ietf-corpus

rfc-3425

Obsoleting IQUERY

D. Lawrence
date2002-11 streamIETF areaint wgdnsext statusPROPOSED STANDARD pages5 canonicalhttps://www.rfc-editor.org/rfc/rfc3425 doi10.17487/RFC3425
The IQUERY method of performing inverse DNS lookups, specified in RFC 1035, has not been generally implemented and has usually been operationally disabled where it has been implemented. Both reflect a general view in the community that the concept was unwise and that the widely-used alternate approach of using pointer (PTR) queries and reverse-mapping records is preferable. Consequently, this document deprecates the IQUERY operation, declaring it entirely obsolete. This document updates RFC 1035. [STANDARDS-TRACK]

updates

Extracted elements (8)

design-rationale §1

IQUERY was deprecated because it placed an arduous burden on servers (requiring exhaustive database searches or separate inverse indexes), could generate megabyte-sized responses enabling DoS attacks, was unable to refer requesters to other servers, and had no known clients providing meaningful service.

dns

design-rationale §1

The widely-used alternative of PTR records in the in-addr.arpa tree for reverse mapping of addresses to names has served the community well and is preferable to IQUERY for inverse lookups.

dns

interoperability-note §3

Section 6.4 (including all subsections) of RFC 1035 is entirely superseded by this document and considered obsolete. Implementations previously conforming to RFC 1035's IQUERY behavior should now return NOTIMP.

dns

normative-requirement §3 SHOULD

Name servers SHOULD return a 'Not Implemented' error when an IQUERY request is received, as the IQUERY opcode is now obsolete.

dns

protocol-element §3

DNS opcode 1 (IQUERY) is redefined as obsolete. Originally used to look up names associated with a given Resource Record value, its definition in RFC 1035 section 4.1.1 is superseded by this document.

dns

registry §5

IANA is directed to permanently retire IQUERY opcode value 1, which must not be reassigned to any future DNS opcode.

dns, registry

security-consideration §4

If IQUERY were not obsoleted, securing its responses with DNSSEC would be extremely difficult without on-the-fly digital signing. Removing IQUERY is unlikely to open new security holes since absence of a positive response would logically lead to denial of authentication.

dns, security

security-consideration §1

Large IQUERY responses (potentially tens of thousands of 3-tuples) could easily be used to launch denial of service attacks against servers or the network. Obsoleting IQUERY removes this vector.

dns, security