Subject: Re: [ietf-dkim] [dkim] #10: Error in Appendix C. Creating a Public Key

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 14 Apr 2011 15:35:02 -0700

> -----Original Message-----
> From: dkim issue tracker [mailto:[email-masked]]
> Sent: Thursday, April 14, 2011 7:04 AM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> Subject: [dkim] #10: Error in Appendix C. Creating a Public Key
> 
> #10: Error in Appendix C. Creating a Public Key
> 
>  http://mipassoc.org/pipermail/ietf-dkim/2011q2/015812.html
> 
>  For appendix C, I believe the example for the public key DNS record is
>  missing the complete subdomain. It has brisbane where it should be
>  brisbane._domainkey
> 
>  Text change to consider:
> 
>     This public-key data (without the BEGIN and END tags) is placed in
>     the DNS as a TXT record subdomain using the selector (i.e. brisbane)
>     plus "._domainkey" like so:
> 
>     brisbane._domainkey IN  TXT  ("v=DKIM1; p=".....")

I don't think this clarifies anything in particular.  If the zone file is for a domain itself, this makes sense, but the text as-is is just fine if the zone file is for _domainkey.<domain>.  I've seen it done (and have done it) using both designs, so both are equally correct.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Thu, 14 Apr 2011 20:59:38 -0400

I was going to raise the same issues, including maybe suggesting to 
thrown in a Microsoft "how to" generate keys to complete the picture. 
  But I didn't think you wanted to go there or get into the zone 
format (Bind vs Microsoft?), or even suggest to take it out and make 
it more general - "Create a subdomain using the format described in 
section x.y."

If anything, I like the idea to help Windows people how they can 
create keys using OS cert tools, which I am not sure off hand if its 
part of the OS or comes with installation of SDKs.

I would probably throw in some text about the domains that need to do 
this via their ISP - "add this subdomain and TXT line using your ISP 
DNS Manager setup"

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

---

From: "John R. Levine" <[email-masked]>
Date: 15 Apr 2011 11:25:40 -0400

Agree with Murray, there's nothing to fix here.

> I don't think this clarifies anything in particular.  If the zone file is for a domain itself, this makes sense, but the text as-is is just fine if the zone file is for _domainkey.<domain>.  I've s…

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 15 Apr 2011 08:51:26 -0700

> From: John R. Levine [mailto:[email-masked]]
> Sent: Friday, April 15, 2011 8:26 AM
> To: Murray S. Kucherawy
> Subject: Re: [ietf-dkim] [dkim] #10: Error in Appendix C. Creating a Public Key
> 

Also, there's precedent in the RFC series for referring to the BIND zone file format (RFC1034), so including an example of that seems appropriate.

---

From: Dave CROCKER <[email-masked]>
Date: Fri, 15 Apr 2011 09:11:53 -0700

> Also, there's precedent in the RFC series for referring to the BIND zone file format (RFC1034), so including an example of that seems appropriate.

Meta-point:

We should not be trying to fix hypothetical weaknesses in the document.  We 
should only be fixing clear and acknowledged documentation errors.

Refinements that might have been worth exploring during initial document 
development are not appropriate here, absence feedback from the community that 
existing text is significantly problematic.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Fri, 15 Apr 2011 15:25:39 -0400

Sure there is.  There is an unwritten if condition for it to be 
incorrect or correct.  Add the condition and then there is "nothing to 
fix" further. It could be as simply as adding:

     The following assumes you already have a zone file for 
_domainkey.<domain>

The thing is WINDOWS DNS admins are going to see ZONE FILES with records

      brisbane._domainkey

so the example for them will be:

      brisbane._domainkey  TXT ("v=DKIM1; p=".....")

note there is no IN word.

John R. Levine wrote:
>> I don't think this clarifies anything in particular.  If the zone file 
>> is for a domain itself, this makes sense, but the text as-is is just fine 
>> if the zone file is for _domainkey.<domain>.  I've seen it done 
>> (and have done it) using both designs, so both are equally correct.