Error reporting

[peterthomassen]

I was thinking about ways for the NOTIFY receiver (i.e., parent) to communicate an error condition to the DNS operator.

Perhaps good ideas:

• [ ] Allow the DNS operator to add a record in the NOTIFY message, indicating an error reporting channel (e.g. SRV record with some host/port, or a TXT record with an email address, or something different. It would need to be standardized; but the basic idea probably is clear.)
• [ ] Send an EDNS0 Report-Channel option in the NOTIFY message (RFC 9567). The parent then can send a reporting query to the DNS operator's monitoring agent later if needed.

In both cases, to prevent reflection attacks, the report target's last labels could be required to be one of the NS hostnames (or something like that).

Probably bad ideas:

• [ ] Act immediately and delay the NOTIFY response until either success or an error condition occurred, and communicate the result in the response. The problem is that this creates pressure on the receiver to come to a conclusion within seconds, which may not be acceptable given that DS provisioning may take longer (including bootstrapping fetches, acceptance checks etc.). Related: #11
• [ ] Allow the DNS operator to publish a reporting endpoint under their nameserver, e.g. _notify-report.$child_signal.ns1.provider.net, or similar (need not be child-specific). The problem here is that there may be multiple NS by different operators, and it's not clear which of the published endpoints is the one related to the NOTIFY that was sent.

[peterthomassen]

Some indicated that "EDNS0 Report-Channel option in the NOTIFY message (RFC 9567)" (option 2 above) is preferable, as it's already standardized.

[jrlevine]

That makes sense. There are a few loose ends like whether the notify needs to have the EDNS0 option 18. It's authors will likely be in Kigali so we can ask them if they see issues with using it.

⁣Sent from phone with tiny keyboard, please excuse typos.​

On Jun 2, 2024, 15:49, at 15:49, Peter Thomassen @.***> wrote:

Some indicated that "EDNS0 Report-Channel option in the NOTIFY message (RFC 9567)" (option 2 above) is preferable, as it's already standardized.

-- Reply to this email directly or view it on GitHub: https://github.com/peterthomassen/draft-ietf-dnsop-generalized-notify/issues/24#issuecomment-2143860992 You are receiving this because you are subscribed to this thread.

Message ID: @.***>