Re: Re: Would not love to see reconsideration for domain and search

[Rich Felker <dalias@libc.org>]

On Sun, Oct 25, 2015 at 10:14:42PM -0700, Tim Hockin wrote:
> Maybe I am confused..
> 
> On Sun, Oct 25, 2015 at 7:14 PM, John Levine <johnl@iecc.com> wrote:
> 
> > DNS search lists seemed like a good idea back in the 1980s.  Then in
> > 1990 they added .CS for Czechoslovakia to the DNS root, and in
> > Computer Science departments all over the world, addresses like
> > joe@frodo.cs stopped working, since the search list that used to turn
> > it into joe@frodo.cs.stateu.edu didn't do that any more.
> 
> If I have a search path of "stateu.edu" and ndots=2, and I resolve
> "frodo.cs", wouldn't that FIRST try frodo.cs.stateu.edu. BEFORE
> frodo.cs. ?

I suspect John was using a configuration with ndots=1, where the
legacy behavior for queries with dots>=ndots was to first try the
global scope, then fallback to search domains. And this example is
(aside from nasty performance hit, which also matters) precisely why I
think supporting this fallback is a bad idea: changes to the global
dns scope, outside of your control, can change the results you get for
things that you thought were under your control.

Without this fallback, you would need ndots=2 to get the "desired"
behavior, and addition of the .cs TLD would not have broken it. Of
course you'd be blocking access to a number of real global-scope .cs
domains, which would be bad policy, but at least stable.

Note that ndots=1 search is rather harmless as long as ICANN has a
prohibition on top-level domains resolving to an address.

Rich