I have a feeling that I might be stepping into a can of worms by asking this, but…
What’s the current thinking around reverse DNS on IPs used by typical residential/ small business customers.
Way way back in the day I used to generate “filler” reverse dns for all of these ranges … that is, records like “45.100.51.198.in-addr.arpa IN PTR 198-51-100‐45.dialup.example.com”, and then add a forward A record to match. We had a procedure to override this generic domain upon customer request when a static IP was assigned, such as for a mail server.
As time has marched on, and other people were responsible for the reverse dns zones, cruft from old customers no longer with us has accumulated in the reverse DNS override file and I recently discovered that many newer ranges are either nonexistent or not updated. As I’m in the process of cleaning up several other related messes, I’m feeling I should clean this one up too.
I’ve kinda felt for a while now that reverse dns isn’t really needed for the customer IPs but before I dump the whole thing overboard and switch to returning NXDOMAIN unless the customer really needs a reverse dns record I figured I’d ask what the current thinking is for these among the internet community.
I’m not talking about reverse dns for infrastructure/router IPs here, as I still feel those need to be kept up to date. This is just for the individual end user IPs.
I think it’s really useful… but as IPv4 becomes a thing of the past, it probably needs to be supplied dynamically by a plug-in to your nameserver, rather than in giant static tables.
Once upon a time, Forrest Christian (List Account) <lists@packetflux.com> said:
I have a feeling that I might be stepping into a can of worms by asking
this, but..
What's the current thinking around reverse DNS on IPs used by typical
residential/ small business customers.
I don't see any benefit to programmatically-generated reverse DNS. I
stopped setting it up a long time ago now. Really, reverse DNS these
days is mostly only useful for:
- mail servers (where it shows a modicum of control and clue)
- infrastructure/router IPs (so mtr/traceroute can show useful info)
I have a feeling that I might be stepping into a can of worms by asking
this, but…
What’s the current thinking around reverse DNS on IPs used by typical
residential/ small business customers.
I don’t see any benefit to programmatically-generated reverse DNS. I
stopped setting it up a long time ago now. Really, reverse DNS these
days is mostly only useful for:
mail servers (where it shows a modicum of control and clue)
infrastructure/router IPs (so mtr/traceroute can show useful info)
without PTRs you will probably get your prefixes listed in things like
Spamhouse PBL. So adding the correct PTR for a mailserver may not be
enough, as services like that love to classify entire IP blocks. Of
course Spamhaus provides the tools to fix this issue. But what if
there are 4 - 5 other services like that? Do you want to go down that
rabbit hole, everytime you turn up a mailserver in your prefix?
I also think reverse DNS records are useful when you have discussions
with content providers for all sorts of reasons like geolocation
issues or "VPN" classifications.
Of course whois/irr records are the proper tools for this. But if I
have to discuss my IP ranges with some first level support desk at a
large content provider, everything that stands out negatively will
impact my chances of actually getting it done and how fast it will get
done.
Considering how subjective IP classifications are, I will not return
NXDOMAIN for v4 addresses if there is even a small chance that it will
make my life harder at some point in the future.
Fri, Apr 21, 2023 at 07:37:49AM -0500, Chris Adams:
Once upon a time, Forrest Christian (List Account) <lists@packetflux.com> said:
> I have a feeling that I might be stepping into a can of worms by asking
> this, but..
>
> What's the current thinking around reverse DNS on IPs used by typical
> residential/ small business customers.
I don't see any benefit to programmatically-generated reverse DNS. I
stopped setting it up a long time ago now. Really, reverse DNS these
days is mostly only useful for:
- mail servers (where it shows a modicum of control and clue)
- infrastructure/router IPs (so mtr/traceroute can show useful info)
I view complete DNS coverage to be a basic function. All used addresses
should have forward and matching reverse records. This is not difficult
stuff. Bonus points for including a clli code or similar indicating the
general location of use for uses like network device interfaces, commodity
end-users, etc; also not difficult stuff.
You are tracking your allocations, right? Programmatically generating
your device configurations? So, generate DNS from that same database(s).
I view complete DNS coverage to be a basic function. All used addresses
should have forward and matching reverse records.
This is not intended as snark: what do people recommend for IPv6? I try to maintain forward/reverse for all my server/infrastructure equipment. But clients? They're making up temporary addresses all day long. So far, I've given up on trying to keep track of those addresses, even though it's a network under my direct control.
Once upon a time, heasley <heas@shrubbery.net> said:
I view complete DNS coverage to be a basic function. All used addresses
should have forward and matching reverse records.
But why? It's not like anybody can trust what's in a reverse DNS
string, even if it has matching forward. If I'm looking for
"ownership", I'm going to registries, not DNS. Since it can't be
guaranteed (or even flagged as) maintained, you can't trust any
information in that string.