<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>
<blockquote type="cite">- Why *must* you forward everything to
Akamai?</blockquote>
<br>
I am forced to "forward only;" to Akamai for all external queries.
It hasn't always been this way, but the decision was made "above
my pay grade", and it is not open to negotiation.</p>
<p>
<blockquote type="cite">- Was that a real example of a daft query:
10.11.12.13 type A?</blockquote>
<br>
"10.11.12.13 is, indeed, a query I found in my log. <br>
</p>
<p>
<blockquote type="cite">what's the issue with returning SERVFAIL?</blockquote>
<br>
On my validating "recursive" servers, "SERVFAIL" is the response
from _my_ server. That is the result of Akamai saying "Here's your
answer!" and my server going through the work of trying to
validate it (and failing).<br>
</p>
<p>On my non-validating "recursive" servers, I send back the answer
Akamai sends me:</p>
<p>
<blockquote type="cite">;; ANSWER SECTION:<br>
10.11.12.13. 10 IN A 10.11.12.13<br>
</blockquote>
</p>
<p>I think SERVFAIL is the correct answer for all of these queries.
I do not want to encourage any customers in thinking they can get
an address back from me by asking for the address of an address.</p>
<p><br>
<blockquote type="cite">- Do Akamai have any knobs you can tweak</blockquote>
</p>
<p>{chuckle} I'm not allowed in the control room. And Akamai's
response to my question was quoted in my original message. From
their perspective, this behavior is a feature, not a defect. I
don't expect them to let their customer disable their "features".
If I want to change this behavior, I'm going to have to do it
within my sphere of influence.<br>
</p>
<p>Off-list, it was suggested to me that I _could_ handle this in my
RPZ, by enumerating all 255 illegal TLDs (e.g. *.10 CNAME . )</p>
<p>I tried this, and it works as expected when dnssec validation is
disabled (either globally, or with "validate-except". My idea
right now is I can enumerate TLD of the numerics I see in my logs,
and ignore the rest. I think this will get me what I want, at a
level of complexity I can accept.<br>
</p>
<pre class="moz-signature" cols="72">--
Do things because you should, not just because you can.
John Thurston 907-465-8591
<a class="moz-txt-link-abbreviated" href="mailto:John.Thurston@alaska.gov">John.Thurston@alaska.gov</a>
Department of Administration
State of Alaska</pre>
<div class="moz-cite-prefix">On 1/24/2023 10:26 PM, Greg Choules
wrote:<br>
</div>
<blockquote type="cite" cite="mid:CANsEUy2abYuHt22-LBAU=Fd0bSG-9ZAg-Qz_KpzFBCSLFF8XGw@mail.gmail.com">
<div>- Why *must* you forward everything to Akamai?</div>
<div>- Was that a real example of a daft query: 10.11.12.13 type
A? If not, do you have some real examples of queries being made
to your servers please?</div>
<div>- Notwithstanding the nature of these illegal queries, if
they *are* illegal (or misguided, or errors, or malicious, or
whatever - anything but valid), what's the issue with returning
SERVFAIL? GIGO Or does that then prejudice genuine queries, for
some reason?</div>
<div>- Are you *only* forwarding to Akamai?</div>
<div>- Do you have "forward only;" or "forward first;"?</div>
<div>- Do Akamai have any knobs you can tweak (I believe they have
a customer web portal for viewing/changing settings?) that would
make them behave like an RFC compliant DNS server?</div>
</blockquote>
</body>
</html>