Subject: [DNSOP] draft-hoffine-already-dotless

From: joel jaeggli <[email-masked]>
Date: Sat, 28 Sep 2013 08:52:22 -0700

Thought the working group might be somewhat interested in:

https://datatracker.ietf.org/doc/draft-hoffine-already-dotless/?include_text=1

in relation to:

http://www.iab.org/documents/correspondence-reports-documents/2013-2/iab-statement-dotless-domains-considered-harmful/

---

From: Dave Crocker <[email-masked]>
Date: Sat, 28 Sep 2013 14:24:39 -0700

> https://datatracker.ietf.org/doc/draft-hoffine-already-dotless/?include_text=1

The draft does not really demonstrate what it purports to demonstrate. 
Or rather, it mis-casts the problems that have been asserted for dotless 
domains.   It purports to contradict concerns about:

    "...the problems that the DNS is likely to experience with top-level 
domains..."

However there has been little question about the ability to /publish/ 
RRs under TLDs.

The question is with their usability.

And the draft offers no data that runs contrary to the IAB paper's 
concerns or the other concerns that have been raised in various public 
discussions.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Dave Crocker <[email-masked]>
Date: Sat, 28 Sep 2013 14:58:49 -0700

On 9/28/2013 2:34 PM, John R. Levine wrote:
>> Or rather, it mis-casts the problems that have been asserted for
>> dotless domains.   It purports to contradict concerns about:
>>
> I'm not aware of any language in this draft that makes such an
...
> Could you identify the specific lines or sentences you're concerned about?

First sentence of your abstract.  The SSAC report is reasonably careful 
with detailing the components likely to have problems, and its emphasis 
is with /reaching/ the TLD RRs, not with publishing them.  In fact, 
SWIW, the word 'publish' does not occur in their report.

Yet your draft solely focuses on publishing.

---

From: "John R. Levine" <[email-masked]>
Date: Sat, 28 Sep 2013 17:34:06 -0400 (EDT)

> The draft does not really demonstrate what it purports to demonstrate. Or 
> rather, it mis-casts the problems that have been asserted for dotless 

I'm not aware of any language in this draft that makes such an assertion, 
and section 4 says:

    This document lists the known dotless domains; it does not express an
    opinion whether or not there are security considerations with the
    existence of dotless domains.  The referenced IAB and SSAC reports
    discuss the opinions of the respective bodies on the security and
    stability considerations of dotless domains.

R's,
John

---

From: Paul Wouters <[email-masked]>
Date: Sun, 29 Sep 2013 21:32:01 -0400 (EDT)

> https://datatracker.ietf.org/doc/draft-hoffine-already-dotless/?include_text=1

I'm not sure I see the value of that document becoming an RFC.

Especially because the dangerous part of the dotless domain is in the
name itself conflicting with non-FQDN names, and two letter country codes
are rarely used as hostnames, unlike many of the new GTLD requested names.

The listed script uses the obsoleted host command. It should maybe use
dig +short instead :P

Paul

---

From: Tony Finch <[email-masked]>
Date: Mon, 30 Sep 2013 12:41:03 +0100

I've just done a rough deliverability test to postmaster@TLD for the TLDs
with MX records. This just checks that the RCPT TO command is accepted.
The results show that even if your site will let you send mail to these
domains, it still mostly won't work.

ai mail.offshore.ai. OK
ax mail.aland.net. BAD
cf mail.intnet.cf. BAD
dm mail.nic.dm. BAD
gp ns1.nic.gp. BAD
gp ns1.worldsatelliteservices.com. BAD
gt ASPMX.L.GOOGLE.COM. BAD
gt ALT1.ASPMX.L.GOOGLE.COM. BAD
gt ALT2.ASPMX.L.GOOGLE.COM. BAD
gt ASPMX2.GOOGLEMAIL.COM. BAD
gt ASPMX3.GOOGLEMAIL.COM. BAD
gt ASPMX4.GOOGLEMAIL.COM. BAD
gt ASPMX5.GOOGLEMAIL.COM. BAD
hr alpha.carnet.hr. OK
io mailer2.io. BAD
kh ns1.dns.net.kh. BAD
km mail1.comorestelecom.km. OK
lk malithi-slt.nic.lk. BAD
lk malithi-lc.nic.lk. BAD
mq mx1-mq.mediaserv.net. BAD
pa ns.pa. BAD
tt ASPMX.L.GOOGLE.COM. OK
tt ALT1.ASPMX.L.GOOGLE.COM. OK
ua mr.kolo.net. BAD
va raphaelmx1.posta.va. BAD
va raphaelmx2.posta.va. BAD
va raphaelmx3.posta.va. BAD
ws mail.worldsite.ws. BAD
ye mail.yemen.net.ye. BAD

Similar results for fallback-to-a:

ac BAD
ai OK
cm BAD
dk BAD
gg BAD
io BAD
je BAD
kh BAD
pn BAD
sh BAD
tk BAD
tm BAD
to BAD
uz BAD
vi BAD
ws BAD

and fallback-to-aaaa:

dk BAD

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first.
Rough, becoming slight or moderate. Showers, rain at first. Moderate or good,
occasionally poor at first.

---

From: Matthäus Wander <[email-masked]>
Date: Mon, 30 Sep 2013 15:14:22 +0200

> [...]
> [...]

You may want to consider greylisting, ua works for me. I didn't test the
other ones, though.

Regards,
Matt

-- 
Universität Duisburg-Essen
Verteilte Systeme
Bismarckstr. 90 / BC 316
47057 Duisburg

---

From: Tony Finch <[email-masked]>
Date: Mon, 30 Sep 2013 15:12:24 +0100

> You may want to consider greylisting, ua works for me. I didn't test the

Not greylisting, just an excessively short timeout at my end.
postmaster@ua appears to work if I am a bit more patient :-)

Tony.