Subject: Re: SPF I-D for review: draft-schlitt-spf-classic-00.txt

From: John Levine <[email-masked]>
Date: 13 Jan 2005 16:49:05 -0000

>> I would surmise that none of your clients use djbdns as their DNS
>> software.  Its cache does correct negative caching, but it doesn't
>> return SOA records as additional or authority data.  You don't have to
>> like djbdns, but enough people use it that you can't wave it off.
>
>It is likely that my code has not been tested on djbdns, but doing
>digs by hand, I could not find any problems.  Pobox.com uses tinydns
>and checking ns1.rightbox.com seems to return SOA records just fine.
>
>Could you please give me some more details?

Tinydns is the server, which returns SOA.  Dnscache is the cache,
which does not, e.g., using my local cache:

$ dig mail.iecc.com a  

; <<>> DiG 8.3 <<>> mail.iecc.com a 
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUERY SECTION:
;;      mail.iecc.com, type = A, class = IN

;; ANSWER SECTION:
mail.iecc.com.          23h54m28s IN A  208.31.42.99

;; Total query time: 127 msec
;; FROM: xuxa.iecc.com to SERVER: default -- 208.31.42.32
;; WHEN: Thu Jan 13 11:39:33 2005
;; MSG SIZE  sent: 31  rcvd: 47

$ dig mail.iecc.com txt

; <<>> DiG 8.3 <<>> mail.iecc.com txt 
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUERY SECTION:
;;      mail.iecc.com, type = TXT, class = IN

;; Total query time: 69 msec
;; FROM: xuxa.iecc.com to SERVER: default -- 208.31.42.32
;; WHEN: Thu Jan 13 11:39:29 2005
;; MSG SIZE  sent: 31  rcvd: 31

Normal clients ignore the authority section, so dnscache doesn't
include it.

I don't know anyone who runs a promiscuous dnscache, but if you want
to send me a set of IPs you use, I'd be happy to give you access to
mine for testing.

>> Beyond the faux wildcard issue, there are some other DNS issues with
>> SPF that I'm wondering about.  The most serious is the blizzard of
>> requests that interpreting SPF records can require.
>
>This is also a large concern of mine.  Have you read the current I-D?
>In particular, the processing limits for the number of DNS requests?

Yes.  That's why I mentioned the mysterious failures.  You set up your
SPF to include:bigisp.net, you test it, it works great.  Then
bigisp.net rearranges its mail servers, adds another couple of lookups
to its SPF, and now your SPF has stopped working.  That doesn't strike
me as robust design.

>In practice, very few domains come even close to the process limits.
>(I have done surveys of all SPF records in the .com, .net and .org
>domains.  Results from the surveys were posted on the MARID list.)

Indeed, but "this fixed limit is plenty big" has led to grief more
times than I can count.  It's a KICK ME sign.

>> there anything helpful one could say other than suggesting that they
>> take the bushiness out?
>
>You mean by removing the include: and redirect= mechanisms?  That
>would be a huge incompatiblity, and wouldn't by itself solve the DoS
>problems.

My suggestion has always been that you run the big complicated set
calculations when you construct your SPF record, and then publish the
set of IPs that it finds.  If the result of the calculation changes,
you rerun it and update your DNS data.  That's what my FSP strawman did.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "william(at)elan.net" <[email-masked]>
Date: Thu, 13 Jan 2005 16:07:43 -0800 (PST)

I've gone through list of all popular dns servers listed at 
http://mydns.bboy.net/survey/ and tested if they return SOA with
NODATA or not. For the servers that have at least 0.1% market
penetration (BIND8, BIND9, djb TinyDNS, Microsoft DNS, MyDNS,
PowerDNS, SimpleDNS+, PlantDNS, UltraDNS, NSD) - they all do!.

John points an interesting picture of how it works different with dns 
caching servers so I'd like to know if there is a webpage that lists 
different caching servers implementations so I could do more tests
(as well as if there is way to find location for at least one of
 those caching servers - i.e. like fpdns helped me to locate dns
 servers to test on)