Re: [BEHAVE] RFC6147 and RFC7208 interoperability issues

[Klaus Frank <[e-mail]>]

On 2022-02-07 20:51, Keith Moore wrote:
> On 2/7/22 14:37, Dan Wing wrote:
>
>> Could the SPF problem dissipate if SPF records only contained DNS 
>> names and deprecate IP addresses?
>
> I suspect this just would just make SPF records even less reliable 
> than they already are, because the DNS name adds an extra layer of 
> indirection that also has a high probability of being wrong.

Not really. Using DNS is already part of the SPF standard (section 5.7) 
via "v=spf1 exists:%{ir}.%{l1r+-}._spf.%{d} -all":

    The <target-name> might expand to
    "1.2.0.192.someuser._spf.example.com".  This makes fine-grained
    decisions possible at the level of the user and client IP address.

> Also, it doesn't rid the burden of applications operating behind the 
> NAT to be aware of the NAT.   For better or worse, applications have a 
> lot of incentive to use DoH or DoT because local resolvers are 
> sometimes under-provisioned or unreliable, network providers sometimes 
> spy on DNS traffic, etc.  Using DoH or DoT can result in more 
> reliable, consistent operation with less delay due to DNS lookup 
> time.   So if the application is going to benefit from SPF records 
> having DNS names in them, it has to know to use the DNS64 server to 
> lookup those DNS names and get the (possibly fake) IPv6 source 
> addresses back.
>
> The general problem that DNS is often out of sync with reality (at 
> least in part because DNS isn't federated in the same way that reality 
> is) is hard to fix.
What exactly do you mean Split-DNS? Which is another pitfall why using 
DoH and DoT is problematic and (from admin perspective) not desirable. 
And when they're used to use the same DNS infrastructure you consider 
"out of sync" via a DoH or DoT resolver...
>
> Keith
>
>
> _______________________________________________
> Behave mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/behave