IETF Logo Mail Archive

Re: [dane] TLSA lookup impedance mismatch with bare-bones DNS servers

mrex@sap.com (Martin Rex) Thu, 21 November 2013 00:05 UTC

Return-Path: <mrex@sap.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D59A81AE1E9 for <dane@ietfa.amsl.com>; Wed, 20 Nov 2013 16:05:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.552
X-Spam-Level:
X-Spam-Status: No, score=-6.552 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_HI=-5, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w1l1aA_3iNiG for <dane@ietfa.amsl.com>; Wed, 20 Nov 2013 16:05:36 -0800 (PST)
Received: from smtpde01.sap-ag.de (smtpde01.sap-ag.de [155.56.68.170]) by ietfa.amsl.com (Postfix) with ESMTP id 2A9AC1AE12B for <dane@ietf.org>; Wed, 20 Nov 2013 16:05:36 -0800 (PST)
Received: from mail05.wdf.sap.corp by smtpde01.sap-ag.de (26) with ESMTP id rAL05SF2009191 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for <dane@ietf.org>; Thu, 21 Nov 2013 01:05:28 +0100 (MET)
In-Reply-To: <20131120234453.GM761@mournblade.imrryr.org>
To: dane@ietf.org
Date: Thu, 21 Nov 2013 01:05:28 +0100
X-Mailer: ELM [version 2.4ME+ PL125 (25)]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="US-ASCII"
Message-Id: <20131121000528.8BDF61AACA@ld9781.wdf.sap.corp>
From: mrex@sap.com
X-SAP: out
Subject: Re: [dane] TLSA lookup impedance mismatch with bare-bones DNS servers
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: mrex@sap.com
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Nov 2013 00:05:38 -0000

Viktor Dukhovni wrote:
> 
> > RFC 103[45] say what to return if the name exists and
> > the type doesn't and it isn't NOTIMP.
> 
> In this case the name does not exist, so the nameserver should be
> returning NXDOMAIN, but it snatches defeat from the jaws of victory
> and indeed returns "NOTIMP":
> 
>     ; <<>> DiG 9.8.0rc1 <<>> +norecur -t TYPE52 _25._tcp.mail.protection.outlook.com. @ns1-proddns.glbdns.o365filtering.com.
>     ;; global options: +cmd
>     ;; Got answer:
>     ;; ->>HEADER<<- opcode: QUERY, status: NOTIMP, id: 4960
>     ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
> 
> which 8.8.8.8 relayed as SERVFAIL.  If there is someone from
> Microsoft on this list, please forward a pointer to thread to the
> appropriate interested parties.


I haven't looked at any of the other stuff (from this discussion),
but this latter appears to be a major goof in Googles DNS server.

Forwarding NOTIMP (=permanent, do not retry) as a temporary
RC (SERVFAIL) is pretty unreasonable on my scorecard.

-Martin

v2.26.15 | Report a Bug | By Email | System Status