Subject: RE: a suggestion for super-wildcards

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 27 Jul 2006 07:38:19 -0700

> From: Doug Barton [mailto:[email-masked]] 

> On the one hand, because I have in the past wanted something 
> similar to what you're proposing, the theoretical concept of 
> these super wildcards is appealing. However, from a protocol 
> standpoint the idea gives me a serious case of the screaming 
> heebeejeebees.

Screaming? 

> So, I have a question ...
> 
> Hallam-Baker, Phillip wrote:

> > So the problem with policy is how to declare an email 
> signing policy 
> > for **.example.com that takes effect if there is no more specific 
> > policy. The objective being to specify policies such as:
> > 
> > example.com     DKIM  "ALL mail is signed" 
> > **.example.com  DKIM  "No mail is originated"
> 
> Ok, your problem statement makes total sense to me, but I 
> think you're missing a third option. I'm assuming that the 
> DKIM protocol has a way to handle total absence of a policy 
> for a domain. So, what if you added a heuristic to the DKIM 
> protocol that says, "If I do not find a policy at this node, 
> I will go down the tree until I either find a policy, or hit the TLD."

It's the heuristic that gives me the heebeejeebees of the screaming variety. Either you walk the tree and allow attackers to stick you with 60 lookups or you add in some constraints and you change the semantics of the DNS delegation as Olafur pointed out in the meeting.

If you walk the tree you allow upper level domains to control the email sending policy of lower domains even if that lower domain thinks that it has full control because it has a delegation. Debugging problems could well get ugly, even more so if you are running split DNS.

> In regards to your problem of spammers that try sending mail 
> from 1.2.3.4..99.spammer-domain.tld, if the spammers have 
> control over that domain and can add a node at that point, it 
> will eat up resources to walk that tree, no doubt. OTOH, if 
> they are playing silly buggers with a domain they don't have 
> control over, I assume DKIM is smart enough to say that if 
> there are NO records at all for a node, that it isn't 
> legitimate? 

A lot of mail originates from addresses that are not externally visible due to split DNS and the use of DNS wildcard MX records.

The problem with the heuristic is that it results in yet another set of semantics to deal with and possibly end up with conflicts.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Fri, 28 Jul 2006 09:27:33 +1000

> It's the heuristic that gives me the heebeejeebees of the screaming variety. E
> ither you walk the tree and allow attackers to stick you with 60 lookups or yo
> u add in some constraints and you change the semantics of the DNS delegation a
> s Olafur pointed out in the meeting.
> 
> If you walk the tree you allow upper level domains to control the email sendin
> g policy of lower domains even if that lower domain thinks that it has full co
> ntrol because it has a delegation. Debugging problems could well get ugly, eve
> n more so if you are running split DNS.

	Given you only want to trust signed and validated answers.
	The signatures themselves define the search range.

	If you don't want to limit answers to signed zones only
	you seach for the zone cut in parallel to looking for the
	records.

> A lot of mail originates from addresses that are not externally visible due to
>  split DNS and the use of DNS wildcard MX records.
> 
> The problem with the heuristic is that it results in yet another set of semant
> ics to deal with and possibly end up with conflicts.
> 
> --
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]