On 5/16/2011 3:13 PM, Paul Vixie wrote:
Date: Mon, 16 May 2011 14:37:46 -0400 From: Jim Gettys<jg@freedesktop.org>
perhaps i'm too close to the problem because that solution looks quite viable to me. dns providers who don't keep up with the market (which means ipv6+dnssec in this context) will lose business to those who do. I don't believe it is currently viable for any but the hackers out there, given my experience during the Comcast IPv6 trial. Typing V6 addresses (much less remembering them) is a PITA. You are asking people who don't even know DNS exists, to bother to establish another business relationship (or maybe DNS services might someday be provided by their ISP). actually, i'm asking the opposite. only hackers run their own dns mostly; the vast majority of users who don't know what ipv6 or dnssec are, are already outsourcing to ultradns/neustar, or verisign, or dyn.com, etc, or
I think that what you probably meant to say was: "... outsourcing to Affilias, Amazon Route 53, DNS Made Easy, DNS.com, Dyn/Dynect, EasyDNS, GoDaddy, Netriplex, UltraDNS, Verisign, Zerigo, etc." ^^ Those are the commercial anycast DNS services that I know of presented in a simple non-preferential alphabetical order. I happen to know, because I did parts of the implementation, that DNS Made Easy provides anycast IPv6 DNS to all customers (available on all servers if they like).
for recursive they're using opendns, google dns, etc. these companies can either add the new services and do outreach to their customer bases, or they can allow their competitors to do so.
of those who still run their own dns, the vast majority actually do know the dnssec and ipv6 issues facing them.
If you get past that hurdle they get to type long IPv6 addresses into a web page they won't remember where it was the year before when they did this the last time to add a machine to their DNS. i've been using ipv6 dual stack for ten years at ISC and for one year at home (i was comcast's first north american dual stack native customer) and the only time i type long ipv6 addresses is when editing dns zone files or configuring routers and hosts. i think your experiences may have been worse than mine and i'll be interested in knowing whether they're common.
The way this "ought" to work for clueless home users (or cluefull users too, for that matter) is that, when a new machine appears on a network, it "just works", by which I mean that a globally routeable IPv6 address appears in DNS without fussing around using the name that was given to the machine when it was first booted, and that a home user's names are accessible via secondaries even if they are off line. this is why ISC DHCP and ISC BIND can communicate using RFC 2136 DNS dynamic updates, secured with RFC 2845 transaction signatures. once you get this running then you don't have to type ipv6 addresses anywhere. and i know that infoblox and other BIND Inside appliance vendors have the same capability, and that Cisco and other DNS/DHCP vendors can also participate in these open standards pretty much out of the box. this is what i worked on when i first found out about IETF back in 1995 or so. it's all done now you just have to learn it and deploy it. (and if you don't think end users ought to have to learn how to configure their DHCP to talk to their DNS, i will point them at a half dozen appliance and outsourcing vendors who can take the ones and zeroes out of this for them.)
And NXDOMAIN should work the way it was intended, for all the reasons you know better than I. while i agree, i don't think the people who are substituting positive responses for NXDOMAIN care at all what you think or what i think, so i'm going to focus on what can be done which is advancing robust solutions.
This is entirely possible ;-). Just go ask Evan Hunt what he's been up to with Dave Taht recently.... more appliance vendors including open source are definitely welcome. the pool is large enough for everybody to swim in it.