Subject: RE: DNS pollution

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 23 Oct 2006 19:25:42 -0700

> I agree.  For me personally, this was not hypothetical.  The 
> Pine mail user agent that I use began to intermittently fail 
> to connect to the IMAP server even when there was no evidence 
> of problems with network connectivity.  The problem turned 
> out to be DNS fraud.
> 
> I use ssh to connect over DSL service from Earthlink, and 
> port forwarding to get to the IMAP server.  That means Pine 
> needs to connect to 127.0.0.1 on the forwarded port number.  
> I don't know why, but Pine does a DNS lookup on 127.0.0.1.  

Stop right there. You have a buggy application. You loose. Tough.

If you have buggy applications you should fix them. You should not raise the buggy behavior at the IETF, ICANN or inter-ISP level as an urgent problem.

There is limited bandwidth and much better things for all these bodies to be doing with their time.

We have a real problem with Internet Crime that is causing rather more problems than your buggy mailer.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Mark Andrews <[email-masked]>
Date: Tue, 24 Oct 2006 13:43:17 +1000

> If you have buggy applications you should fix them. You should not raise the 
> buggy behavior at the IETF, ICANN or inter-ISP level as an urgent problem.
> 

	Actually if you had read the followup this was not a
	application error but a operator error.  Operator errors
	are exactly what this misbehaviour depends on.  This a
	perfectly good example of unexpected consequences.

	Note this also breaks the expectations of RFC 1123

           If a dotted-decimal number can be entered without such
           identifying delimiters, then a full syntactic check must be
           made, because a segment of a host domain name is now allowed
           to begin with a digit and could legally be entirely numeric
           (see Section 6.1.2.4).  However, a valid host name can never 
           have the dotted-decimal form #.#.#.#, since at least the
           highest-level component label will be alphabetic.

	This implies that entering a address query for #.#.#.# will
	NOT return a RRset.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Tue, 24 Oct 2006 01:23:27 -0400

> 	This implies that entering a address query for #.#.#.# will

except that resolver libraries routinely tack on a domain suffix before 
sending the query.  so the query isn't for #.#.#.#, it's for 
#.#.#.#.some-domain.com.  and this is actually part of the problem.   in 
my experience, earthlink's servers often (correctly) don't respond for 
queries for a particular domain without the suffix, but do respond with 
bogus RRs for queries that have the suffix tacked on.  I'm not sure why 
the servers act differently between the two cases, but I've seen it 
happen enough to make me think there's a real correlation.

Keith