[44net] Re: DNS AXFR

On Wed, Apr 24, 2024 at 1:54 PM Rob PE1CHL via 44net <44net(a)mailman.ampr.org> wrote: I don't know that it's quite that bad. What I understand the use case to be is that: 1. KB3VWG has a recursive DNS server sitting on a very slow speed link (perhaps on an RF island). 2. He wants to be able to look up arbitrary AMPRnet host names, but the latency due to the RF island makes doing this in the standard recursive fashion difficult. Hence, 3. The desire to cache the entire `ampr.org` zone and reverse RRs, presumably by transferring them to said DNS server periodically via an AXFR. At least, that's my reading between the lines; it's admittedly not super clear whether the DNS server is on a slow link, or clients are on a slow link. I could see either as being a legitimate use case. I think what G1FEF and ON3RVH are saying is that nothing precludes one from setting up a recursive DNS server that handles queries to the root for arbitrary AMPRNet DNS RRs oneself, and then configuring clients to connect to that. In that case, a client making a request from a slow RF island is still only making one request: to the recursive DNS server that will handle resolution from there, and eventually return the results to the slow client. But that's predicated on the recursive DNS server not being on a super-slow link. Or maybe the request is to provision "official" recursive DNS servers in various places inside of AMPRnet to avoid having to traverse the public Internet to handle lookups. On the face of it, it's not an unreasonable request, but someone would have to coordinate it and provision the resources, etc. Many DNS servers of various kinds support the concept of "forwarding" a query for specific zones to specific server (or set of servers); sort of an alternate root, if you will. For example, Unbound can do this via it's "Forward Zone" options: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#forw… BIND has similar functionality when configured as a recursive resolver: https://bind9.readthedocs.io/en/latest/chapter3.html#resolver-caching-name-… (see, section 3.3.3, "Forwarding Resolver Configuration"). With something like that, a recursive caching resolver on a slow island can forward to a nearby authoritative server without having to contact the root, and without any traffic leaving AMPRNet, and without having to use zone transfers to "seed" the local cache (which does seem fraught, as described). - Dan C. (KZ2X)