Subject: Email Authentication - Minimizing the Risk to DNS

From: David MacQuigg <[email-masked]>
Date: Thu, 28 Apr 2005 12:45:40 -0700

I'm preparing a draft for IETF.  Before submitting it, I would like to get 
some feedback from people familiar with DNS.  I've had some discussion on 
lists with email-authentication experts, but it is hard to get good answers 
on questions like - What are the problems with putting authentication 
records in their own subdomain, like _AUTH.example.com?  How do we set up 
these records so they are no more of a problem than any other services 
supported by DNS.

Abstract
Consolidating email authentication information into one DNS record at a 
standard location can avoid the threat of abuse facing IP-based 
authentication methods.  A simple, general record syntax can provide for 
the use of any authentication method or domain-rating service and 
facilitate changing methods, should that become necessary.

The current draft is at 
http://purl.net/net/macquigg/email/draft-macquigg-authent-dns.htm

Comments and suggestions will be appreciated.

--
Dave

************************************************************     *
* David MacQuigg, PhD     email: david_macquigg at yahoo.com     *  *
* IC Design Engineer            phone:  USA 520-721-4583      *  *  *
* Analog Design Methodologies                                 *  *  *
*                                 9320 East Mikelyn Lane       * * *
* VRS Consulting, P.C.            Tucson, Arizona 85710          *
************************************************************     *

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David MacQuigg <[email-masked]>
Date: Fri, 29 Apr 2005 11:44:40 -0700

That abstract was a bit terse.  I should have included the 
Introduction.  See below.

Is anyone interested in this topic?  It seems to me that DNS has a key role 
to play in solving an important problem.  Existing methods have not done a 
good job of minimizing the risk to DNS.  The folks working on email 
authentication don't know DNS very well (nor do I). They could use some 
help from experts who are not part of one or another warring camp, but just 
want to see the interface to DNS done right.

--
Dave

1.    Introduction

A fundamental requirement of any email authentication method is that it not 
create any new opportunities for Denial-of-Service ( DoS ) attacks or abuse 
of the Internet infrastructure.  IP-based authentication methods are 
particularly vulnerable, because they require at least one query to the 
Domain Name System ( DNS ) by a Mail Transfer Agent ( MTA ) within each 
domain handling an email.  Some of the current methods require multiple 
queries per MTA.

Many DNS servers are old, slow, but reliable machines, intended to answer 
only occasional queries from other domains, and very dependent on name 
servers in those other domains to cache the answers and handle the vast 
majority of queries locally.  A typical query by an Internet Service 
Provider ( ISP ) for the address of a web page might be cached for days, 
and during that time, provide local answers to 1000 similar queries.

In requesting the support of DNS for email authentication, we must 
anticipate not just the increase in DNS load under normal circumstances, 
but what may happen in worst-case scenarios, when configurations are 
deliberately set up for abuse.  We have to be especially careful about 
possible involvement of "third parties", i.e. those not involved in sending 
or receiving an email.  Planning for this abuse is difficult, because we 
have to think about complex and unlikely scenarios.  If there is a 
one-in-ten chance of a successful attack, we have to take it seriously, and 
design for this worst case.

We also have to avoid demanding so much of the new authentication methods, 
that no solution is possible.  We must compare the potential costs, 
including the upgrade of DNS servers and a small possibility of DoS attack, 
to the real and present costs of continued email abuse.  No method will 
avoid all possibility of abuse.  Even the current uses of DNS for non-email 
services can be abused.

A reasonable goal for new services is that the DNS load be comparable in 
magnitude and risk to the load from current services.  If it is not 
possible to meet this goal, then perhaps authentication queries should be 
handled by servers separate from those providing other critical DNS 
services.  A well-planned authentication system should allow for rapid 
migration to such separate servers.

At 12:45 PM 4/28/2005 -0700, David MacQuigg wrote:

>lists with email-authentication experts, but it is hard to get good 
>answers on questions like - What are the problems with putting 
>authentication records in their own subdomain, like 
>_AUTH.example.com?  How do we set up these records so they are no more of 
>a problem than any other services supported by DNS.
>
>Abstract

---

From: David MacQuigg <[email-masked]>
Date: Fri, 29 Apr 2005 12:15:12 -0700

Edward,

Thanks for the heads up.  Yes, I'm aware of the MARID problems, and the 
need to not repeat mistakes of the past.  The essential difference in this 
new effort is that we won't try to standardize everything, just a few very 
simple items.  I am seeing resistance from the advocates on every side, and 
at some point we may need a referee.  I'm hoping that referee will be the 
IETF, but it could also be the FTC.  They have a mandate from Congress, 
they can hire neutral experts, and they know how to deal with advocacy.

I'm hoping to get some good advice and less hard-core advocacy from this 
group, at least on the DNS issues.  Of the items needing standardization, 
this is the toughest.

--
Dave

At 10:37 PM 4/28/2005 -0400, Edward Lewis wrote (quoted with permission):

>Not to squash any ideas (I've not read you draft), but in case you aren't 
>already aware of this group and it's history you might want to look into this:
>
>http://ietf.org/html.charters/OLD/marid-charter.html
>
>The group failed to meet its objectives ...not a comment on the work, but 
>on the mess it devolved into.  Yet, it does cover some of the same ground 
>your message hints at.
>
>Emphasizing that I am only sending this as a reference to prior work, not 
>as a commentary of any of you effort.
>
>At 12:45 -0700 4/28/05, David MacQuigg wrote:
>>I'm preparing a draft for IETF.  Before submitting it, I would like to 
>>get some feedback from people familiar with DNS.  I've had some 
>>discussion on lists with email-authentication experts, but it is hard to 
>>get good answers on questions like - What are the problems with putting

---

From: Dean Anderson <[email-masked]>
Date: Sat, 30 Apr 2005 01:59:14 -0400 (EDT)

The problem is that DNS isn't suitable for authentication.  It isn't 
secure itself.

But you should refer to the MARID archives, where these issues were 
discussed very thoroughly before writing a new draft.

Email authentication, even if possible by some other method, doesn't solve
the problem, since it is the equivalent of dialup problem: 

	Every user is authorized to send email until they aren't. 

	Only their service provider can remove that authorization

Lack of identification is not actually a problem. On every spam, there is
attached a time and IP address of the abuser.  After appropriate
investigation, their service provider may terminate their account. That
takes time. They may receive warnings. They may have virus infections 
using their identity.

Further, email is not sent by only real people. It is sent frequently by
computers, pagers, routers, refrigerators, you name it.  It is a mistake
to assume that an email is sent by a person, and that you (a remote user,
recipient of their email) can find out who they are.  You can't do that
any more than you can find out the name and address or phone number of
someone who called you with Caller-ID blocked. That doesn't mean they
can't be found, it just means that ordinary users can't do it.  That
feature will not change, any more than you are likely to be granted access
to the E911 or subscriber database of another carrier. So, given that
you've found out Paris Hilton's email address, you are not going to be
given her home phone number.  So email authentication is not a solution to
a problem.  

The people "frustrated" by email identity issues are usually recipients of
spam. Email authentication isn't going to lessen that. Even if it were
do-able (and done), end-users and other carriers wouldn't have access to
the subscriber identity information.  And if they are your subscriber, you
usually don't have any lack of identity information given a spam and its
headers.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000