<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>A follow-up to my heads-up about EDNS errors, with test results.</div><div><br></div><div dir="ltr">I got the ISC tool for bulk testing running, and checked for EDNS compatibility for all Alaskan-looking domains.<div><br></div><div>Of 9727 domains that produced some kind of test result, <b>1017 Alaskan domains</b> were affected in some way. Note that the tester treats things like this as errors as well, which almost always need to be fixed, but aren't EDNS-specific:</div><div><br></div><div>- if the domain has no NS records at all</div><div>- if one of the NS records listed for the domain isn't reachable</div><div>... etc.</div><div><br></div><div>I've published the results to this raw directory:<br></div><div><br></div><div><b> <a href="https://www.techsolvency.com/alaskan-domains-list/edns/">https://www.techsolvency.com/alaskan-domains-list/edns/</a></b><br></div><div><br></div><div>... which has three files:</div><div><br></div><div>* A list of domains with at least one error</div><div>* The test results for those domains<br></div><div>* The results for all domains, regardless of status<br></div><div><br></div><div>I'll leave these up and accessible until at least March 1st. </div><div><br></div><div>I'll also update the list a time or two before the deadline - but don't wait for that while working. Instead, use the tester yourself directly to verify any fixes:<br></div><div><br></div><div> <a href="https://ednscomp.isc.org/ednscomp">https://ednscomp.isc.org/ednscomp</a></div><div><br clear="all"><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">-- </div><div dir="ltr"><span style="font-size:12.8px">Royce</span><br></div></div></div></div></div></div></div><br></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Sat, Jan 12, 2019 at 7:25 AM Royce Williams <<a href="mailto:royce@tycho.org">royce@tycho.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>All,</div><div><br></div><div>If you run a DNS domain, read this:</div><div><br></div><div dir="ltr"> <a href="https://dnsflagday.net/" target="_blank">https://dnsflagday.net/</a></div><div dir="ltr"><br></div><div>Major quotes:</div><div><br></div><div dir="ltr"><div dir="ltr"><i>The current DNS is unnecessarily slow and suffers from inability to deploy new features. To remediate these problems, vendors of DNS software and also big public DNS providers are going to remove certain workarounds on <b>February 1st, 2019.</b><br></i></div><div dir="ltr"><br></div><div dir="ltr"><i>This change affects only sites which operate software which is not following published standards.</i></div><div dir="ltr"><i><br></i></div><div dir="ltr"><i>[...]</i></div><div dir="ltr"><i><br></i></div><div dir="ltr"><div><div><i>The main change is that DNS software from vendors named above will interpret timeouts as sign of a network or server problem. Starting February 1st, 2019 there will be no attempt to disable EDNS as reaction to a DNS query timeout.</i></div><div><i><br></i></div><div><i><b>This effectively means that all DNS servers which do not respond at all to EDNS queries are going to be treated as dead.</b></i></div></div><br class="gmail-m_6048773934084511779gmail-Apple-interchange-newline"></div><div>[end quotes]</div><div dir="ltr"><br></div><div>Basically, there are mechanisms out there to retry <i>without</i> EDNS when an EDNS query times out after a certain tim. <b>These fallback mechanisms are going to be removed, which will make the Internet significantly slower for anyone trying to reach your domain(s).</b></div><div><br></div><div>Please check your major domains and a sampling of your minor ones (based on platform).</div><div><br></div><div>Resources:</div><div><br></div><div>* Tester: <a href="https://ednscomp.isc.org/ednscomp" target="_blank">https://ednscomp.isc.org/ednscomp</a></div><div>* Background: <a href="https://en.wikipedia.org/wiki/Extension_mechanisms_for_DNS" target="_blank">https://en.wikipedia.org/wiki/Extension_mechanisms_for_DNS</a><br></div><div>* Bulk scanner for ISPs: <a href="https://gitlab.labs.nic.cz/knot/edns-zone-scanner/" target="_blank">https://gitlab.labs.nic.cz/knot/edns-zone-scanner/</a><br></div><div><br></div><div><div dir="ltr" class="gmail-m_6048773934084511779gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">-- </div><div dir="ltr"><span style="font-size:12.8px">Royce</span><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</blockquote></div>