Subject: ISSUE: Possibility to use non-resolvable domain name as path-identity

From: "Charles Lindsey" <[email-masked]>
Date: Wed, 14 Feb 2007 14:56:00 GMT

Issue # requested

There were two alternative texts in Usepro-06, of which Russ arbitrarily
chose one.

This issue originally arose from a suggestion by Harald that a domain name
(e.g. foo.com) could be used as a <path-identity> even though the only
records in the DNS were at one level lower (e.g. news.foo.com,
mail.foo.com).

For sure, people are likely to do it whatever we say, but I regard it as
an undesirable practice. I therefore wish to make it a SHOULD NOT (or
rather to say it SHOULD be resolvable, to MX/A/AAAA/CNAME, in the DNS,
which amounts to the same thing).

Also, I wish to see a mention of RFC 2142, just to draw attention to its
existence. It does have the status of a draft-standard, although we have
agreed that we do not intend either to supersede/obsolete/commend it.
There were two wordings in Usepro-06, of which I would suggest

   NOTE: According to [RFC 2142], the forms "usenet@<path-identity>" and
   "news@<path-identity>" are common addresses for a news server
   administrator.

which uses a little bit of each of each. I do not want to take any position
on the relative merits of "usenet@" and "news@".

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 15 Feb 2007 07:22:25 +0100

I want a second before entering this one as an issue number.

Note: 2142 is a Proposed standard, not a Draft (of any kind). Mention of 
that standard belongs in issue #1093; it is not appropriate to raise it as 
a new issue.

--On 14. februar 2007 14:56 +0000 Charles Lindsey <[email-masked]> 
wrote:

> which uses a little bit of each of each. I do not want to take any
> position on the relative merits of "usenet@" and "news@".
>
> --
> Charles H. Lindsey ---------At Home, doing my own
> thing------------------------ Tel: +44 161 436 6131 Fax: +44 161 436 6133
> Web: http://www.cs.man.ac.uk/~chl Email: [email-masked]      Snail:
> 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K. PGP: 2C15F1A9      Fingerprint:
> 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5
>
>

---

From: Frank Ellermann <[email-masked]>
Date: Sun, 18 Feb 2007 23:22:15 +0100

Charles Lindsey wrote:
 
> This issue originally arose from a suggestion by Harald that a domain
> name (e.g. foo.com) could be used as a <path-identity> even though the
> only records in the DNS were at one level lower (e.g. news.foo.com,
> mail.foo.com).

I don't recall "one level" and I don't recall "lower".  It could be
also the opposite, a subdomain the.hide.out.example with "real" domain
out.example.

How's your example supposed to work, has foo.com no NS record ?  

> For sure, people are likely to do it whatever we say, but I regard it
> as an undesirable practice. I therefore wish to make it a SHOULD NOT
> (or rather to say it SHOULD be resolvable, to MX/A/AAAA/CNAME, in the
> DNS, which amounts to the same thing).

Why's that the same thing ?  An MX record probably won't help with !!
(aka 'match').  

An alias of 'something' doesn't guarantee that 'something' has an
address.   Talking about CNAME in a NetNews memo strikes me as wrong.

Let the spec. say that "a path-identity SHOULD be the fully qualified
domain name of the corresponding host (here news server)", and be done
with it.  If it has no IP it has a good excuse to pick 'something' else,
and then 'something' with an MX might be the second best choice, but 
maybe reality is weirder than we can imagine.

> Also, I wish to see a mention of RFC 2142, just to draw attention to
> its existence.  It does have the status of a draft-standard

No.  I'm checking facts for an implementation and interoperability
report for its promotion to DS.  The main implementation I'm aware
of is the RFCI abuse zone (postmaster is covered by better RFCs).
I've found references in RFC 2369 (mailing lists), RFC 2635 (FYI 35,
don't spew), RFC 3013 (BCP 46, ISP security), and in the approved
SIEVE vacation RFC.

> we have agreed that we do not intend either to supersede/obsolete/
> commend it.

TINW.  I certainly don't agree.

>| According to [RFC 2142], the forms "usenet@<path-identity>" and
>| "news@<path-identity>" are common addresses for a news server
>| administrator.

Yes, and according to s-o-1036 there are also two common addresses,
only different, for a total of three...

> I do not want to take any position on the relative merits of 
> "usenet@" and "news@".

...making it more interesting for admins and other affected parties,
tiny little mazes, all alike.  The proposed issue could be joined
with #1093.

Frank

---

From: "Charles Lindsey" <[email-masked]>
Date: Mon, 19 Feb 2007 16:17:24 GMT

>Note: 2142 is a Proposed standard, not a Draft (of any kind).

Sorry. My typo. Should have been "proposed-standard".

---

From: "Charles Lindsey" <[email-masked]>
Date: Mon, 19 Feb 2007 16:56:47 GMT

>also the opposite, a subdomain the.hide.out.example with "real" domain

Agreed. I had covered only half of the possible cases.

>How's your example supposed to work, has foo.com no NS record ?

I have never regarded the existence of (only) an NS record as meaning
"resolvable in the DNS".

>Why's that the same thing ?  An MX record probably won't help with !!

'match' is not nececessarily done by IP addresses. And if a site has
outgoing relayers "news1.site.example", "news2.site.example", etc, it
still might use "site.example" as its <path-identity>, but in that case I
would like to see at least an MX record for "site.example".

>maybe reality is weirder than we can imagine.

Well, since that's almost exactly what I want it to say, can I take it that
you 'second' the Issue?

>> its existence.  It does have the status of a draft-standard

s/draft-standard/proposed-standard/ of course.

>report for its promotion to DS.

I don't think 2142 is in a fit state for DS yet, particularly regarding
what it says about Netnews. The other RFCs you mention seem to recommend
adhering to it with varying degrees of strictness. We cannot be as strict
as some of them, however, because we are not requiring <path-identity>s to
be mailable. But that is no reason for total silence.

>TINW.  I certainly don't agree.

That seems to be the consensus, but feel free to raise an Issue.

>only different, for a total of three...

Though I don't think 'newsmaster' is widely used in practice - not since
2142 came out, anyway. As to whether 'news' is more prevalent than
'usenet', s-o-1036 seems to think not.

>tiny little mazes, all alike.  The proposed issue could be joined

As I said, feel free to raise it. I don't want to go further than I have
already indicated.

---

From: Frank Ellermann <[email-masked]>
Date: Mon, 19 Feb 2007 20:03:15 +0100

> I have never regarded the existence of (only) an NS record as
> meaning "resolvable in the DNS".

Okay, but nslookup foo.com would return "nothing", not NXDOMAIN,
a similar effect as for an "UUCP domain" with only an MX record.

>> An MX record probably won't help with !! (aka 'match').
 
> 'match' is not nececessarily done by IP addresses.

Yes, that's why I wrote "probably", you or Russ mentioned some
NNTP AUTH magic some days ago instead of a gethostbyname IP match.

> if a site has outgoing relayers "news1.site.example",
> "news2.site.example", etc, it still might use "site.example" as
> its <path-identity>, but in that case I would like to see at
> least an MX record for "site.example".

That's already covered by RFC 2142, [email-masked] has to
work, they need either an MX or an address with an smtpd.

>> say that "a path-identity SHOULD be the fully qualified domain
>> name of the corresponding host (here news server)", and be done
>> with it.  If it has no IP it has a good excuse to pick 'something'
>> else, and then 'something' with an MX might be the second best
>> choice, but maybe reality is weirder than we can imagine.
 
> Well, since that's almost exactly what I want it to say, can I
> take it that you 'second' the Issue?

As continuation of the #1093 saga, yes, it makes no sense to track
the in essence same issue twice.

 
> That seems to be the consensus, but feel free to raise an Issue.

#1093 already exists.  Any "let the users try to guess a responsible 
address, maybe with whois or by asking abuse@" approach, because it's
beyond admins to filter spam to a role account, that's IMHO arrogance,
unrelated to the C-word reserved for Chairs.

Frank