dns-violations / dnsflagday

DNS flag day
https://dnsflagday.net/
147 stars 40 forks source link

'what is EDNS' #38

Closed Habbie closed 5 years ago

Habbie commented 5 years ago

From an IRC discussion:

<A> Yesterday in some channel someone read https://dnsflagday.net/ and then asked what EDNS was. Should the website be more explicit?
<A> It has a link to 6891 section 7 at the end of a paragraph. And doesn't stop people from Googling. But still.
<Habbie> it's a very hard problem
<Habbie> that i'm not good at
<B> A: People will always take the shortest path.
<B> There's no mention of what EDNS is
<B> It should be right at the top
<B> Some coworker paste dit on Slack and was like "whats EDNS"

I think they have a point. Noting this here because I do not have time to write good text right now.

vrisk commented 5 years ago

There is a pretty good wikipedia on this: https://en.wikipedia.org/wiki/Extension_mechanisms_for_DNS

I think the key things to mention are: EDNS0 was specified years ago (1999) to add additional information to DNS messages. It is designed to be backward-compatible, so systems that don't support EDNS should continue to work. Some newer features, including DNSSEC and DNS Cookies, rely on EDNS. EDNS is sometimes confused with client-subnet-identifier, which is another application that uses EDNS. Client Subnet Identifier is sometimes abbreviated as 'ECS' - EDNS Client Subnet Identifier.

twicinski commented 5 years ago

"EDNS is a method created for extending the DNS Protocol, first published in 1999. A more detailed explanation, and its history can be found at https://en.wikipedia.org/wiki/Extension_mechanisms_for_DNS"

Pointing someone to a wikipedia article isn't enough. There should be an explanation "why is it important ?" Just because its been there since 1999 is not good enough, we know why it is important, but we failed if we can't communicate that simply.

pspacek commented 5 years ago

Explanatory text is more than welcome!

pspacek commented 5 years ago

Funnily enough I just received response from our copywriter and he thinks more information beyond simple link is redundant and will distract attention unnecessarily.

After all we are not forcing anyone to actually implement EDNS. The ask is "either implement it or return FORMERR as mandated by standard", which is no change since 1986.

ltwagnon commented 5 years ago

overview video of DNS Flag Day here: https://youtu.be/kwz45vYo-bE

Also gives a brief explanation of what EDNS is.

iddq commented 5 years ago

Hello guys,

what is that EDNS(1) you mentioned on the web page? Far as I know EDNS version 1 does not exist.

mnordhoff commented 5 years ago

@iddq That's correct. EDNS version 1 doesn't exist, but the EDNS standard describes how servers are supposed to handle unknown versions, and they often do it incorrectly.

pspacek commented 5 years ago

Exactly. The whole point of DNS flag day is to get to the point where EDNS (E = extension) can actually be used for further DNS protocol development.

iddq commented 5 years ago

"The following versions of DNS resolvers will not accommodate EDNS non-compliant responses"

Can you please explain what is that case when the response is not EDNS compliant?

pspacek commented 5 years ago

It is described here: https://dnsflagday.net/#im-a-dns-expert

Please let us know if there is anything unclear.

pspacek commented 5 years ago

Closing, it's not relevant anymore.