Subject: [dbound] New Version Notification for draft-levine-dbound-dns-02.txt (fwd)

From: "John R Levine" <[email-masked]>
Date: 6 Apr 2019 18:14:38 -0400

Since I keep saying how wonderful my wildcard dbound proposal was, I 
figure I should resuscitate it.  Here it is with TXT records rather than a 
new rrtype and a few other minor tweaks.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---------- Forwarded message ----------
Date: Sat, 6 Apr 2019 18:10:32
From: [email-masked]
To: John Levine <[email-masked]>
Subject: [taugh.com-standards] New Version Notification for
     draft-levine-dbound-dns-02.txt

A new version of I-D, draft-levine-dbound-dns-02.txt
has been successfully submitted by John Levine and posted to the
IETF repository.

Name:		draft-levine-dbound-dns
Revision:	02
Title:		Publishing Organization Boundaries in the DNS
Document date:	2019-04-06
Group:		Individual Submission
Pages:		10
URL:            https://www.ietf.org/internet-drafts/draft-levine-dbound-dns-02.txt
Status:         https://datatracker.ietf.org/doc/draft-levine-dbound-dns/
Htmlized:       https://tools.ietf.org/html/draft-levine-dbound-dns-02
Htmlized:       https://datatracker.ietf.org/doc/html/draft-levine-dbound-dns
Diff:           https://www.ietf.org/rfcdiff?url2=draft-levine-dbound-dns-02

Abstract:
    The organization that manages a subtree in the DNS is often different
    from the one that manages the tree above it.  We describe an
    architecture to publish in the DNS the boundaries between
    organizations that can be adapted to various policy models and can be
    queried with a small number of DNS lookups.

---

From: Tim Wicinski <[email-masked]>
Date: Sat, 6 Apr 2019 20:21:00 -0400

Thanks John

I remember thinking this idea is even simpler than the PSD-like proposal in
dmarc right now.

On Sat, Apr 6, 2019 at 6:14 PM John R Levine <[email-masked]> wrote:

> URL:
> https://www.ietf.org/internet-drafts/draft-levine-dbound-dns-02.txt
> Htmlized:
> https://datatracker.ietf.org/doc/html/draft-levine-dbound-dns
> Diff:
> https://www.ietf.org/rfcdiff?url2=draft-levine-dbound-dns-02
>
> Abstract:
> _______________________________________________
> dbound mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dbound
>

---

From: Scott Kitterman <[email-masked]>
Date: Sat, 06 Apr 2019 20:29:49 -0400

I think they are orthogonal.

This is about how you find the public/private boundary.  PSD DMARC is about 
when to look past it.

Scott K

---

From: "John R Levine" <[email-masked]>
Date: 27 Apr 2019 15:19:57 -0400

You may recall that we've been discussing ways to publish DNS authority 
boundaries, like the Mozilla PSL but in the DNS itself, not a text file.

I've been claiming that with careful use of wildcards one make the number 
of lookups depend on the number of boundaries, not the number of labels 
in the name being checked, so it's reliably reasonably fast.

I figured I should put my bits where my mouth is so I wrote a script to 
translate the Mozilla PSL into DNS rules.  It turned out to be harder than 
I thought because the PSL has wildcard rules with exceptions, e.g.:

*.ck
!www.ck

That turned out to be straightforward to handle with a tweak to the spec I 
just made in the -03 version.

The code to make the DNS records, and another script to take a domain name 
and look it up in those records are here:

https://github.com/jrlevine/bound

I think the lookup code is OK but there may be some glitches in the PSL 
translator for some of the more arcane combination of wildcard and 
non-wildcard boundaries.  Take a look if interested.

Regards,

PS to Scott: I think it would be pretty easy to add a tag for PSD TLDs.