Re: [Fwd: Request for Advice on VGRS IDN Announcement]

[Thomas Narten <narten@us.ibm.com>]

Hmmm.

> On Friday, VeriSign Global Registry Services announced a set of steps
> relating to the implementation of internationalized domain name
> capabilities, including changes in the behavior of the authoritative
> name servers for the com and net zones.  The announcement is at
> <http://www.merit.edu/mail.archives/nanog/msg06058.html>.

I can only tell 80% what they are doing here. But if its what I think
it is, it's bad. Quoting from the Verisign release:

> Starting
> on January 3, 2003, some queries to the com/net name servers that
> previously failed with a DNS Name Error (NXDOMAIN) response will
> instead return an address (A) record. Any queries for A records with
> at least one octet greater than decimal 127 in the second-level label
> will trigger this A record response.

This is broken, it if does this for things in .com and other
TLDs. I.e, instead of returning an error, their servers will return a
bogus A record that points to one of their servers.  The client will
then contact the verisign server instead of the actual intended
destination.

> The A record that will be returned by VGRS points to a farm of web
> servers that will attempt to resolve the query. The browser that sent
> the original DNS query will connect to one of these web servers and
> its HTTP request will contain a Host header with the representation
> of the IDN originally entered by the user in the address bar. The web
> servers will attempt to interpret the contents of the Host header. If
> the Host header corresponds to an IDN registered in VeriSign's IDN
> Test Bed, the web server will return a page that gives the user an
> opportunity to download the free i-Nav plug-in. The page will also
> allow the user to navigate to the corresponding IDN web site via an
> HTTP redirect. If the contents of the Host header cannot be matched
> to an IDN registered in the Testbed, the web server will return an
> HTTP 404 response.

Oh? you mean the intended service for the client might not be HTTP? Oh
well, too bad.

The question is the scope here. If the .com servers start doing this
for *everything* in, say, .com, this is way out of line.

Thomas