Subject: [ietf-dkim] New issue: DNS Record type for SSP

From: Jim Fenton <[email-masked]>
Date: Mon, 16 Apr 2007 17:43:01 -0700

There have been many discussions regarding the choice of DNS record type
for SSP.  draft-allman-dkim-ssp proposes the use of a new RR type for
SSP records; another choice is to use TXT records with a distinct (and
likely IANA-registered) prefix.

Phill Hallam-Baker has proposed that DKIM policy be queried in two
different ways, in parallel:  (1) Prefixed query for TXT record, e.g.,
_dkimpolicy.example.com and (2) Non-prefixed query for a new RR, either
an XPTR or a new RR containing DKIM policy directly (depending on what
we decide about the XPTR proposal).  The second query allows the client
to determine that the domain doesn't exist if it receives an NXDOMAIN
error.

Argument Pro:  Allows DKIM policy to work in the absence of support for
new RRs.

Argument Con:  Twice as many queries.  Depending on where it is assumed
that DNS will not support new RR types, it may never be possible to
remove support for the TXT query.  If the problem supporting new RRs is
only with DNS publication, clients will always need to make both kinds
of queries, although at some point it may be possible to make the
queries sequential, and only making the TXT query if the query for the
new RR returns a NODATA response.  If the problem supporting new RRs is
only with DNS resolvers, it may never be possible to remove TXT records
and double-publication will always be needed.

My opinion:  Basically "Argument Con" from above (I wrote it, after
all...).  Allowing the query to make use of an NXDOMAIN response (which
means there can't be a prefix) I believe to be a useful optimization
especially in the presence of messages from non-existent domains or
subdomains; we want to handle this case efficiently because it is a
likely attack vector.

-Jim
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 17 Apr 2007 02:46:30 -0400

> subdomains; we want to handle this case efficiently because it is a

If the protocol is supportable through use of prefixed TXT records, you'll 
never move off of it.  Give up and don't bother defining the new RR type.  
It's twice as many queries for no gain.  We are near the 2nd aniversary of 
the SPF record type and it still has almost zero deployment.

I tend to think along the lines of make TXT work.  It's all you've got for 
near term deployment.  If we can wait 5 years for SSP, why bother to expend 
the resources to design it at all.

Scott K

---

From: John Levine <[email-masked]>
Date: 18 Apr 2007 02:08:29 -0000

>different ways, in parallel:

As others have noted, that's equivalent to just using the TXT record,
but with twice the queries.

If SSP needs a new RR, it needs one out of the gate.  Given that one
of its largest uses will be "this domain sends no mail", the ability
to wildcard across all one's non-existent subdomains would be rather
important, and you need a new RR to do that.

I looked at the IAB's recent document on wildcards, and I think this
is a situtation where it would agree they're OK.  This isn't a record
type that will point to a host, so there isn't the problem you run
into with wildcarded A or AAAA or even MX records.

R's,
John

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 17 Apr 2007 22:34:16 -0400

> important, and you need a new RR to do that.

Isn't the lack of an A or MX record sufficient for non-existent domains?  Do 
we really need a new protocol to tell us a non-exitent domain is dodgy?

Scott K

---

From: John Levine <[email-masked]>
Date: 18 Apr 2007 04:58:28 -0000

>Isn't the lack of an A or MX record sufficient for non-existent
>domains?  Do we really need a new protocol to tell us a non-exitent
>domain is dodgy?

The recent IAB doc points out that the most common use of wildcards is
for catchall MXes, for places that accept mail to any subdomain.  But
just because you accept mail to every possible subdomain doesn't mean
that you send mail from every possible subdomain, so you'd need an SSP
record along with the MX at the wildcard to reject mail purporting to
be from them.  You'd presumably put in explicit records for the
subdomains that do send mail.

Wildcards actually work pretty well for this purpose so long as you have
the RRs to put at the wildcard names.

Also, although you are of course right that it's extremely rare to get
legit mail from a domain that doesn't have an MX or an A, there's no
IETF standards track document I'm aware of that says that.  If you
want people to reject mail purporting to be from your domain, you need
some way to tell them that.

R's,
John