3gpp-analysis-04: DNS guidelines

[Pekka Savola <pekkas@netcore.fi>]

Hi,

This is the second issue of today. (I'm using an accelerated cycle because 
I'm leaving for vacation on Friday and want to send all of them out before 
that.)
----

Actually, there are five related issues here regarding DNS guidelines in 
the document.

* The statement about IPv6-only DNS servers, "every recursive DNS server
should be either IPv4-only or dual stack", it not entirely accurate.  It
is perfectly OK to have a IPv6-only DNS server which recursively queries
from _other_ recursive DNS servers.  As long as there are dual-stack
recursive DNS servers in the "recursion chain", the rule is fulfilled.  
It may be useful to try to reword the text slightly to cover for this case
too.

* The analysis only refers to [DNStrans]; it should also refer to (where
appropriate) draft-ietf-dnsop-ipv6-transport-guidelines-00.txt which is
soon ready for DNSOP last call.

* " When thinking the DNS issues, [...]" sounds bad and should be reworded 
(sorry, forgot to add this to the editorial section.)

* The description in section 3.5 is very terse.  The problems here appear 
to be two-fold:

 1) either 3GPP operator's DNS servers should be dual-stack (to reach 
those bogus IPv6-only servers serving the AAAA records), or

 2) at least one IPv4 DNS server is needed for AAAA records so that the 
3GPP operator's DNS servers are able to get the record.

The first is not noted, and the for the second, it is not stated that this
is not the *3GPP operator's* problem, but guy's who is serving AAAA
records.  If we wants to break the operational practices for robust DNS,
there is no way we can stop him..

* the description of DNS issues is spread throughout the document.  
Perhaps we should reword the section "2. Transition mechanisms" to "2. 
Transition mechanisms and considerations" and add a subsection on DNS, 
where we could move e.g. text in section 3.1 and the first paragraph of 
4.1, and only give pointers and discussion specific to GPRS/IMS scenarios 
under those scenarios.

-----
 3.1 Dual Stack UE Connecting to IPv4 and IPv6 Nodes
[...]
    Keeping the Internet name space unfragmented is another important
    issue for both IPv4 and IPv6. It means that any record in the
    public Internet should be available unmodified to any nodes, IPv4
    or IPv6, regardless of the transport being used. The recommended
    approach is the following: every recursive DNS server should be
    either IPv4-only or dual stack and every single DNS zone should be
    served by at least an IPv4 reachable DNS server. This
    recommendation rules out IPv6-only recursive DNS servers and DNS
    zones served by IPv6-only DNS servers, and this approach could be
    revisited if translation techniques between IPv4 and IPv6 were to
    be widely deployed [DNStrans].

 3.4 IPv6 UE Connecting to an IPv4 Node
[...]
    When thinking the DNS issues, the IPv6 UE needs to find the IPv4
    address in the DNS [DNStrans]. Note that DNSSEC is broken if
    NA(P)T-PT is used.

 3.5 IPv4 UE Connecting to an IPv6 Node
[...]
    When thinking the DNS issues, the DNS zones containing AAAA records
    for the IPv6 nodes need to be served by at least one IPv4
    accessible DNS server [DNStrans].

 4.1 DNS Interworking in IMS
                                                                                                       
    The recommended approach (as documented in [DNStrans]) currently is
    that every recursive DNS server should be either IPv4-only or dual
    stack and every single DNS zone should be served by at least an
    IPv4 reachable DNS server. The recommendation rules out IPv6-only
    recursive DNS servers and DNS zones served by IPv6-only DNS
    servers.
                                                                                                       
    To perform DNS resolution in the IMS, the UE can be configured as a
    stub resolver pointing to a recursive DNS resolver. This
    communication can happen over IPv6. However, in the process to find
    the IPv6 address of a SIP server, the recursive DNS resolver may
    need to access data that is available only on some IPv4 DNS
    servers, see [DNStrans]. One way to achieve this is to make the DNS
    resolver be dual stack. As DNS traffic is not directly related to
    the IMS functionality, this is not in contradiction with the IPv6-
    only nature of the IMS.

 8. References

8.2 Informative

    [DNStrans] Durand, A. and Ihren, J.: "IPv6 DNS transition issues",
    February 2003, draft-ietf-dnsop-ipv6-dns-issues-02.txt, work in
    progress.
-----


-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings