Subject: RE: DEPLOY: DNS Record Types

From: "Jim Lyon" <[email-masked]>
Date: Mon, 13 Sep 2004 23:57:39 -0700

On Monday, September 13, 2004 at 10:39 PM, Jonathan de Boyne-Pollard
said:
 
> > The DNS resolver APIs on all Microsoft OS's don't let you
> > query for an unknown record type.
> Rubbish.
> <http://msdn.microsoft.com./library/en-us/dns/dns/dnsquery.asp>

If you're behind a firewall and you call this API with an unknown record
type, it will fail with INVALID_PARAMETER.

> If one is behind certain makes and models of firewalls, one
> cannot use EDNS, too.  Yet RFC 2671 has made it on to the
> standards track.

Yep. But RFC 2671 doesn't mandate that resolvers use it.  RFC 2671 was
carefully designed so that DNS is still usable if either the resolver or
the server doesn't understand EDNS.  I'm just asking for similar
behavior.

-- Jim Lyon

---

From: Patrik Fältström <[email-masked]>
Date: Tue, 14 Sep 2004 15:03:50 +0200

> type, it will fail with INVALID_PARAMETER.

What is the chance/risk you have some box behind a firewall, allow 
incoming traffic using port 25/TCP but disallow the box to make 
outgoing 53/UDP+TCP connections?

I.e. yes, you are correct on this limitation, but, it will in reality 
be possible for the box to send and receive DNS packets by itself IF it 
is located so it accept incoming SMTP connections over the Internet. 
And I claim enough boxes will be able to do that, and that a minority 
will have the problem.

    paf

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 14 Sep 2004 11:04:07 -0400

Patrik Fältström wrote:
> incoming traffic using port 25/TCP but disallow the box to make outgoing 
> 53/UDP+TCP connections?
> 
> I.e. yes, you are correct on this limitation, but, it will in reality be 
> possible for the box to send and receive DNS packets by itself IF it is 
> located so it accept incoming SMTP connections over the Internet. And I 
> claim enough boxes will be able to do that, and that a minority will 
> have the problem.
> 

Microsoft is planning on deploying Sender-ID on the MUA level in Outlook 
and Exchange. Either Jim or Harry mentioned before that they have a 
working prototype that uses PRA to analyze email. In these cases, the 
DNS traffic would still be blocked.

Yakov

---

From: "Eric A. Hall" <[email-masked]>
Date: Wed, 15 Sep 2004 10:01:56 -0400

> type, it will fail with INVALID_PARAMETER.

That's completely different from the original statement, and is still
insufficiently qualified -- the APIs let you do it, but Microsoft's
firewall product in particular barfs up the failure. Users that are not
behind a Microsoft firewall do not have this problem.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/