1. DNS Proxy Bypass by Recursive DNS Discovery and LOCAL.ARPA draft-ietf-dns-recursive-discovery Ray Bellis IETF76 DNSOP WG Hiroshima, 11 th November 2009

2. The Fundamental Problem… ISP DNS DNS settings learnt via DHCP or PPP/IPCP DHCP DISCOVER DHCP OFFER DNS Servers (6) = 192.168.1.1 FAIL Please try again – the DNS proxy on 192.168.1.1 doesnt work properly (see RFC5625)

3. The Chicken and Egg Problem… ISP DNS DNS settings learnt via DHCP or PPP/IPCP DHCP DISCOVER DHCP OFFER DNS Servers (6) = 192.168.1.1 FAIL Still not right – you dont know the real DNS servers because the LAN came up before the WAN. Didnt you fix that proxy yet?

4. The Configuration Problem… ISP DNS End-user configures DNS settings DHCP DISCOVER DHCP OFFER DNS Servers (6) = 192.168.1.1 FAIL Uh-oh - someone forgot to implement TR124 requirement LAN.DNS.2. End-user supplied DNS settings SHOULD be in the DHCP OFFER. BTW – your proxy still doesnt work properly!

5. The Proposed Solution… ISP DNS Let the DHCP stuff happen Use the DNS proxy initially … to ask the recursive DNS server for a list of real DNS servers Then use those instead! IN A? domain.local.arpa. IN A 192.0.2.1

6. The Proposed Solution… ISP DNS Let the DHCP stuff happen Use the DNS proxy initially … to ask the recursive DNS server for a list of real DNS servers Then use those instead! IN A? domain.local.arpa. IN A 192.0.2.1

7. A little more detail Why were proposing this: –Because DNS proxies dont work! to get DNSSEC through to get TCP queries through The draft reserves local.arpa. –for use within a networks administrative boundaries –and domain.local.arpa for this application Version -02 will have NXDOMAIN redirect detection –probably via nxdomain.local.arpa. –if nxdomain.local.arpa == domain.local.arpa then ignore the results, your ISP is trapping NXDOMAIN

8. Things weve thrown out already Anycast –If youre going to use an Anycast address to discover DNS, you might as well use that address for all DNS!.local –Too much baggage

9. Things were still figuring out! Does the bootstrap query need additional protection, and if so, how? –DNSSEC no good, proxies break it! –A random nonce prefix? –Something else? Interaction with DNSSEC-signed.arpa –If IANA has an NSEC[3] record that says local.arpa doesnt exist, then the locally-supplied copy is bogus

10. Any Questions?