Subject: Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

From: Mark Andrews <[email-masked]>
Date: Tue, 12 Aug 2008 09:46:09 +1000

> At 09:18 PM 8/10/2008, Mark Andrews wrote:
> 
> >> OK - but MX-records point to host names which point to A/AAAA records whic
> h
> >> point to IP addresses...
> >> If the bad guy is on the wire, he can intercept and replace your SMTP
> >> traffic anyway. 
> >> DNSSEC or not.
> >> 
> >> SRV-records also point to host names which...
> >
> >        DNS security is required for SMTP security to work. 
> 
> Absurd claim.

	Not really.  SMTP is not HTTPS where you know apriori which
	certificate to check for.  For SMTP you need to check the
	certificate of the mail exchanger and to find that securely
	you need DNSSEC to verify the MX record or its absence so
	you know when to use the implict MX record.

	Mark
 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>