Re: [dane] TLSA lookup impedance mismatch with bare-bones DNS servers

[Viktor Dukhovni <[e-mail]>]

On Thu, Nov 21, 2013 at 12:08:38PM -0500, James Cloos wrote:

> Given insecure a/aaaa results, it is reasonable to presume that tlsa
> resaults also will be insecure.

Thanks, this is on the list for inclusion in the OPS and SMTP drafts.

> Avoiding the tlsa lookup has the downside of serializing the requests,
> but that appears to be necessary in the face of b0rked auth servers.

Yes, though for Postfix the serialization is unavoidable, TLS policy
is loaded one MX destination at a time (in preparation for delivery
to that destination), after the network address is already in hand.

[ The network address is needed early for loop elimination.  Postfix
determines whether it is an MX host for the destination by comparing
network addresses, not hostnames.  Therefore the network addresses
of all equal-preference hosts need to be available, before delivery
to any host at that preference.  Hence the $proxy_interfaces
parameter for MX hosts behind a NAT. ]

Also Postfix + DANE requires a validating resolver on the loopback
interface, so latency is a bit less of a concern, at least for
high-volume destinations where the local cache amortises lookup
latency.

-- 
	Viktor.