Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:77316
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.195 as permitted sender)
MIME-Version: 1.0
Date: Thu, 18 Sep 2014 16:31:33 -0400
Message-ID: <CAA8DMBtdzrkkuXyYqQwnK8DxLB0RoN_y_Hz7+A2SgKmaNaWW=w@mail.gmail.com>
To: Kris Craig <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=f46d043c7f04d11eee05035cde79
Subject: [PHP-DEV] Why does checkdnsrr() default to MX??
From: figureonecpr@gmail.com (Sanford Whiteman)

--f46d043c7f04d11eee05035cde79
Content-Type: text/plain; charset=UTF-8

ANY (*) requests are key to many DNS amplification attacks and may fail,
even if the RR you want exists when individually requested. Such requests
should be discouraged by clients, IMO. It's disappointing that PHP's
dns_get_record() defaults to ANY.

But more to the point, what is the client-side utility? You are basically
flooding yourself if you make such requests -- what exactly are you going
to do with the TXT records, NS records, the SOAs, the unknown types?  This
is just a ton of extraneous data, even if the overall payload is small.

Maybe if you're building a PHP app whose sole purpose is to troubleshoot
DNS.  But if so I would sooner fork `dig`, since most likely you are trying
to show people the results that a non-PHP app would see, so better to avoid
any PHP bugs/specialness and miss any DNS features (such as new RR types
and new DNS extensions).

I don't think there's anything particularly askew in MX being the default
for checkdnsrr() if you think of it as a cut-down generalization of
getdnsmx().  Still I can't remember the last time my PHP apps cared only
about whether an RR existed, not its value (our mail server cares about
that of course when checking blacklists, and we care when we're
troubleshooting... but not within PHP). And I've *never *wanted to get a
true/false *if there is an RR of any type, *as opposed to a true/false if
the domain exists at all in the public DNS.  Can you explain the use case?

-- Sandy

--f46d043c7f04d11eee05035cde79--