DNS Flag Day: We’re buckled in over here

Topic

New Reply

February 1 is DNS Flag Day – a day when the people who support the internet’s lookup pages (think phone book — if you’re old enough to remember what
[See the full post at: DNS Flag Day: We’re buckled in over here]

4 users thanked author for this post.

AlexEiffel, Moonbear, PhotM, Elly

Reply | Quote

Replies

Do everyday internet users have anything to worry about? I ask because if any of my older family members lose their internet, I’ll be fielding panicked phone calls all day. All I really need is for someone to tell me exactly what about DNS is being changed.

Reply | Quote

The anonymous post above this is mine. I also appear to have erased the last part of my question before I posted it. What I was trying to ask was this: All I really need is for someone to tell me exactly what about DNS is being changed so if I need to I can explain that nobody needs to run out and buy a new router, just hopefully change a setting.

Reply | Quote

You should not have to do anything as it is for the external internet, however at least I do not believe right now it would affect home routers. If anybody knows otherwise…?

The best I could tell you is to do is explain it or if they are not interested in any technical details…

• The building directory is missing location information.
• Just tell them the telephone book has some permanently missing pages.

Make the explanation something they can relate to, in case stuff breaks tomorrow.

Read this section about standards compliance, https://dnsflagday.net/#dns-admins

Reply | Quote

Thank you, that’s probably just what I’ll tell them if need be. Considering how big this is, if it was going to effect user hardware I would’ve expected the tech news site to all be encouraging everyone to buy new gear. To be perfectly honest, before this post went up, I had never heard of DNS flag day before so hopefully we won’t even notice.

Reply | Quote

From my understanding of the issue, some DNS providers won’t accept non-standard replies from up-stream DNS providers.  It *may* interfere with resolving the IP addresses of certain clients (websites) of the non-compliant DNS providers.

My DNS server is Quad9 which is part of all of this Flag day.  If I find I can’t get to places I want to get to, I’ll cut DNS resolution over to someone who will get me to that place.

If I find that a site that handles my money isn’t reachable, well, that will cause an issue between me and a site that handles my money, not Quad 9.

I’m not expecting any problems.

Reply | Quote

So, this is only happening today and we’ll just have to wait until tomorrow for it to go away?

Group B, with Windows 7 Pro SP1 x64 — and clueless sole administrator of my very own PC.

Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

Reply | Quote

“So, this is only happening today”

Uh no, absolutely not.

EDIT html to text

Reply | Quote

Well, that’s cute. Thanks a lot.

So DSN February 1st Flag Day lasts for how many days? It looks from Woody’s description like some kind of seriously off-season, but already expected to happen Spring Cleaning Day in the Internet. Perhaps someone would care to provide now a full answer to my question? I am not asking for the fun of it. Either this is something worth worrying about for people like me, or just a conversation between those inclined to discuss interesting technical minutiae. So which is it?

Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

Reply | Quote

OscarCP wrote:

So DSN February 1st Flag Day lasts for how many days? It looks from Woody’s description like some kind of seriously off-season, but regularly occurring, Spring Cleaning Day in the Internet.

“Flag Day” usually means it’s the date for a permanent change or a start date, I understand… some of those might be regularly occurring.

This one certainly is intended to be the start of a one-time permanent change in the technical internals of internet name services, coordinated to happen on a specific date by various big names in that business. The change will propagate gradually and not all at once, and due to the decentralized nature of Internet there can be no projected 100% completion date.

It “SHOULD” only be an issue for a small subset of network techs and NOT affect end users directly at all.

However, since the technical details involve reduced support for things that according to the standards shouldn’t happen anyway… well, there’s a small risk of probably temporary outages of specific services, and an even smaller risk of having to replace or update specific kinds of noncompliant devices. (Though, Windows Server is apparently on that list, if configured in specific ways – Microsoft says they may provide updates later.)

3 users thanked author for this post.

jburk07, Chris B, OscarCP

Reply | Quote

Flag days on the internet are advertised days when something changes from one standard to another.

In this particular case, DNS worldwide has been working in compatibilty mode for 10 years. A required feature was added to the DNS standard but, in case a server doesn’t support it, workarounds were in place. The problem is these workarounds are a security risk (you can exploit them to do nasty things to people).

On this flag day, the internet will switch from working around the lack of this feature in non-compatible servers to just calling them broken. From now on, any DNS Server that doesn’t support this required feature will not be considered a valid DNS Server.

3 users thanked author for this post.

jburk07, OscarCP, b

Reply | Quote

It “SHOULD” only be an issue for a small subset of network techs and NOT affect end users directly at all.

That is not necessarily the case. Many servers, and some of us home users, run Ubuntu and its fellow Linux distros.

There is a long-standing bug in Ubuntu since 16.04, extending into Ubuntu 18.04, relating to DNS Name Resolution within the operating system. This bug is unique to Ubuntu and its derivatives.

See:

A name resolution issue with systemd-resolved we found in the wild

https://moss.sh/name-resolution-issue-systemd-resolved/

systemd-resolved: RRSIG format error unless EDNS is disabled #9241

https://github.com/systemd/systemd/issues/9241

systemd-resolved times out if other nameservers in /etc/resolv.conf and a query fails #9243

https://github.com/systemd/systemd/issues/9243

This resulted in my Claws Mail email client failing to reach Comcast POP3 and IMAP servers in late-November, 2018:

systemd-resolved can’t resolve Comcast mail server addresses

https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1805027

I assure you, many more than 11 people were affected, and the topic was not resolved in Comcast’s own user to user forums. I myself was on the phone with three different Comcast technical support people before I finally found the Comcast Forums and Ask Ubuntu complaint threads about this bug.

To my knowledge, Ubuntu 18.04 and Ubuntu 18.10 have not as of this date reprogrammed systemd-resolved to behave properly.

This Flag Day may (one would hope!) serve as a wake-up call to Canonical’s developers to get off their tushies and fix this bug.

In the meantime, we Comcast users with desktop Ubuntu Linux or Linux Mint email clients must muck about with finding the true server names and ip addresses, and manually adding them to our Ubuntu Hosts File for each service for which systemd-resolved fails to resolve the server redirect.

The same issue struck me this morning when I tried to use Firefox under Ubuntu 18.04 to update some Gnome Shell Extensions. The Gnome Shell Extensions server could not be resolved initially, until some Ubuntu updates were applied. None of them addresses the underlying bug, as BIND9 was not part of the name of any of the current Ubuntu updates.

So this Flag Day does have serious implications for a subset of Ubuntu and Mint Linux users.

-- rc primak

1 user thanked author for this post.

jburk07

Reply | Quote

rc primak wrote:

So this Flag Day does have serious implications for a subset of Ubuntu and Mint Linux users.

The serious implication for you being that your six-month-old Linux issue may get fixed without you having to do anything?

 

Reply | Quote

Indeed, according to https://launchpad.net/ubuntu/+source/systemd/237-3ubuntu10.12 the fix for this is in the pipeline, and should be installable already if you want to use “preview” patches

Meanwhile, on my own systems I’ll just override systemd-resolved for consistency of operation anyway. At least dnsmasq can be made to behave…

(“Back in my day, we wouldnt’ get to use newfangled things like DNS for production applications, just too unreliable you know… sure you can do a DNS query, but then you need to sanity check it by eyeball, and then add to /etc/hosts if it’s good enough…”)

Reply | Quote

Following these instructions, I was able to test my router for internal network compliance.

Opinion: Systemd probably should have stayed in the data center where it belonged, there did not seem there was anything wrong with the old Init system. Configuring a service thing can be equally cause confusion and requires practice.

Reply | Quote

I’m not clear on this point.

Is the underlying issue being fixed? I have read nothing which indicates it is being fixed for Ubuntu 18.04.

And it’s much more than a six-months long issue. This goes back two years.

I may have to wait until the actual patches arrive through normal software update channels. If this is indeed in the pipeline, it shouldn’t take very long for the patches to arrive.

-- rc primak

Reply | Quote

Well, my link above is specifically the systemd-resolved patch for 18.04 – should expect it to get out of “proposed” (as in the last testing phase before the general updates pool) some time next week.

The alternative is to do what I did and just not use systemd-resolved; dnsmasq is one of the other possible components for that role.

… yeah, I disagree with many of the design decisions involved with systemd, but then again…

1 user thanked author for this post.

rc primak

Reply | Quote

For the next week or so I can still rely on the /etc/hosts solution for my Comcast email client issue. That has worked so far, and when the patches arrive, it won’t matter anymore. Thanks for the updates and the links.

-- rc primak

Reply | Quote