Subject: [Asrg] Final(?) draft of DNSwL draft

From: John L <[email-masked]>
Date: Fri, 27 Jul 2007 23:40:04 -0400 (EDT)

I got some review comments back from the IRTF on the DNSwL draft, so I've 
done another version:

 	http://asrg.sp.am/draft-irtf-asrg-dnsbl-03.txt

Please take a look, if nobody hates it I'll send it off on Monday.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor
"More Wiener schnitzel, please", said Tom, revealingly.

PS: The comments said:

> I have done a review of this document.  I think it could use a bit
> more attention in section 2.3.  This section mentions an
> "organization" may use a variety of DNSxLs for different purposes.
> I believe this statement can be expanded and made more clear.  In
> particular, the next sentence discusses "multiple sublists", but no
> definition has yet been given for just what that is, and how it
> relates to an organization and its variety of DNSxLs.  In the next
> paragraph it mentions subdomains and sublists.
> 
> I think with another pass on this part {and a definition for the term rDNS
> in 2.1} and the doc would be ok.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "william(at)elan.net" <[email-masked]>
Date: Fri, 27 Jul 2007 22:11:53 -0700 (PDT)

In security consideration should say more then just DNS service
subjected to various types of attacks, I'd like to see on that
line that without DNSSEC the response is not authenticated and
DNS being UDP service, it means it can easily be forged by 3rd
party. DNS security issues are really the most important so that
paragraph should go first either way. In prior paragraph of security 
section at the end of it gives reference to "[5,6]", I really
dont see anything in "[6]" that is relevant.

And while this may not be exactly right doc, I think it should be 
mentioned that if for some reason domain expires and it is in TLDs
that has wildcard entries, that would cause equivalent to all listed 
response.  However these would then not be 127.0.0.1 so it should
say somewhere that clients SHOULD only use entries in blacklist that
are in 127/8 range (rather then just check if there is any A record
at all as some are doing) and ignore all others unless list
documentation says otherwise.

Also in general it should say that while DNSxL use is primary
centered around email, the method described is general and also
used by other applications (in fact consider even changing
title and removing "for E-Mail" at the end) as way to verify
that certain ip address or domain zone is or is not in some list.
Examples of where its heavily used outside of email are 
ip->country lists which are used by all types of applications
from weblog & security analyzers to real-time HTTP apps.
And DNSBL lists that are used for email blocking also found
use in blocking of unwanted web comments spam, etc (this is
similar to email blocking but point is its not email).

---

From: Matthias Leisi <[email-masked]>
Date: Sun, 29 Jul 2007 02:43:37 +0200

John L wrote:
> I got some review comments back from the IRTF on the DNSwL draft, so
> I've done another version:
> 

ad 5) Security Considerations:

The use of DNSWLs to override any DNSBLs (or other criteria, also in a
scoring mechanism) is only as reliable as the underlying transport
mechanism (ie unreliable for DNS-over-UDP, especially over non-local links).

- -- Matthias

- --
http://www.dnswl.org/

---

From: John Levine <[email-masked]>
Date: 29 Jul 2007 02:04:26 -0000

>The use of DNSWLs to override any DNSBLs (or other criteria, also in
>a scoring mechanism) is only as reliable as the underlying transport

It already says that they're subject to the usual DNS attacks.  I don't
see the point of adding this disclaimer.

R's,
John

---

From: John Levine <[email-masked]>
Date: 29 Jul 2007 02:04:26 -0000

>The use of DNSWLs to override anyFrom [email-masked] Sat Jul 28 22:04:36 2007
Date: 29 Jul 2007 02:04:26 -0000
From: John Levine <[email-masked]>
To: [email-masked]
Subject: Re: [Asrg] Final(?) draft of DNSwL draft
Organization: 
Cc: [email-masked]
Reply-To: Anti-Spam Research Group - IRTF <[email-masked]>

R's,
John

---

From: John Levine <[email-masked]>
Date: 29 Jul 2007 02:04:26 -0000

R's,
John

 DNSBLs (or other criteria, also in

R's,
John

---

From: Jim Fenton <[email-masked]>
Date: Sun, 29 Jul 2007 22:35:04 -0700

Based on a very quick read:

Reference [3] should probably point to something at Trend; the page at
mail-abuse.com looks like a temporary redirect.

Section 2.1 refers to the address values used "may have other values as
described below" but, aside from some discussion of how values may be
logically ORed, I didn't find this.  If there isn't a consistent set of
meanings, please say so.

Section 2 should also have some discussion of the operational problems
associated with DNSxLs, such as the problem that one has if one is
received an allocation for a "tainted" IP address.  There is no
consistent means of getting off all the DNSBLs that people use. You
might also mention how many DNSBLs there are.

Section 3 should mention the need for some sort of email authentication
in order for the domain name to be meaningful.

-Jim

---

From: John Levine <[email-masked]>
Date: 30 Jul 2007 18:42:19 -0000

>mail-abuse.com looks like a temporary redirect.

It's been like that for a couple of years, don't think it's likely to
change.

>logically ORed, I didn't find this.  If there isn't a consistent set of

Clarified that I'm referring to the section

>Section 2 should also have some discussion of the operational problems

I'm trying to keep all the operational stuff in the companion BCP.

> You might also mention how many DNSBLs there are.

How could anyone tell?  They pop up and disappear dailt.

>in order for the domain name to be meaningful.

Actually, the most common use of domain name DNSBLs is for the names
found in URLs in the bodies of spam, which doesn't need any
authentication.

Authentication only matters if you're whitelisting by sender, but I
don't know of anyone using DNSWLs for that.

R's,
John

---

From: John Levine <[email-masked]>
Date: 30 Jul 2007 18:42:19 -0000

R's,
John

---

From: Jim Fenton <[email-masked]>
Date: Mon, 30 Jul 2007 12:17:50 -0700

> How could anyone tell?  They pop up and disappear dailt.

The point wasn't a specific number, but rather that there are a lot of
them.  But maybe this is an operational concern, out of scope for this
document.
> found in URLs in the bodies of spam, which doesn't need any

It isn't at all clear that section 3 is talking about URLs.  On the
contrary, the example of [email-masked] is clearly not a URL, and the
term "right hand side blacklist" doesn't sounds like a URL either.  Side
note:  the document will be dinged for using anything other than RFC
2606 hostnames in examples.

> don't know of anyone using DNSWLs for that.

We hope this will change with the wider deployment of authentication.

-Jim

---

From: John Levine <[email-masked]>
Date: 30 Jul 2007 20:28:47 -0000

>term "right hand side blacklist" doesn't sounds like a URL either. 

I suppose you're right.  If there's another pass, I'll say something
about the results only being as reliable as the data.

> Side note: the document will be dinged for using anything other than
>RFC 2606 hostnames in examples.

I fixed that, it's all example.com/org/net now.

>We hope this will change with the wider deployment of authentication.

Some of us hope they will use VBR, which is sort of a DNSWL but
slightly more flexible.

R's,
John

---

From: Douglas Otis <[email-masked]>
Date: Mon, 30 Jul 2007 13:33:47 -0700

On Jul 30, 2007, at 11:42 AM, John Levine wrote:

>> Reference [3] should probably point to something at Trend; the  
>> page at mail-abuse.com looks like a temporary redirect.
>
> It's been like that for a couple of years, don't think it's likely  
> to change.

It might at some point.  The Trend Micro domain is more likely to  
remain as a permanent reference.

-Doug

---

From: Barry Shein <[email-masked]>
Date: Tue, 31 Jul 2007 01:19:33 -0400

Far be it for me to flog a dead horse but aren't you two speaking past
each other? Unreliable isn't the same as insecure.

That said, I don't think one generally needs to repeat something like
that in a context like this; it should be tacit.

-- 
        -Barry Shein

The World              | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 800-THE-WRLD        | Login: Nationwide
Software Tool & Die    | Public Access Internet     | SINCE 1989     *oo*

---

From: "David Nicol" <[email-masked]>
Date: Tue, 31 Jul 2007 09:51:41 -0500

> that in a context like this; it should be tacit.

If everything that should be tacit was left out, there wouldn't be much left
AFAICT.  In general.  Redundancy is good, especially in introductory
material.  Same message in different forms.  Few people have well
organized schema that integrate new data on the first pass.

Complaints off-list please.