Subject: Re: (ngtrans) The reverse lookup issue

From: Dean Anderson <[email-masked]>
Date: Mon, 8 Jul 2002 01:15:54 -0400 (EDT)

But the problem is your [wrong] _assumption_ that when forward and reverse
match, you have "identified someone responsible". You haven't done
anything of the sort. Garbage in just matches garbage out. If you have the
IP address, you will be able to find out (eg from DHCP logs) who was
assigned that IP address at a certain time, and you'll be able to find the
DHCP server owner starting from whois records. If you have only the
reverse DNS, you have nothing.  Even if the reverse matches the forward,
you still have nothing.

If your assumption were true, then reverse DNS might be warranted. But
your assumption is false, and it has proven very difficult to eradicate
that false assumption. Because of the difficulty of that eradication, and
the danger posed by the misplaced trust, in comparison with the minor
cosmetic benefits of having it, reverse DNS needs to be deprecated.

		--Dean

On Sun, 7 Jul 2002, David Terrell wrote:

> On Sun, Jul 07, 2002 at 07:10:44PM +0900, Toshi Yamasaki wrote:
> > 
> > 2)  3rd party may want to identify the source of traffic to complain about
> > spam or abuse, not  necessarily per host but per /48. What 3rd party want is
> > not the FQDN but the contact (tech-c or admin-c) of the source,  per /48.
> > Whois db is enough to get the contact.
> 
> One justification behind TCP wrappers paranoid mode (require reverse,
> require that reverse and forward match) is that whois data can
> easily become stale, but tcp wrappers will enforce that reverse DNS
> will at least identify someone responsible for the domain (because
> forward matches). 
> 
> I like being able to identify the source of traffic in my logfiles
> without having to run whois against every single entry.  This becomes
> more crucial with IPv6 (addresses are harder to remember and identify
> easily), not less.  I do not think that deprecating the reverse
> tree is warranted or acceptable.
> 
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Mon, 8 Jul 2002 13:35:16 +0000 (UCT)

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

	and the whois data get has only one instance and is always
	correct...  :)

	when forward and reverse match, you have potentially -two- 
	distinct administrative regimes that agree on the target of
	the delegation.  Based on the heirarchical nature of the DNS,
	I can follow delegation chains, increasing my confidence in 
	the answer.  

	Its not ideal, but its much stronger than a single lookup
	into a whois database. Of course both whois and dns depend
	on the integrity of the routing system. And DNS does have a
	defined method for checking the validity of a response (DNSSEC)
	while whois has no such integrity checks.

---

From: David Terrell <[email-masked]>
Date: Mon, 8 Jul 2002 10:33:21 -0700

On Mon, Jul 08, 2002 at 01:15:54AM -0400, Dean Anderson wrote:
> match, you have "identified someone responsible".

Given a reverse dns of foo-10-27-123-99.example.net and a forward that
matches, I can reasonably assume that I can email 
{root,postmaster,[email-masked] and probably reach someone who can
take care of a problem I am having with a machine; and I am more likely
to get a response from the tech contact under whois example.net than
I am from the contact in whois -a 10.27.123.99.

Whois data is far more frequently out of date; a single whois request
causes a much higher load on the whois server than a single reverse
DNS request; and most importantly there is no way for a clued person
to enforce that whois is somewhat correct when a connection is made.

> reverse DNS, you have nothing.  Even if the reverse matches the forward,

DHCP?  Are you assuming these are internal netblocks that I own?

> cosmetic benefits of having it, reverse DNS needs to be deprecated.

Just because DNS is sometimes wrong doesn't mean that it's useless.
Forward DNS is sometimes wrong, should we eradicate that too?  If
we push people off to whois, the load on whois servers will go up
exponentially and we'll end up needing to bring it back anyway.

-- 
David Terrell           | "Anyone want to start a fund for students
Nebcorp Prime Minister  | that vow not to work at MS?"
[email-masked]            |  - Libor Michalek
http://wwn.nebcorp.com/

---

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 08 Jul 2002 13:15:51 -0500

on 7/8/2002 12:15 AM Dean Anderson wrote:
> But the problem is your [wrong] _assumption_ that when forward and
> reverse match, you have "identified someone responsible". You haven't
> done anything of the sort. Garbage in just matches garbage out.

The garbage is in two different zone partitions, each of which have to be
updated at the replication master by somebody with access rights (in the
common case). So even if the hostname labels are lies, the zones will
still be correct. EG, you can make your PTR foobar.IBM.COM but if the
IBM.COM doesn't have a forward match then I'm less inclined to believe it
is true, and without access to the IBM.COM zone you'll get caught sooner
or later since I can track you down through your IN-ADDR path.

There are a bunch of security holes that make this less than 100%
trustworthy but it is perfectly reasonable as a first-pass approximation.
For large organizations with multiple netblocks, a well-managed IN-ADDR
space with double-lookups is a requirement for basic first-pass access
restriction controls.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/