{"id":7251,"date":"2019-02-15T17:25:02","date_gmt":"2019-02-15T08:25:02","guid":{"rendered":"https:\/\/y2tech.net\/blog\/?p=7251"},"modified":"2019-02-15T17:47:33","modified_gmt":"2019-02-15T08:47:33","slug":"checking-own-dns-responses-after-the-dns-flag-day","status":"publish","type":"post","link":"https:\/\/y2tech.net\/blog\/inet\/checking-own-dns-responses-after-the-dns-flag-day-7251\/","title":{"rendered":"“DNS Flag Day”\u3068\u3044\u3046\u3053\u3068\u3067DNS\u30b5\u30fc\u30d0\u306e\u632f\u308b\u821e\u3044\u3092\u8abf\u3079\u3066\u307f\u305f"},"content":{"rendered":"

DNS Flag Day\u3066\u4f55\u3060\u308d\u3046\uff1f<\/h3>\r\n
\r\n

IPv6\u95a2\u9023\u306eIP\u30a2\u30c9\u30ec\u30b9\u306e\u5272\u308a\u5f53\u3066\u3084\u53d6\u5f97\u65b9\u6cd5\u306a\u3069\u306b\u3064\u3044\u3066JPRS\u3084JPNIC\u95a2\u4fc2\u306e\u30db\u30fc\u30e0\u30da\u30fc\u30b8\u3092\u8997\u3044\u3066\u3044\u305f\u3089\u3001”DNS Flag Day” \u306b\u95a2\u9023\u3057\u305fDNS\u30b5\u30fc\u30d0\u7ba1\u7406\u8005\u3084\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u7ba1\u7406\u8005\u306a\u3069\u306b\u5bfe\u3059\u308b\u6ce8\u610f\u559a\u8d77\u6587\u66f8\u304c\u76ee\u306b\u3064\u3044\u305f\uff0e\u6065\u305a\u304b\u3057\u306a\u304c\u3089\u79c1\u306f\u3053\u306e “DNS Flag Day” \u3068\u3044\u30462\u67081\u65e5\u306eDNS\u95a2\u9023\u306e\u30de\u30a4\u30eb\u30b9\u30c8\u30fc\u30f3\u306e\u4e8b\u3092\u77e5\u3089\u306a\u304b\u3063\u305f\u306e\u3067\u3001\u81ea\u5206\u304c\u904b\u7528\u3057\u3066\u3044\u308b\u500b\u4eba\u30c9\u30e1\u30a4\u30f3\u306eDNS\u30b5\u30fc\u30d0\u3084\u7d44\u7e54\u306e\u30c9\u30e1\u30a4\u30f3\u30b5\u30fc\u30d0\u306e\u5b9f\u88c5\u304c\u3069\u306e\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u308b\u306e\u304b\u78ba\u8a8d\u3057\u3066\u307f\u308b\u3053\u3068\u306b\u3057\u305f\uff0e<\/p>\r\n
\r\n

\r\n\r\n\"DNS
\r\nDNS flag day<\/span> <\/a>\r\n<\/div>\r\n
\r\n

\u5148\u305a\u306f\u3001”DNS flag day<\/a>” \u306e\u516c\u5f0f\u30db\u30fc\u30e0\u30da\u30fc\u30b8\u3092\u8997\u3044\u3066\u307f\u308b\uff0e\u3053\u306e\u30b5\u30a4\u30c8\u306f6\u30ab\u56fd\u8a9e\u306b\u5bfe\u5fdc\u3057\u3066\u3044\u308b\u304c\u3001\u6b8b\u5ff5\u306a\u304c\u3089\u65e5\u672c\u8a9e\u306f\u306a\u3044\u306e\u3067\u3001\u82f1\u8a9e\u304c\u82e6\u624b\u306a\u4eba\u306f\u3001JPRS\u3084JPNIC\u306e\u30db\u30fc\u30e0\u30da\u30fc\u30b8\u304b\u3089”DNS Flag Day”\u306e\u60c5\u5831\u3092\u62fe\u3063\u3066\u304a\u304f\u3068\u826f\u3044\u3060\u308d\u3046\uff0e<\/p>\r\n
\r\n\u3000\u30fbDNS flag day\u306e\u6982\u8981\u30fb\u5f71\u97ff\u3068\u5bfe\u5fdc\u72b6\u6cc1\u306e\u78ba\u8a8d\u65b9\u6cd5<\/a> (JPRS)
\r\n
\r\n\u3000\u30fb\u300eDNS flag day \u3067\u3059 \u300f<\/a>\uff08JPNIC BLOG)
\r\n
\r\n\u3000\u30fb\u300c512\u306e\u58c1\u300d\u3092\u8d8a\u3048\u308b\u3000~EDNS0\u306e\u6982\u8981\u3068\u904b\u7528\u4e0a\u306e\u6ce8\u610f~<\/a>\u3000\uff08JPRS \u30c8\u30d4\u30c3\u30af\u30b9&\u30b3\u30e9\u30e0\uff09\r\n
\r\n
\r\n

“DNS Flag Day”\u3092\u5927\u96d1\u628a\u306b\u8a00\u3046\u3068\u3001\u3053\u308c\u307e\u3067\u5927\u76ee\u306b\u898b\u3066\u304d\u305f\u30eb\u30fc\u30eb\u306b\u5247\u3063\u3066\u3044\u306a\u3044DNS\u30b5\u30fc\u30d0\u3084\u3044\u3044\u52a0\u6e1b\u306a\u904b\u7528\u3068\u8a31\u3057\u307e\u305b\u3093\u3088\u3068\u3044\u3046\u6c7a\u5225\u5ba3\u8a00\u306e\u65e5\u3068\u601d\u3048\u3070\u826f\u3044\u3060\u308d\u3046\uff0eDNS\u306f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u306e\u8981\u306a\u306e\u3067\u3001\u7686\u3067\u304d\u3061\u3093\u3068DNS\u3092\u904b\u7528\u3057\u3066\u884c\u304f\u305e\u3068\u3044\u3046\u6c7a\u610f\u8868\u660e\u3068\u8a00\u3063\u3066\u3082\u826f\u3044\u3060\u308d\u3046\uff0e<\/p>\r\n
\r\n

\u5b9f\u969b\u306b\u30012\/1\u304b\u3089BIND\u306a\u3069\u306e\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u3084Google\u3084MS\u306a\u3069\u306eDNS\u30b5\u30fc\u30d3\u30b9\u3001\u5927\u624b\u6a5f\u5668\u30d9\u30f3\u30c0\u30fc\u306a\u3069\u304c\u5bfe\u5fdc\u3092\u59cb\u3081\u308b\u3088\u3046\u306a\u306e\u3067\u3001DNS\u306b\u5c11\u3057\u3067\u3082\u95a2\u308f\u308b\u4eba\u306f\u4eca\u56de\u306e”DNS Flag Day”\u79fb\u884c\u306e\u52d5\u304d\u3092\u304d\u3061\u3093\u3068\u628a\u63e1\u3057\u3066\u304a\u304f\u5fc5\u8981\u304c\u3042\u308b\uff0e<\/p>\r\n
\r\n

DNS\u3068\u306e\u4fc2\u308f\u308a\u65b9\u306b\u3088\u3063\u3066\u3001
\r\n\u3000\u30fb\u5358\u306a\u308b\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u5229\u7528\u8005
\r\n\u3000\u3000\u3000\u3000\u21d2\u3000\u7279\u306b\u4f55\u304b\u3092\u884c\u3046\u5fc5\u8981\u3082\u7121\u3044\uff08Don’t Worry.\uff09
\r\n
\r\n\u3000\u30fb\u30c9\u30e1\u30a4\u30f3\u6240\u6709\u8005
\r\n\u3000\u3000\u3000\u3000\u21d2\u3000\u81ea\u5206\u304c\u6240\u6709\u3059\u308b\u30c9\u30e1\u30a4\u30f3\u3092\u30c1\u30a7\u30c3\u30af\u30b5\u30a4\u30c8\u3067\u8abf\u3079\u308b
\r\n
\r\n\u3000\u30fbDNS\u30b5\u30fc\u30d0\u7ba1\u7406\u8005
\r\n\u3000\u3000\u3000\u3000\u21d2\u3000\u30c9\u30e1\u30a4\u30f3\u30ea\u30be\u30eb\u30d0\u30b5\u30fc\u30d0\u904b\u7528\u8005\uff1a\u91cd\u8981\u306a\u30a2\u30af\u30bb\u30b9\u5148\u306e\u30c9\u30e1\u30a4\u30f3\u306e\u6319\u52d5\u3092\u524d\u3082\u3063\u3066\u30c1\u30a7\u30c3\u30af\u30b5\u30a4\u30c8\u3067
\u3000\u3000\u3000\u3000\u8abf\u3079\u3066\u304a\u304f
\r\n\u3000\u3000\u3000\u3000\u21d2\u3000\u30c9\u30e1\u30a4\u30f3\u30ea\u30b5\u30fc\u30d0\u904b\u7528\u8005\uff1a\u30c9\u30e1\u30a4\u30f3\u306e\u6a29\u5a01DNS\u30b5\u30fc\u30d0\u304c\u6b63\u3057\u304f\u5b9f\u88c5\u30fb\u904b\u7528\u3055\u308c\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092
\u3000\u3000\u3000\u3000\u30c1\u30a7\u30c3\u30af\u30b5\u30a4\u30c8\u3067\u8abf\u3079\u3001\u554f\u984c\u304c\u3042\u308c\u3070\u5bfe\u51e6\u3059\u308b
\r\n\u3000\u3000\u3000\u3000\u3000\u3000\uff08\u6700\u65b0\u7248\u3078\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3084Firewall\u8a2d\u5b9a\u306e\u898b\u76f4\u3057\u3001…etc.\uff09
\r\n\u3000\u3000\u3000\u3000\u3000\u3000”Firewalls must not drop DNS packets!!!”
\r\n
\r\n\u3000\u30fbDNS\u95a2\u4fc2\u306e\u5c02\u9580\u5bb6\uff08\u958b\u767a\u8005\u3001\u7814\u7a76\u8005\u306a\u3069\uff09
\r\n\u3000\u3000\u3000\u3000\u3000\u3000\u9811\u5f35\u3063\u3066\u304f\u3060\u3055\u3044\u306d\uff08^^)\/
\r\n
\r\n

\u3010\u5b9f\u9a13\u541b\u3011DNS\u30b5\u30fc\u30d0\u304c\u8fd4\u3059\u60c5\u5831\u3092\u30c6\u30b9\u30c8\u3057\u3066\u307f\u308b<\/h4>\r\n
\r\n\u3000\u30fb\u3053\u306eblog\u306e\u30c9\u30e1\u30a4\u30f3 “y2tech.net” (AWS Route53\u30b5\u30fc\u30d3\u30b9\uff09
\r\n
\r\n
\r\n\"y2tech.net \r\n
\r\n\u304a\u3084\u3000AWS Route53\u306f\u3061\u3087\u3063\u3068\u554f\u984c\u3042\u308a\u3068\u3044\u3046\u7d50\u679c\u306b\uff0e\uff0e\uff0e<\/span>\r\n
\r\n<\/div>\r\n
\r\n

\u4e00\u756a\u4e0b\u306b\u3042\u308b\u3001isc.org\u306e\u8a3a\u65ad\u30c4\u30fc\u30eb\u304c\u51fa\u529b\u3057\u305f\u7d50\u679c\u306e\u30ea\u30f3\u30af\u3092\u8fbf\u3063\u3066\u307f\u308b\u3068\u3001\u30a8\u30e9\u30fc\u306e\u5185\u5bb9\u3092\u78ba\u8a8d\u3067\u304d\u308b\uff0e<\/p>\r\n

\r\ny2tech.net. @205.251.198.87 (ns-1623.awsdns-10.co.uk.): dns=ok edns=ok edns1=noerror,noopt,soa edns@512=ok ednsopt=ok edns1opt=noerror,noopt,soa do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok,nsid,subnet (927967dd7b316d7ab5100673f5628c43 -)\r\ny2tech.net. @2600:9000:5306:5700::1 (ns-1623.awsdns-10.co.uk.): dns=ok edns=ok edns1=noerror,noopt,soa edns@512=ok ednsopt=ok edns1opt=noerror,noopt,soa do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok,nsid,subnet (2a8d421fe512db640f3d6793e76d8cfe -)\r\ny2tech.net. @205.251.193.17 (ns-273.awsdns-34.com.): dns=ok edns=ok edns1=noerror,noopt,soa edns@512=ok ednsopt=ok edns1opt=noerror,noopt,soa do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok,nsid,subnet (6e0a624c9e1fdd897ef163b8131386f2 -)\r\ny2tech.net. @2600:9000:5301:1100::1 (ns-273.awsdns-34.com.): dns=ok edns=ok edns1=noerror,noopt,soa edns@512=ok ednsopt=ok edns1opt=noerror,noopt,soa do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok,nsid,subnet (4af1a7c146cdc0e5211a9469210c5b10 -)\r\ny2tech.net. @205.251.197.143 (ns-1423.awsdns-49.org.): dns=ok edns=ok edns1=noerror,noopt,soa edns@512=ok ednsopt=ok edns1opt=noerror,noopt,soa do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok,nsid,subnet (4f03a5065eb1f09d963c13ec1df0ecee -)\r\ny2tech.net. @2600:9000:5305:8f00::1 (ns-1423.awsdns-49.org.): dns=ok edns=ok edns1=noerror,noopt,soa edns@512=ok ednsopt=ok edns1opt=noerror,noopt,soa do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok,nsid,subnet (d8ed5005dc9ba4d55d9f03aee377d8a5 -)\r\ny2tech.net. @205.251.194.2 (ns-514.awsdns-00.net.): dns=ok edns=ok edns1=noerror,noopt,soa edns@512=ok ednsopt=ok edns1opt=noerror,noopt,soa do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok,nsid,subnet (8c45dc40b487cc447a2257ec38384025 -)\r\ny2tech.net. @2600:9000:5302:200::1 (ns-514.awsdns-00.net.): dns=ok edns=ok edns1=noerror,noopt,soa edns@512=ok ednsopt=ok edns1opt=noerror,noopt,soa do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok,nsid,subnet (4f722db132daec1e7dc92d433ea0c060 -)\r\nThe Following Tests Failed\r\n\r\nWarning: test failures may indicate that some DNS clients cannot resolve the zone or will get a unintended answer or resolution will be slower than necessary.\r\n\r\nWarning: failure to address issues identified here may make future DNS extensions that you want to use ineffective. In particular echoing back unknown EDNS options and unknown EDNS flags will break future signaling between DNS client and DNS server. We already have examples of this where you cannot depend on the AD flag bit meaning anything in replies because too many DNS servers just echo it back. Similarly the EDNS Client Subnet (ECS) option cannot just be sent to everyone in part because of servers just echoing it back.\r\n\r\nEDNS - Unknown Version Handling (edns1)\r\n\r\ndig +nocookie +norec +noad +edns=1 +noednsneg soa zone @server\r\nexpect: BADVERS\r\nexpect: OPT record with version set to 0\r\nexpect: not to see SOA\r\nSee RFC6891, 6.1.3. OPT Record TTL Field Use\r\n\r\nEDNS - Unknown Version with Unknown Option Handling (edns1opt)\r\n\r\ndig +nocookie +norec +noad +edns=1 +noednsneg +ednsopt=100 soa zone @server\r\nexpect: BADVERS\r\nexpect: OPT record with version set to 0\r\nexpect: not to see SOA\r\nexpect: that the option will not be present in response\r\nSee RFC6891\r\n<\/code>\r\n<\/pre>\r\n
\r\n
\r\n\u3000\u30fb\u500b\u4eba\u30e1\u30fc\u30eb\u7528\u30c9\u30e1\u30a4\u30f3 “xxxxxx.net” (\u3055\u304f\u3089\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u30c9\u30e1\u30a4\u30f3\u30db\u30b9\u30c6\u30a3\u30f3\u30b0\u30b5\u30fc\u30d3\u30b9\uff09
\r\n
\r\n\"My \r\n
\r\n\u3053\u3061\u3089\u306f\u554f\u984c\u306a\u3044<\/span>\r\n
\r\n<\/div>\r\n
\r\n
\r\nxxxxxx.net. @61.211.236.1 (ns1.dns.ne.jp.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok,nsid (f8b0659f-5919-45f6-bbb3-ee0f4d79d226)\r\nxxxxxx.net. @133.167.21.1 (ns2.dns.ne.jp.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok \r\nAll Ok\r\n<\/code>\r\n<\/pre>\r\n
\r\n
\r\n\u3000\u30fb\u67d0\u516c\u5171\u7cfb\u6a5f\u95a2 “xxxxxx.jp” \uff08\u30aa\u30f3\u30d7\u30ec\u5b9f\u88c5\uff09
\r\n
\r\n\"My\r\n
\r\n\u3042\u3089\u3089\uff0e\uff0e\uff0e\u3000\u7ba1\u7406\u8005\u306b\u6559\u3048\u3066\u3042\u3052\u306a\u304d\u3083<\/span>\r\n
\r\n<\/div>\r\n
","protected":false},"excerpt":{"rendered":"IPv6\u95a2\u9023\u306eIP\u30a2\u30c9\u30ec\u30b9\u306e\u5272\u308a\u5f53\u3066\u3084\u53d6\u5f97\u65b9\u6cd5\u306a\u3069\u306b\u3064\u3044\u3066JPRS\u3084JPNIC\u95a2\u4fc2\u306e\u30db\u30fc\u30e0\u30da\u30fc\u30b8\u3092\u8997\u3044\u3066\u3044\u305f\u3089\u3001”DNS Flag Day” \u306b\u95a2\u9023\u3057\u305fDNS\u30b5\u30fc\u30d0\u7ba1\u7406\u8005\u3084\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u7ba1\u7406\u8005\u306a\u3069\u306b\u5bfe\u3059\u308b\u6ce8\u610f\u559a\u8d77\u6587\u66f8\u304c\u76ee\u306b\u3064\u3044\u305f\uff0e\u6065\u305a\u304b\u3057\u306a\u304c\u3089\u79c1\u306f\u3053\u306e “DNS Flag Day” \u3068\u3044\u30462\u67081\u65e5\u306eDNS\u95a2\u9023\u306e\u30de\u30a4\u30eb\u30b9\u30c8\u30fc\u30f3\u306e\u4e8b\u3092\u77e5\u3089\u306a\u304b\u3063\u305f\u306e\u3067\u3001\u81ea\u5206\u304c\u904b\u7528\u3057\u3066\u3044\u308b\u500b\u4eba\u30c9\u30e1\u30a4\u30f3\u306eDNS\u30b5\u30fc\u30d0\u3084\u7d44\u7e54\u306e\u30c9\u30e1\u30a4\u30f3\u30b5\u30fc\u30d0\u306e\u5b9f\u88c5\u304c\u3069\u306e\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u308b\u306e\u304b\u78ba\u8a8d\u3057\u3066\u307f\u308b\u3053\u3068\u306b\u3057\u305f\uff0e","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[7],"tags":[839,840],"class_list":["post-7251","post","type-post","status-publish","format-standard","hentry","category-inet","tag-dns-flag-day","tag-edns0"],"_links":{"self":[{"href":"https:\/\/y2tech.net\/blog\/wp-json\/wp\/v2\/posts\/7251","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/y2tech.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/y2tech.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/y2tech.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/y2tech.net\/blog\/wp-json\/wp\/v2\/comments?post=7251"}],"version-history":[{"count":2,"href":"https:\/\/y2tech.net\/blog\/wp-json\/wp\/v2\/posts\/7251\/revisions"}],"predecessor-version":[{"id":7275,"href":"https:\/\/y2tech.net\/blog\/wp-json\/wp\/v2\/posts\/7251\/revisions\/7275"}],"wp:attachment":[{"href":"https:\/\/y2tech.net\/blog\/wp-json\/wp\/v2\/media?parent=7251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/y2tech.net\/blog\/wp-json\/wp\/v2\/categories?post=7251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/y2tech.net\/blog\/wp-json\/wp\/v2\/tags?post=7251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}