4 ms·
From section 11 of the draft: "To protect users' privacy, Recursive Resolvers are strongly encouraged to conceal part of the IP address of the user by truncatin
by GTP 10y ago
From section 11 of the draft:
"To protect users' privacy, Recursive Resolvers are strongly encouraged to conceal part of the IP address of the user by truncating IPv4 addresses to 24 bits. 56 bits are recommended for IPv6, based on [RFC6177]. ISPs should have more detailed knowledge of their own networks. That is, they might know that all 24-bit prefixes in a /20 are in the same area. In those cases, for optimal cache utilization and improved privacy, the ISP's Recursive Resolver SHOULD truncate IP addresses in this /20 to just 20 bits, instead of 24 as recommended above. Users who wish their full IP address to be hidden need to configure their client software, if possible, to include an ECS option specifying the wildcard address (i.e. SOURCE PREFIX-LENGTH of 0). As described in previous sections, this option will be forwarded across all the Recursive Resolvers supporting ECS, which MUST NOT modify it to include the network address of the client".
So it's suggested that DNS providers and ISPs use only a portion of the IP address but they aren't forced to do so (and how could they be forced anyway?). Then it says that users that don't want to send their IP address should configure their software accordingly, but again only "if possible" so again no guarantee that it would be possible.
Now a question: I don't see why a DNS packet would contain the client's IP address and a (I admit too quick) look at the draft didn't provided any information. Could you please elaborate on the supposed advantages of this practice?
- MichaelGG 10y agoIt's to return local DNS records so you resolve to a nearby server.
- GTP 10y agoI have one more question. DNS requests are carried by the IP protocol, so when someone makes a DNS interrogation the DNS server already gets the client's full IP address in the IP header. Isn't redundant to place (a portion of) the IP address in a DNS packet? Or maybe for some reason the DNS server is quicker to get this information from the DNS packet rather than from the IP packet's header?
- MichaelGG 10y agoI use e.g. 8.8.8.8 as my DNS server. When that server needs to request a record for me, the other servers it connects to will only see 8.8.8.8. With this extension, the 8. server will embed my subnet into the request and allow upstream servers to see part of my IP.