Subject: Re: [spfbis] #24: RFC 4408: Reasonable DNS error limits

From: Scott Kitterman <[email-masked]>
Date: Tue, 05 Feb 2013 10:35:46 -0500

On Thursday, January 31, 2013 06:53:55 AM S Moonesamy wrote:
> Hi Scott,
> 
> At 06:22 31-01-2013, Scott Kitterman wrote:
> >I think it will be resolved with the next revision.  I think we've
> >discussed it sufficiently.  Next week looks to be good for me to take a
> >stab at making progress on the remaining issues.
> 
> Thanks for the feedback.

This is what I've put in my local copy of the to revision 10 (line breaks are 
better in the draft):
          
>             The published SPF record for a given domain name SHOULD remain
>             small enough that the results of a query for it will fit within
>             512 octets.  This UDP limit is defined in <xref
>             target="RFC1035"/>
>             section 2.3.4.  This will keep even older DNS implementations
>             from
>             falling over to TCP.  Since the answer size is dependent on many
>             things outside the scope of this document, it is only possible
>             to
>             give this guideline: If the combined length of the DNS name and
>             the text of all the records of a given type is under 450 octets,
>             then DNS answers ought to fit in UDP packets.  Records that are
>             too  long to fit in a single UDP packet could be silently ignored
>             by  SPF
>             verifiers due to firewall and other issues that cause DNS over
>             TCP
>             to be less reliable than DNS over UDP.
>   
>             Note that when computing the sizes for replies to queries of the
>             TXT
>             format, one has to take into account any other TXT records
>             published
>             at the domain name.  Similarly, the sizes for replies to all
>             queries
>             related to SPF have to be evaluated to fit in a single UDP
>             packet.

I believe it addresses the specific concern raised without driving into a lot 
of detail about how one operates DNS.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 5 Feb 2013 12:45:34 -0800

Looks good to me.

-MSK

On Tue, Feb 5, 2013 at 7:35 AM, Scott Kitterman <[email-masked]> wrote:

> _______________________________________________
> spfbis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spfbis
>