Subject: [spfbis] Ticket #47 domain-spec

From: Scott Kitterman <[email-masked]>
Date: Tue, 05 Feb 2013 13:00:47 -0500

I think this needs discussion before I include one of the two proposed 
solutions in a draft.

http://trac.tools.ietf.org/wg/spfbis/trac/ticket/47

 Suggested text:

bis-06:

    The domain-spec is expanded as per Section 8. The resulting domain name is 
used for a DNS A RR lookup. If any A record is returned, this mechanism 
matches. The lookup type is A even when the connection type is IPv6.

new:

    The domain-spec is expanded as per Section 8. The resulting domain name is 
used for a DNS A RR lookup (even when the connection type is IPv6). If any A 
record is returned, this mechanism matches, otherwise the mechanism doesn't 
match.

or new:

    The domain-spec is expanded as per Section 8. The resulting domain name is 
used for a DNS A RR lookup (even when the connection type is IPv6). If any A 
record is returned, this mechanism matches. In all other cases (no A records, 
DNS error, etc.), the mechanism doesn't match.

​http://www.ietf.org/mail-archive/web/spfbis/current/msg02371.html

As I read it the second alternative specifies that a DNS error is treated as a 
no match, but the first does not.  I believe we want the first as we don't want 
to hide DNS failures, but I'm not sure.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 5 Feb 2013 13:34:10 -0800

Feel free to point me at previous discussion, but why "(even when the
connection type is IPv6)"?

Shouldn't a DNS error result in a "temp-fail"?

-MSK

On Tue, Feb 5, 2013 at 10:00 AM, Scott Kitterman <[email-masked]> wrote:

> http://www.ietf.org/mail-archive/web/spfbis/current/msg02371.html
>
> _______________________________________________
> spfbis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spfbis
>

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 05 Feb 2013 18:00:52 -0500

As far as I know, there's been no discussion on the topic, just an initial 
proposal for resolving an ambiguity in the spec.

It's A lookup even when the connection type is IPv6 because DNSxBLs return an 
A record format.

Looking at the two options, I think the rationale (to be clear, I am 
guessing):

1.  A DNS lookup failure here will generally only turn a pass into a 
temperror, so hiding the error doesn't allow a path to upgrade a result.  If a 
message would otherwise be accepted, it's not worth sending them a 450 just 
for this.

2.  Hiding errors is bad.

Scott K

On Tuesday, February 05, 2013 01:34:10 PM Murray S. Kucherawy wrote:
> >     The domain-spec is expanded as per Section 8. The resulting domain
> > 
> > name is
> >     The domain-spec is expanded as per Section 8. The resulting domain
> > 
> > name is
> >     The domain-spec is expanded as per Section 8. The resulting domain
> > 
> > name is

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 5 Feb 2013 20:20:08 -0800

I'm unclear on how DNSxLs come into this.  Is that through the macro
reverse IP lookup trick?  Something else?

More generally, I agree that DNS errors should not be hidden.

-MSK

On Tue, Feb 5, 2013 at 3:00 PM, Scott Kitterman <[email-masked]> wrote:

> > > used for a DNS A RR lookup (even when the connection type is IPv6). If
> any
> > > A
> > > used for a DNS A RR lookup (even when the connection type is IPv6). If
> any
> > > A
> > > As I read it the second alternative specifies that a DNS error is
> treated
> > > as a
> > > no match, but the first does not.  I believe we want the first as we
> don't
> > > want

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 06 Feb 2013 01:33:24 -0500

They actually don't.  I think given the improvements we've made in the 
previous text, the DNSxL reference is just confusing now.  I've removed it 
from my local copy.

Scott K

On Tuesday, February 05, 2013 08:20:08 PM Murray S. Kucherawy wrote:
> > temperror, so hiding the error doesn't allow a path to upgrade a result.
> > 
> >  If a
> > 
> > > On Tue, Feb 5, 2013 at 10:00 AM, Scott Kitterman <[email-masked]>
> > 
> > wrote: