Re: [BEHAVE] RFC6147 and RFC7208 interoperability issues

[Keith Moore <[e-mail]>]

On 2/7/22 14:37, Dan Wing wrote:

> Could the SPF problem dissipate if SPF records only contained DNS names and deprecate IP addresses?

I suspect this just would just make SPF records even less reliable than 
they already are, because the DNS name adds an extra layer of 
indirection that also has a high probability of being wrong.

Also, it doesn't rid the burden of applications operating behind the NAT 
to be aware of the NAT.   For better or worse, applications have a lot 
of incentive to use DoH or DoT because local resolvers are sometimes 
under-provisioned or unreliable, network providers sometimes spy on DNS 
traffic, etc.  Using DoH or DoT can result in more reliable, consistent 
operation with less delay due to DNS lookup time.   So if the 
application is going to benefit from SPF records having DNS names in 
them, it has to know to use the DNS64 server to lookup those DNS names 
and get the (possibly fake) IPv6 source addresses back.

The general problem that DNS is often out of sync with reality (at least 
in part because DNS isn't federated in the same way that reality is) is 
hard to fix.

Keith