[Pdns-users] Re: in.addr-arpa delegation

[Stephane Bortzmeyer]

On Sat, Feb 25, 2006 at 12:03:24AM +1100,
 Richard McLean <richard at golivehost.com> wrote 
 a message of 22 lines which said:

> You left out the important part of the sentence:

No, because the "fix" is apparently (I did not look the diff) a very
partial one: PowerDNS *must not* choose arbitrarly which characters to
refuse or to accept. Almost any 8-bits characters can appear in a DNS
label (unlike a host name but the DNS is not restricted to host
names).

RFC 1035 clearly says:

>Although labels can contain any 8 bit values in octets that make up a
>label,

If / is accepted, this is good for RFC 2317 but if _ is still
forbidden, this is bad for SRV (RFC 2782), etc.

Let me quote RFC 2181, which is crystal clear on how to interpret RFC
1035:

11. Name syntax

   Occasionally it is assumed that the Domain Name System serves only
   the purpose of mapping Internet host names to data, and mapping
   Internet addresses to host names.  This is not correct, the DNS is a
   general (if somewhat limited) hierarchical database, and can store
   almost any kind of data, for almost any purpose.

   The DNS itself places only one restriction on the particular labels
   that can be used to identify resource records.  That one restriction
   relates to the length of the label and the full name.  The length of
   any one label is limited to between 1 and 63 octets.  A full domain
   name is limited to 255 octets (including the separators).  The zero
   length full name is defined as representing the root of the DNS tree,
   and is typically written and displayed as ".".  Those restrictions
   aside, any binary string whatever can be used as the label of any
   resource record.  Similarly, any binary string can serve as the value
   of any record that includes a domain name as some or all of its value
   (SOA, NS, MX, PTR, CNAME, and any others that may be added).
   Implementations of the DNS protocols must not place any restrictions
   on the labels that can be used.  In particular, DNS servers must not
   refuse to serve a zone because it contains labels that might not be
   acceptable to some DNS client programs.  A DNS server may be
   configurable to issue warnings when loading, or even to refuse to
   load, a primary zone containing labels that might be considered
   questionable, however this should not happen by default.

   Note however, that the various applications that make use of DNS data
   can have restrictions imposed on what particular values are
   acceptable in their environment.  For example, that any binary label
   can have an MX record does not imply that any binary name can be used
   as the host part of an e-mail address.  Clients of the DNS can impose
   whatever restrictions are appropriate to their circumstances on the
   values they use as keys for DNS lookup requests, and on the values
   returned by the DNS.  If the client has such restrictions, it is
   solely responsible for validating the data from the DNS to ensure
   that it conforms before it makes any use of that data.

   See also [RFC1123] section 6.1.3.5.