注意：2019/2/1即将实施的DNS Flag Day带来的影响

什么是DNS Flag Day:

DNS flag day是由google，ISC(BIND), PowerDNS，思科，Cloudflare等诸多国际知名DNS服务提供商联合发起的一项关于不再继续采取 "EDNS error workaround"措施的活动。

DNS flag day 背景：

EDNS是对DNS协议的扩展补充（RFC6891），必须DNSSEC，Client Sub net，支持大于512字节DNS响应等都是通过EDNS(Version=0）来实现扩展支持的。但是一直以来，很多DNS的权威域名服务器不能规范的处理EDNS扩展，导致类似google、BIND等公司或软件需要针对不能正确处理EDNS request的NS服务器再次发起不包含EDNS opt的请求（EDNS error workaround）来获得最终解析结果，虽然可以通过这种做法获得解析结果但这导致了DNS解析方面会存在很大的延迟。

从2019年2月1日起，以下知名服务商将开始不再执行上述workaround，这要求DNS系统软件提供商需要遵从RFC6891的第7章，引述如下：

7. Transport Considerations

The presence of an OPT pseudo-RR in a request should be taken as an indication that the requestor fully implements the given version of EDNS and can correctly understand any response that conforms to that feature's specification. Lack of presence of an OPT record in a request MUST be taken as an indication that the requestor does not implement any part of this specification and that the responder MUST NOT include an OPT record in its response. Extended agents MUST be prepared for handling interactions with unextended clients in the face of new protocol elements and fall back gracefully to unextended DNS when needed. Responders that choose not to implement the protocol extensions defined in this document MUST respond with a return code (RCODE) of FORMERR to messages containing an OPT record in the additional section and MUST NOT include an OPT record in the response. If there is a problem with processing the OPT record itself, such as an option value that is badly formatted or that includes out-of-range values, a FORMERR MUST be returned. If this occurs, the response MUST include an OPT record. This is intended to allow the requestor to distinguish between servers that do not implement EDNS and format errors within EDNS.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

The presence of an OPT pseudo-RR in a request should be taken as an    indication that the requestor fully implements the given version of    EDNS and can correctly understand any response that conforms to that    feature's specification.      Lack of presence of an OPT record in a request MUST be taken as an    indication that the requestor does not implement any part of this    specification and that the responder MUST NOT include an OPT record    in its response.      Extended agents MUST be prepared for handling interactions with    unextended clients in the face of new protocol elements and fall back    gracefully to unextended DNS when needed.      Responders that choose not to implement the protocol extensions    defined in this document MUST respond with a return code (RCODE) of    FORMERR to messages containing an OPT record in the additional    section and MUST NOT include an OPT record in the response.      If there is a problem with processing the OPT record itself, such as    an option value that is badly formatted or that includes out-of-range    values, a FORMERR MUST be returned.  If this occurs, the response    MUST include an OPT record.  This is intended to allow the requestor    to distinguish between servers that do not implement EDNS and format    errors within EDNS.

带来的影响：

DNS管理员应采取的措施：

使用如下网站进行对域名进行检查
https://dnsflagday.net/

该测试的测试逻辑如下：

结果中真正需要关注的是测试项结果为timeout的，但是需要注意鉴别这些timeout的测试项自己是不是真的很在意（比如是否是因为测试网络不稳定导致的或者测试案例中的的方法是不是对自己有意义）

总体建议考虑以下几个方面问题：

1. DNS服务器前的防火墙有无丢弃 包含 EDNS OPT的请求或响应包
2. DNS服务系统本身是否已经正确配置EDNS支持
3. DNS服务系统提供商是否已经提供解决dns flag day的相关补丁或版本

如果网络限制了该测试网站的访问，可以使用https://gitlab.labs.nic.cz/knot/edns-zone-scanner 这个测试工具

F5 DNS/GTM客户如何处理：

如果你没有特别的其它设置，理论应能够通过检查。提示如下：

1. 如果已经启用了DNS cache或DNS express的用户，针对检查报告中的任何疑问，建议联系F5 support获得具体建议和支持
2. 关注F5官方对此的更新https://support.f5.com/csp/article/K07808381

不处理后果会很严重吗？

EDNS目前依然不是强制支持项，企业可能本来就拒绝EDNS，同时也不会全球所有的public dns都会实施 DNS flag day，根据企业的解析来源属性不同，以及企业所用的DNS系统对RFC6891标准遵从行不同（The software does not need to support EDNS(0) extensions but must respond correctly when asked according to EDNS standard section 7），影响结果可能不会那么大，但还是需要注意目前ISC，google，cloudflare都明确表示会执行，因此可以预见越来越多的Public DNS会执行上述行为。

建议在上述检查网站的报告结果中，对于edns1为例进行测试的其结果为timeout的可以不关注，dnssec,tcp测试项根据自己是否本身就支持来判断，其它的几个测试不要有timeout结果. 

有意的是，目前Google也还没做到完全OK的测试结果：

google.com. @216.239.38.10 (ns4.google.com.): dns=ok edns=noopt edns1=ok edns@512=noopt ednsopt=noopt edns1opt=ok do=noopt ednsflags=noopt docookie=nooptedns512tcp=noopt optlist=ok,subnet