Subject: Re: [dnsop] well known MTA's , smtp servers and DNS co-operating

From: Markus Stumpf <[email-masked]>
Date: Wed, 3 Dec 2003 01:17:25 +0100

Sorry to jump in late ...

On Thu, Nov 20, 2003 at 03:00:25PM -0500, Ed Lewis wrote:
> A lot of services have relied on matching forward and reverse records
> for authenitcation of the client, but this is seen as weak.  So much so
> that the "in-addr required" draft can't state this as a reason that the
> reverse map is important to have.

It is not about security in general.
It is about to have a way for an administrator to say
   this IP address is meant to run a mail agent talking to other mail agents
   accross the Internet.
or
   this IP address is *NOT* meant to run a mail agent talking to other mail
   agents accross the Internet.
That's no more secure or insecure as a MX record is. There is no identity
to be transported but merely a boolean fact.

It would solve problems with 0wned or viri contaminated machines that
are abused as spam relays.
Maybe
    http://www.space.net/~maex/draft-irtf-asrg-mtamark-00.txt
can shed some more light on that issue/the idea behind.

--------------------------

To return to a more ontopic discussion ;-)
Solutions and proposals based on information stored in DNS are an
operational issue. Without knowledge and support from DNS operators
one can write a lot of fine papers and have lengthy discussions
that will be doomed.

So, how is DNS managed today? How hard would it be to add new QTYPE
records to management interfaces, to automated software, teach support
personnel? How hard would it be if it is not a new QTYPE but TXT
records? How about SRV LHS like records, like
   _send._smtp._tcp.8.0.30.195.in-addr.arpa. IN TXT "1"

To make it clear: I'm not interested in pros and cons of such an
approach in general, but, if such an approach would make it an RFC
would it be widely accepted? Would it be too "expensive" for DNS ops?
How long would it take to populate the DNS?

Please bear with me if there are any documents I have missed. I did
a lot of search engine queries ... ;-)

IMHO this is of interest in general, not only related to antispam.
E.g. the SRV RFC has been published a long time now, but I don't see wide
use of e.g.
    _smtp._tcp.example.com	IN	SRV	100 100 25 mail.example.com.
and most MTAs IMHO don't even support it.
What is the reason for that?

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html