<html><head></head><body><div><div><div class=""><div class=""><div class=""><div class=""><br></div></div><div class=""><br></div><div class="sh-signature"><div class="gmail_signature"><br></div></div></div><div class=""><br></div><div class="sh-quoted-content"><div class=""><div class="gmail_quote"><div class="">On Wed, Aug 03, 2022 at 12:11 PM, Casey Deccio <span dir="ltr" class=""><<a href="mailto:casey@deccio.net" target="_blank" class="">casey@deccio.net</a>></span> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_extra"><div class="gmail_quote"><p class="">Dear NCAP DG members, <br></p><p class="">As you know, I have written two reports associated with root cause analysis for name collisions reports received by ICANN. Some time ago I distributed earlier versions of these documents to this mailing list, which resulted in feedback that I have addressed in the latest versions. Most of the changes are relatively minor. The one significant addition is the inclusion of a section on "Qname minimization considerations", which is now section 7.3 of the "Root Cause Analysis - new gTLD" report. The final version of these reports will be included as appendices in the Study 2 document, along with other reports that have been written in conjunction with Study 2. <br></p><p class="">I invite you to read the documents, with particular attention to the new section. I will consider this a final call for comments from the NCAP DG. <br></p><p class=""></p><div class="">Root Cause Analysis - <a target="_blank" rel="noopener noreferrer" href="http://wpad.domain.name/" class="">wpad.<wbr>domain.<wbr>name</a> <br></div><div class=""> <a target="_blank" rel="noopener noreferrer" href="https://docs.google.com/document/d/1y5jcWeH3gOKzxtF7_BnqNdwbbvlyqvshNVIZvJ19wDg/edit?usp=sharing">https://docs.google.com/document/d/1y5jcWeH3gOKzxtF7_BnqNdwbbvlyqvshNVIZvJ19wDg/edit?usp=sharing</a><br></div><p></p><p class=""></p><div class="">Root Cause Analysis - New gTLD Collisions <br></div><div class=""> <a target="_blank" rel="noopener noreferrer" href="https://docs.google.com/document/d/1YSvdH9Slws0iW3e6yoS04s5zANBnyMMFn9DUNE19fkg/edit?usp=sharing" class="">https:/<wbr>/<wbr>docs.<wbr>google.<wbr>com/<wbr>document/<wbr>d/<wbr>1YSvdH9Slws0iW3e6yoS04s5zANBnyMMFn9DUNE19fkg/<wbr>edit?usp=sharing</a><br></div><p></p><p class=""><br></p></div></div></blockquote></div></div></div></div><div class=""><div class=""><br></div><div class="">Apologies, I've been traveling and so have missed a number of calls / updates, so this may all have been covered in a discussion that I missed.<br></div><div class=""><br></div><div class=""><br></div><div class="">I'm quite confused by section "7.3. Qname Minimization Considerations" and the finding: "Based on the analysis presented herein, we conclude that the trends related to name collision DNS queries observed at the root servers from DITL collection data are not affected by qname minimization behaviors."<br></div><div class=""><br></div><div class="">From what I can tell, the methodology used is flawed — it says (Sec 7.3.1):<br></div><div class="">"A resolver was evaluated for qname minimization by testing for the following two query behaviors during the collection period: 1) the resolver issued a minimum of five queries for qnames other than the root name; and 2) the resolver issued no query with a qname having more than one label."<br></div><div class=""><br></div><div class="">I have configured a test name-server (BIND 9.16.27 (Extended Support Version)) with QNAME minimization (qname-minimization strict;)<br></div><div class="">and then restarted it, while doing a tcpdump towards the root servers.<br></div><div class=""><br></div><div class="">This is the result (edited to remove noise):<br></div><div class="">17:18:55.133793 IP 204.194.23.4.57696 > 199.9.14.201.53: 6466% [1au] DNSKEY? . (40)<br></div></div><div class="">17:18:55.133811 IP 204.194.23.4.45279 > 199.9.14.201.53: 5337% [1au] A? <a href="http://ns.example.com/" class="">ns.example.com</a>. (55)<br></div><div class="">17:18:55.134010 IP 204.194.23.4.40745 > 199.9.14.201.53: 18603 [1au] NS? . (40)<br></div><div class="">17:18:55.134025 IP 204.194.23.4.37222 > 199.9.14.201.53: 59226% [1au] AAAA? <a href="http://ns.example.com/" class="">ns.example.com</a>. (55)<br></div><div class="">17:18:55.135841 IP 204.194.23.4.38998 > 199.9.14.201.53: 62191% [1au] A? <a href="http://ns.example.com/" class="">ns.example.com</a>. (71)<br></div><div class="">17:18:55.136058 IP 204.194.23.4.55746 > 199.9.14.201.53: 31405% [1au] AAAA? <a href="http://ns.example.com/" class="">ns.example.com</a>. (71)<br></div><div class="">17:18:55.136125 IP 199.9.14.201.53 > 204.194.23.4.37949: 5960*-| 13/0/1 NS <a href="http://a.root-servers.net/" class="">a.root-servers.net</a>., NS <a href="http://b.root-servers.net/" class="">b.root-servers.net</a>., NS <a href="http://c.root-servers.net/" class="">c.root-servers.net</a>., NS <a href="http://d.root-servers.net/" class="">d.root-servers.net</a>., NS <a href="http://e.root-servers.net/" class="">e.root-servers.net</a>., NS <a href="http://f.root-servers.net/" class="">f.root-servers.net</a>., NS <a href="http://g.root-servers.net/" class="">g.root-servers.net</a>., NS <a href="http://h.root-servers.net/" class="">h.root-servers.net</a>., NS <a href="http://i.root-servers.net/" class="">i.root-servers.net</a>., NS <a href="http://j.root-servers.net/" class="">j.root-servers.net</a>., NS <a href="http://k.root-servers.net/" class="">k.root-servers.net</a>., NS <a href="http://l.root-servers.net/" class="">l.root-servers.net</a>., NS <a href="http://m.root-servers.net/" class="">m.root-servers.net</a>. (459)<br></div><div class="">17:18:55.199919 IP 204.194.23.4.35072 > 202.12.27.33.53: 39497% [1au] A? <a href="http://a.iana-servers.net/" class="">a.iana-servers.net</a>. (59)<br></div><div class="">17:18:55.200079 IP 204.194.23.4.53543 > 202.12.27.33.53: 37131% [1au] A? <a href="http://b.iana-servers.net/" class="">b.iana-servers.net</a>. (59)<br></div><div class="">17:18:55.381516 IP 204.194.23.4.34696 > 193.0.14.129.53: 61999% [1au] A? <a href="http://ns.icann.org/" class="">ns.icann.org</a>. (53)<br></div><div class="">17:18:58.561175 IP 204.194.23.4.53967 > 199.7.83.42.53: 5955% [1au] A? <a href="http://ns1.hkg1.afilias-nst.info/" class="">ns1.hkg1.afilias-nst.info</a>. (66)<br></div><div class="">17:18:58.561246 IP 204.194.23.4.47519 > 199.7.83.42.53: 47603% [1au] A? <a href="http://ns1.mia1.afilias-nst.info/" class="">ns1.mia1.afilias-nst.info</a>. (66)<br></div><div class="">17:18:58.561301 IP 204.194.23.4.44128 > 199.7.83.42.53: 17974% [1au] A? <a href="http://ns1.sea1.afilias-nst.info/" class="">ns1.sea1.afilias-nst.info</a>. (66)<br></div><div class="">17:18:58.561372 IP 204.194.23.4.38500 > 199.7.83.42.53: 31478% [1au] A? <a href="http://ns1.ams1.afilias-nst.info/" class="">ns1.ams1.afilias-nst.info</a>. (66)<br></div><div class="">17:18:59.320376 IP 204.194.23.4.38118 > 192.112.36.4.53: 63393% [1au] A? <a href="http://sunic.sunet.se/" class="">sunic.sunet.se</a>. (55)<br></div><div class="">17:18:59.320454 IP 204.194.23.4.53799 > 192.112.36.4.53: 53942% [1au] A? <a href="http://ns-ietf.nlnetlabs.nl/" class="">ns-ietf.nlnetlabs.nl</a>. (61)<br></div><div class="">17:18:59.342234 IP 204.194.23.4.42688 > 192.112.36.4.53: 27839% [1au] A? <a href="http://ns1.bknix.co.th/" class="">ns1.bknix.co.th</a>. (56)<br></div><div class="">17:18:59.342274 IP 204.194.23.4.46165 > 192.112.36.4.53: 50831% [1au] A? <a href="http://ns3.bknix.co.th/" class="">ns3.bknix.co.th</a>. (56)<br></div><div class="">17:18:59.342274 IP 204.194.23.4.51014 > 192.112.36.4.53: 41759% [1au] A? <a href="http://ns0.bknix.co.th/" class="">ns0.bknix.co.th</a>. (56)<br></div><div class="">17:18:59.344635 IP 204.194.23.4.39436 > 192.58.128.30.53: 20236% [1au] A? <a href="http://ns2.dns.nl/" class="">ns2.dns.nl</a>. (51)<br></div><div class="">17:18:59.344685 IP 204.194.23.4.59324 > 192.58.128.30.53: 52721% [1au] A? <a href="http://ns1.dns.nl/" class="">ns1.dns.nl</a>. (51)<br></div><div class="">17:18:59.344695 IP 204.194.23.4.44777 > 192.58.128.30.53: 31159% [1au] A? <a href="http://ns3.dns.nl/" class="">ns3.dns.nl</a>. (51)<br></div><div class="">17:18:59.366421 IP 204.194.23.4.45371 > 192.5.5.241.53: 44872% [1au] A? <a href="http://b.thains.co.th/" class="">b.thains.co.th</a>. (55)<br></div><div class="">17:18:59.366546 IP 204.194.23.4.38353 > 192.5.5.241.53: 17011% [1au] A? <a href="http://c.thains.co.th/" class="">c.thains.co.th</a>. (55)<br></div><div class="">17:18:59.366611 IP 204.194.23.4.57669 > 192.5.5.241.53: 40232% [1au] A? <a href="http://a.thains.co.th/" class="">a.thains.co.th</a>. (55)<br></div><div class="">17:18:59.366616 IP 204.194.23.4.56667 > 192.5.5.241.53: 9030% [1au] A? <a href="http://p.thains.co.th/" class="">p.thains.co.th</a>. (55)<br></div><div class="">17:18:59.500690 IP 204.194.23.4.60389 > 192.5.5.241.53: 54713% [1au] A? <a href="http://ns1.sunet.se/" class="">ns1.sunet.se</a>. (53)<br></div><div class="">17:18:59.523583 IP 204.194.23.4.59315 > 199.7.91.13.53: 28978% [1au] A? <a href="http://nn.uninett.no/" class="">nn.uninett.no</a>. (54)<br></div><div class="">17:18:59.524834 IP 204.194.23.4.51883 > 199.7.91.13.53: 22009% [1au] A? <a href="http://x.nic.no/" class="">x.nic.no</a>. (49)<br></div><div class="">17:18:59.524894 IP 204.194.23.4.55999 > 199.7.91.13.53: 27108% [1au] A? <a href="http://y.nic.no/" class="">y.nic.no</a>. (49)<br></div><div class="">17:18:59.524912 IP 204.194.23.4.43732 > 199.7.91.13.53: 58903% [1au] A? <a href="http://z.nic.no/" class="">z.nic.no</a>. (49)<br></div><div class="">17:18:59.524984 IP 204.194.23.4.36453 > 199.7.91.13.53: 24228% [1au] A? <a href="http://not.norid.no/" class="">not.norid.no</a>. (53)<br></div><div class="">17:18:59.525033 IP 204.194.23.4.48791 > 199.7.91.13.53: 18178% [1au] A? <a href="http://njet.norid.no/" class="">njet.norid.no</a>. (54)<br></div><div class="">17:22:28.168113 IP 204.194.23.4.50911 > 192.33.4.12.53: 36830% [1au] A? <a href="http://ns-1867.awsdns-41.co.uk/" class="">ns-1867.awsdns-41.co.uk</a>. (64)<br></div><div class=""><br></div><div class="">It sent more than 28 queries with more than one label. <br></div><div class=""><br></div><div class="">Testing to make sure that it *is* actually a qname-minimizing resolver:<br></div><div class="">$ ping <a href="http://this.is.a.name.with.many.labels/" class="">this.is.a.name.with.many.labels</a><br></div><div class="">ping: <a href="http://this.is.a.name.with.many.labels/" class="">this.is.a.name.with.many.labels</a>: Name or service not known<br></div><div class=""><br></div><div class="">Gives:<br></div><div class="">17:28:22.045055 IP 204.194.23.4.48050 > 192.36.148.17.53: 45039 [1au] NS? labels. (47)<br></div><div class="">17:28:22.045506 IP 192.36.148.17.53 > 204.194.23.4.48050: 45039 NXDomain*-| 0/0/1 (63)<br></div><div class=""><br></div><div class="">So, it clearly is performing name-minimization for queries received (it doesn't qname minimize infrastructure lookups)<br></div><div class=""><br></div><div class=""><div class="">So, from the criteria above, this would be classified as non-qname-minimizing (it sent many queries with more than one label), even though it clearly is qname-minimizing.<br></div><div class=""><br></div><div class="">This seems to call the findings into significant doubt,<br></div><div class="">W<br></div><div class=""><br></div><div class=""><br></div><div class=""><br></div></div><div class=""><div class="sh-quoted-content"><div class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_extra"><div class="gmail_quote"><p class="">Please request access if you don't have it. <br></p><p class=""></p><div class="">Cheers, <br></div><div class=""> Casey <br></div><div class=""> _______________________________________________ <br></div><div class=""> NCAP-Discuss mailing list <br></div><div class=""> <a target="_blank" rel="noopener noreferrer" href="mailto:NCAP-Discuss@icann.org" class="">NCAP-Discuss@<wbr>icann.<wbr>org</a> <br></div><div class=""> <a target="_blank" rel="noopener noreferrer" href="https://mm.icann.org/mailman/listinfo/ncap-discuss">https://mm.icann.org/mailman/listinfo/ncap-discuss</a><br></div><p></p><p class=""></p><div class="">_______________________________________________ <br></div><div class=""> By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a target="_blank" rel="noopener noreferrer" href="https://www.icann.org/privacy/policy" class="">https:/<wbr>/<wbr>www.<wbr>icann.<wbr>org/<wbr>privacy/<wbr>policy</a>) and the website Terms of Service (<a target="_blank" rel="noopener noreferrer" href="https://www.icann.org/privacy/tos" class="">https:/<wbr>/<wbr>www.<wbr>icann.<wbr>org/<wbr>privacy/<wbr>tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<br></div><p></p></div></div></blockquote></div></div></div></div><div class=""><br></div></div><div></div></div></body></html>