What is DNS flag day?

12/20/2019 5 6582

DESCRIPTION:

"DNS Flag Day is an initiative by the DNS Community to deprecate and remove support for an older DNS workaround that DNS vendors have been using for years. The goal is to make DNS software a little less complex, easier to maintain, have more predictable behavior, and improve performance.

In this case, the changes are related to how DNS query timeouts occur. In the past, DNS resolvers, when encountering a timeout from an authoritative, would retry the DNS query without EDNS being enabled. Starting on February 1, 2019, EDNS will not be disabled by major public DNS resolvers and vendors when DNS query timeout occurs. This means if your Authoritative DNS servers do not respond properly to DNS queries that utilize EDNS, the DNS query will effectively timeout."

The SonicWall Solution for SMA1000 regarding DNS Flag Day

A DNS request handling routine in the GTO SMA firmware can fail during processing of a very specifically formatted DNS request type resulting in the affected node being unable to process GTO name resolution requests. This issue is relevant only to appliances participating in a Global High Availability cluster - all other appliance deployment models are unaffected. The code in question has been carefully analyzed and a targeted fix that eliminates the problem from occurring has been developed and delivered via this hotfix release.

When a GTO service name served by an unpatched GTO SMA is tested with the DNS Flag Day test tool, the problem described above may be observed. Further, it should be noted that the results from the DNS Flag Day test tool on a properly patched GTO SMA will report an error that indicates that the “EDNS – over TCP Response” test has timed out. This is an expected result as these GTO SMAs do not currently support or require DNS via TCP – which has no impact on their operations but does cause the test itself to fail. This will NOT result in such GTO SMAs being unavailable after Feb 1. However, SonicWall is currently developing updates that will eliminate these test failures and set the system up for proper operation with all future DNS operations.

Learn more about DNS Flag Day.