSG SIZE rcvd: 278<br /><br />Setting "minimal-responses" in BIND 9's named.conf should fix this.<br /><br />Cheers,<br /><br />--<br />Shane <br /></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>