Re: [BEHAVE] RFC6147 and RFC7208 interoperability issues

[Christian Huitema <[e-mail]>]

On 2/6/2022 6:20 PM, Klaus Frank wrote:

> You left out the other half of Section 6.2 where it says:
>
>    Alternatively,
>    the validating host may establish a trusted connection with a DNS64,
>    and allow the DNS64 recursive resolver to do all validation on its
>    behalf.
>
> Which is allowing the DNS64 server to rewrite the SPF record... 

Yes, but doing that requires updating the code on the DNS64 server, 
which may or may not be under the same management as the SMTP server. 
The DNS64 update would  also will still break if the SMTP server is 
configured to access a secure DNS server using encrypted DNS -- DoH, DoT 
or DoQ. Turns out that "use encrypted DNS" is one of the recommendations 
pushed for network security, because it prevents DNS spoofing and DNS 
monitoring attacks. Overall, it is probably easier and more robust to 
deploy a change in the SMTP servers.

-- Christian Huitema