I have a feeling that I might be stepping into a can of worms by asking this, but.. What's the current thinking around reverse DNS on IPs used by typical residential/ small business customers. Way way back in the day I used to generate "filler" reverse dns for all of these ranges .. that is, records like "45.100.51.198.in-addr.arpa IN PTR 198-51-100‐45.dialup.example.com", and then add a forward A record to match. We had a procedure to override this generic domain upon customer request when a static IP was assigned, such as for a mail server. As time has marched on, and other people were responsible for the reverse dns zones, cruft from old customers no longer with us has accumulated in the reverse DNS override file and I recently discovered that many newer ranges are either nonexistent or not updated. As I'm in the process of cleaning up several other related messes, I'm feeling I should clean this one up too. I've kinda felt for a while now that reverse dns isn't really needed for the customer IPs but before I dump the whole thing overboard and switch to returning NXDOMAIN unless the customer really needs a reverse dns record I figured I'd ask what the current thinking is for these among the internet community. I'm not talking about reverse dns for infrastructure/router IPs here, as I still feel those need to be kept up to date. This is just for the individual end user IPs.
On Apr 21, 2023, at 11:38 AM, Forrest Christian (List Account) <lists@packetflux.com> wrote: What's the current thinking around reverse DNS on IPs used by typical residential/ small business customers? I'm not talking about reverse dns for infrastructure/router IPs here, as I still feel those need to be kept up to date. This is just for the individual end user IPs.
I think it’s really useful… but as IPv4 becomes a thing of the past, it probably needs to be supplied dynamically by a plug-in to your nameserver, rather than in giant static tables. -Bill
Once upon a time, Forrest Christian (List Account) <lists@packetflux.com> said:
I have a feeling that I might be stepping into a can of worms by asking this, but..
What's the current thinking around reverse DNS on IPs used by typical residential/ small business customers.
I don't see any benefit to programmatically-generated reverse DNS. I stopped setting it up a long time ago now. Really, reverse DNS these days is mostly only useful for: - mail servers (where it shows a modicum of control and clue) - infrastructure/router IPs (so mtr/traceroute can show useful info) -- Chris Adams <cma@cmadams.net>
On 21/04/2023 15:37, Chris Adams wrote:
I don't see any benefit to programmatically-generated reverse DNS. I stopped setting it up a long time ago now. Really, reverse DNS these days is mostly only useful for:
- mail servers (where it shows a modicum of control and clue) - infrastructure/router IPs (so mtr/traceroute can show useful info)
I would say the absence of reverse DNS tells useful info to receiving MTAs - to preferably not accept. Frank
On Fri, Apr 21, 2023 at 5:40 AM Chris Adams <cma@cmadams.net> wrote:
Once upon a time, Forrest Christian (List Account) <lists@packetflux.com> said:
I have a feeling that I might be stepping into a can of worms by asking this, but..
What's the current thinking around reverse DNS on IPs used by typical residential/ small business customers.
I don't see any benefit to programmatically-generated reverse DNS. I stopped setting it up a long time ago now. Really, reverse DNS these days is mostly only useful for:
- mail servers (where it shows a modicum of control and clue) - infrastructure/router IPs (so mtr/traceroute can show useful info)
Same
-- Chris Adams <cma@cmadams.net>
Hello, without PTRs you will probably get your prefixes listed in things like Spamhouse PBL. So adding the correct PTR for a mailserver may not be enough, as services like that love to classify entire IP blocks. Of course Spamhaus provides the tools to fix this issue. But what if there are 4 - 5 other services like that? Do you want to go down that rabbit hole, everytime you turn up a mailserver in your prefix? I also think reverse DNS records are useful when you have discussions with content providers for all sorts of reasons like geolocation issues or "VPN" classifications. Of course whois/irr records are the proper tools for this. But if I have to discuss my IP ranges with some first level support desk at a large content provider, everything that stands out negatively will impact my chances of actually getting it done and how fast it will get done. Considering how subjective IP classifications are, I will not return NXDOMAIN for v4 addresses if there is even a small chance that it will make my life harder at some point in the future. Lukas
We actually manually list our customer ranges in pbl, or at least used to. Probably something else that I need to check on. On Fri, Apr 21, 2023, 8:04 AM Lukas Tribus <lukas@ltri.eu> wrote:
Hello,
without PTRs you will probably get your prefixes listed in things like Spamhouse PBL. So adding the correct PTR for a mailserver may not be enough, as services like that love to classify entire IP blocks. Of course Spamhaus provides the tools to fix this issue. But what if there are 4 - 5 other services like that? Do you want to go down that rabbit hole, everytime you turn up a mailserver in your prefix?
I also think reverse DNS records are useful when you have discussions with content providers for all sorts of reasons like geolocation issues or "VPN" classifications.
Of course whois/irr records are the proper tools for this. But if I have to discuss my IP ranges with some first level support desk at a large content provider, everything that stands out negatively will impact my chances of actually getting it done and how fast it will get done.
Considering how subjective IP classifications are, I will not return NXDOMAIN for v4 addresses if there is even a small chance that it will make my life harder at some point in the future.
Lukas
On 4/21/23 14:37, Chris Adams wrote:
I don't see any benefit to programmatically-generated reverse DNS. I stopped setting it up a long time ago now. Really, reverse DNS these days is mostly only useful for:
- mail servers (where it shows a modicum of control and clue) - infrastructure/router IPs (so mtr/traceroute can show useful info)
Agreed. Mark.
Fri, Apr 21, 2023 at 07:37:49AM -0500, Chris Adams:
Once upon a time, Forrest Christian (List Account) <lists@packetflux.com> said:
I have a feeling that I might be stepping into a can of worms by asking this, but..
What's the current thinking around reverse DNS on IPs used by typical residential/ small business customers.
I don't see any benefit to programmatically-generated reverse DNS. I stopped setting it up a long time ago now. Really, reverse DNS these days is mostly only useful for:
- mail servers (where it shows a modicum of control and clue) - infrastructure/router IPs (so mtr/traceroute can show useful info)
I view complete DNS coverage to be a basic function. All used addresses should have forward and matching reverse records. This is not difficult stuff. Bonus points for including a clli code or similar indicating the general location of use for uses like network device interfaces, commodity end-users, etc; also not difficult stuff. You are tracking your allocations, right? Programmatically generating your device configurations? So, generate DNS from that same database(s).
I view complete DNS coverage to be a basic function. All used addresses should have forward and matching reverse records.
This is not intended as snark: what do people recommend for IPv6? I try to maintain forward/reverse for all my server/infrastructure equipment. But clients? They're making up temporary addresses all day long. So far, I've given up on trying to keep track of those addresses, even though it's a network under my direct control. Thanks, Jason
On Fri, 21 Apr 2023 at 20:44, Jason Healy via NANOG <nanog@nanog.org> wrote:
This is not intended as snark: what do people recommend for IPv6? I try to maintain forward/reverse for all my server/infrastructure equipment. But clients? They're making up temporary addresses all day long. So far, I've given up on trying to keep track of those addresses, even though it's a network under my direct control.
Stateless generation at query time - https://github.com/cmouse/pdns-v6-autorev/blob/master/rev.pl I wrote some POCs quite bit long ago http://p.ip.fi/L5PK - base36 http://p.ip.fi/CAtB - rfc2289 -- ++ytti
Once upon a time, heasley <heas@shrubbery.net> said:
I view complete DNS coverage to be a basic function. All used addresses should have forward and matching reverse records.
But why? It's not like anybody can trust what's in a reverse DNS string, even if it has matching forward. If I'm looking for "ownership", I'm going to registries, not DNS. Since it can't be guaranteed (or even flagged as) maintained, you can't trust any information in that string. -- Chris Adams <cma@cmadams.net>
participants (11)
-
Bill Woodcock -
Ca By -
Chris Adams -
Forrest Christian (List Account) -
Frank Habicht -
heasley -
Jason Healy -
Lukas Tribus -
Mark Tinka -
Randy Bush -
Saku Ytti