From 5e37190877ce05afedf95cc0ea3cf6b2da6061a7 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Thu, 30 Aug 2018 21:16:47 -0700 Subject: [PATCH] add documentation --- CHANGES | 7 ++++++ doc/arm/Bv9ARM-book.xml | 51 +++++++++++++++++++++++++++++++++++++++++ doc/arm/notes.xml | 41 +++++++++++++++++++++++++++++++++ 3 files changed, 99 insertions(+) diff --git a/CHANGES b/CHANGES index a17df7937a..5e55faa14a 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,10 @@ +5029. [func] Workarounds for servers that misbehave when queried + with EDNS have been removed, because these broken + servers and the workarounds for their noncompliance + cause unnecessary delays, increase code complexity, + and prevent deployment of new DNS features. See + https://dnsflagday.net for further details. [GL #150] + 5028. [bug] Spread the initial RRSIG expiration times over the entire working sig-validity-interval when signing a zone in named to even out re-signing and transfer diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 4530c0876e..453b7a43bd 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -17139,7 +17139,58 @@ allow-query { !{ !10/8; any; }; key example; }; source of hints and information that can be used to figure out what went wrong and how to fix the problem. + +
EDNS compliance issues + + EDNS (Extended DNS) is a standard that was first specified + in 1999. It is required for DNSSEC validation, DNS COOKIE + options, and other features. There are broken and outdated + DNS servers and firewalls still in use which misbehave when + queried with EDNS; for example, they may drop EDNS queries + rather than replying with FORMERR. BIND and other recursive + name servers have traditionally employed workarounds in this + situation, retrying queries in different ways and eventually + falling back to plain DNS queries without EDNS. + + + Such workarounds cause unnecessary resolution delays, + increase code complexity, and prevent deployment of new DNS + features. As of February 2019, all major DNS software vendors + have agreed to remove these workarounds; see + https://dnsflagday.net + for further details. This change was implemented in BIND + as of release 9.14.0. + + + As a result, some domains may be non-resolvable without manual + intervention. In these cases, resolution can be restored by + adding server clauses for the offending + servers, specifying edns no or + send-cookie no, depending on the specific + noncompliance. + + + To determine which server clause to use, + run the following commands to send queries to the authoritative + servers for the broken domain: + + + dig soa <zone> @<server> +dnssec + dig soa <zone> @<server> +dnssec +nocookie + dig soa <zone> @<server> +noedns + + + If the first command fails but the second succeeds, the + server most likely needs send-cookie no. + If the first two fail but the third succeeds, then the server + needs EDNS to be fully disabled with edns no. + + + Please contact the administrators of noncompliant domains + and encourage them to upgrade their broken DNS servers. +
Incrementing and Changing the Serial Number diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index f3c4e2017a..f326885798 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -156,6 +156,47 @@
Removed Features + + + Workarounds for servers that misbehave when queried with EDNS + have been removed, because these broken servers and the + workarounds for their noncompliance cause unnecessary delays, + increase code complexity, and prevent deployment of new DNS + features. See https://dnsflagday.net + for further details. + + + In particular, resolution will no longer fall back to + plain DNS when there was no response from an authoritative + server. This will cause some domains to become non-resolvable + without manual intervention. In these cases, resolution can + be restored by adding server clauses for the + offending servers, specifying edns no or + send-cookie no, depending on the specific + noncompliance. + + + To determine which server clause to use, run + the following commands to send queries to the authoritative + servers for the broken domain: + + + dig soa <zone> @<server> +dnssec + dig soa <zone> @<server> +dnssec +nocookie + dig soa <zone> @<server> +noedns + + + If the first command fails but the second succeeds, the + server most likely needs send-cookie no. + If the first two fail but the third succeeds, then the server + needs EDNS to be fully disabled with edns no. + + + Please contact the administrators of noncompliant domains + and encourage them to upgrade their broken DNS servers. [GL #150] + + Previously, it was possible to build BIND without thread support