IETF Logo Mail Archive

Re: [dane] Please help to remediate broken DNSSEC hosting

Viktor Dukhovni <ietf-dane@dukhovni.org> Thu, 20 November 2014 15:18 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B9F91A1A79 for <dane@ietfa.amsl.com>; Thu, 20 Nov 2014 07:18:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1VklyxplvZhh for <dane@ietfa.amsl.com>; Thu, 20 Nov 2014 07:18:13 -0800 (PST)
Received: from mournblade.imrryr.org (mournblade.imrryr.org [38.117.134.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 47D711A1AB2 for <dane@ietf.org>; Thu, 20 Nov 2014 07:17:18 -0800 (PST)
Received: by mournblade.imrryr.org (Postfix, from userid 1034) id 8E047282F88; Thu, 20 Nov 2014 15:17:16 +0000 (UTC)
Date: Thu, 20 Nov 2014 15:17:16 +0000
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
To: dane@ietf.org
Message-ID: <20141120151716.GQ13179@mournblade.imrryr.org>
References: <20141027225310.29285.24437.idtracker@ietfa.amsl.com> <F0C0FC32-FAA7-4D07-A230-59A538754BCD@isoc.org> <20141120062942.GL13179@mournblade.imrryr.org> <20141120073445.GM13179@mournblade.imrryr.org> <546DA64E.4010900@sidn.nl>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <546DA64E.4010900@sidn.nl>
User-Agent: Mutt/1.5.23 (2014-03-12)
Archived-At: http://mailarchive.ietf.org/arch/msg/dane/XD9pgm5-Du0z9k0Yirdgh-z7jxA
Subject: Re: [dane] Please help to remediate broken DNSSEC hosting
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: dane@ietf.org
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 20 Nov 2014 15:18:15 -0000

On Thu, Nov 20, 2014 at 09:29:02AM +0100, Marco Davids (SIDN) wrote:

> In particular TransIP is a bit of a challenge, because they run their
> own DNS-software and feel no rush to fix this issue. But rest assured
> that we will keep on trying to have them improve things.

At this point the "feel no rush" attitude will cause loss of email
between SMTP with DANE early adopters to transip sites that employ
wildcard records.  They really need to get off their rear-ends and
fix the problem.

Otherwise, I may need to develop a new unbound feature that considers
a zone insecure if all its NS records lie in a given blacklisted
domain.

I don't suppose it is possible to pressure transip with a threat
of removal of the problem DS records from the '.nl' registry by
say 6 months from now if the problem is not addressed?

-- 
	Viktor.

v2.30.2 | Report a Bug | By Email | System Status