6 ms·
(All) DNS Resource Records
- nly 5y agoThe DNS zone text file format is the most horrific, loosely specified thing to parse I did some experiments a number of years ago and found almost none of the DNS server software out there parses zone files the same, particularly surrounding parenthesis, line wrapping, and unknown record types.
- Anthony-G 5y agoI discovered this when I wrote a Vim function to automatically update the serial of the SOA record (can be easy to forget if in a hurry) whenever I saved a zone file. It worked fine for my own zone files, similar to: $ORIGIN example.com. @ IN SOA ns.example.info. hostmaster.example.info. ( 2021031306 ; Serial 12h ; Refresh (secondary server accepts zone update notifications) 2h ; Retry (how long secondary should wait before retrying) 14d ; Expire (how long records should be considered valid by secondary) 1h ; NXDOMAIN (Nonexistent domain) TTL – previously the Minimum TTL ) I considered publishing my Vim script but figured I should improve it so that it would work for all valid zone files. Then I read the Master Files section of RFC 1035¹ and realised that this would be more difficult than I had assumed. I’m also not particularly proficient with Vimscript so I never published it. Since then, I’ve converted my zones to be dynamic so I don’t need to worry about formatting or updating the serial. Out of interest, which name server had the most robust parsing of zone files? 1. https://tools.ietf.org/html/rfc1035#section-5 https://tools.ietf.org/html/rfc1035#section-5
- nly 5y agoRobustness is irrelevant, because whenever there is a hole in the various specs people ask "What is BIND doing?"
- janci 5y agoIt's sad SRV records are not used for the web for running http(s) services on different ports (instead of virtual hosts and SNI).
- cpach 5y agoWhy is that sad?
- Zash 5y agoAnd because SRV records are not used for the web, they can't be used at all, as some routers or something doesn't support them and instead discards them. (~10% of users according to the admin of yaxim.org) And then along comes https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-https/ https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-https... defining a "SRV2", SVCB and also its identical twin the HTTPS RR (same format, different RR number). I have a fear that those routers will end up supporting the HTTPS RR but not SVCB...
- tialaramex 5y agoOutside of businesses it doesn't matter at all. You'll use DoH to escape local garbage. A variation on Happy Eyeballs will automatically try to do QUIC unless that doesn't work in which case you get TLS. At work, obviously IT group policy, "security" middle boxes and so on will insist on whatever set of nonsense is just barely enough to keep the Marketing Director's twitter working how she likes it, and the Sales Director's Candy Crush on his work phone. Can't help you really on that.
- Macha 5y agoI've never had problems with srv records for matrix servers, Minecraft servers, email auto configuration etc.
- throw0101a 5y agoThe draft outlines the differences from SRV for anyone curious: * https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https#appendix-C.1 https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-...
- smartbit 5y agoWhy are we not all using sshfp records? They seem quite useful even without dnssec. Or is the lack of dnssec the only reason they’re not/little used?
- tptacek 5y agoBecause SSH certificates are a more powerful solution to the problem, work effectively in both directions, support short-lived keys linked to MFA, and are supported by a lot of tooling that SSHFP doesn't have. SSHFP is dead.