IETF Logo Mail Archive

Re: [dane] Delivery of email if MX is not signed

Paul Wouters <paul@nohats.ca> Sun, 23 August 2015 19:34 UTC

Return-Path: <paul@nohats.ca>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 939EF1B2A89 for <dane@ietfa.amsl.com>; Sun, 23 Aug 2015 12:34:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.71
X-Spam-Level:
X-Spam-Status: No, score=-1.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_8BIT_HEADER=0.3, T_RP_MATCHES_RCVD=-0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Du-r73Xn0vEu for <dane@ietfa.amsl.com>; Sun, 23 Aug 2015 12:34:00 -0700 (PDT)
Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17A961B2A88 for <dane@ietf.org>; Sun, 23 Aug 2015 12:34:00 -0700 (PDT)
Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3mzmwj4XlDz1bq; Sun, 23 Aug 2015 21:33:57 +0200 (CEST)
Authentication-Results: mx.nohats.ca; dkim=pass (1024-bit key) header.d=nohats.ca header.i=@nohats.ca header.b=eRyYCo2i
X-OPENPGPKEY: Message passed unmodified
X-Virus-Scanned: amavisd-new at mx.nohats.ca
Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id N08KqYNZJMFG; Sun, 23 Aug 2015 21:33:55 +0200 (CEST)
Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Sun, 23 Aug 2015 21:33:55 +0200 (CEST)
Received: from bofh.nohats.ca (bofh.nohats.ca [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 933078009C; Sun, 23 Aug 2015 15:33:54 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1440358434; bh=xxIe8IrpV4RDas12IDVZCZKkffUj7m140VdG35pn/sQ=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=eRyYCo2ibTPlfWLn6O+DEzrssR6tbujlBCabsuslytidrDeZg/glA8HKKaX440pjP wfsCe4iCftGPgB5CDehawgcGehgtD9LduMHWLe7JinyROQkbu5PpF/aVwwSzNnaROw 6w74TeGgBksPZcrwsZREyFVHCtjztUN9ehBnIFXc=
Received: from localhost (paul@localhost) by bofh.nohats.ca (8.15.2/8.15.2/Submit) with ESMTP id t7NJXro7008452; Sun, 23 Aug 2015 15:33:54 -0400
X-Authentication-Warning: bofh.nohats.ca: paul owned process doing -bs
Date: Sun, 23 Aug 2015 15:33:53 -0400
From: Paul Wouters <paul@nohats.ca>
To: Patrik Fältström <paf@frobbit.se>
In-Reply-To: <0E722F2F-510C-4060-86C2-41190F724DBA@frobbit.se>
Message-ID: <alpine.LFD.2.20.1508231528300.8057@bofh.nohats.ca>
References: <D976ACCE-8F15-448C-A5E4-B8D1FD329A8B@frobbit.se> <alpine.LFD.2.20.1508231343110.26943@bofh.nohats.ca> <F2977CCF-CE1E-46F1-A08E-4A6D77EA3A74@frobbit.se> <alpine.LFD.2.20.1508231411280.26943@bofh.nohats.ca> <C6382564-E6D5-4461-902A-6E12ED78296C@frobbit.se> <20150823185057.GJ5112@x28.adm.denic.de> <0E722F2F-510C-4060-86C2-41190F724DBA@frobbit.se>
User-Agent: Alpine 2.20 (LFD 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; format="flowed"; charset="ISO-8859-15"
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/dane/fZhM_VMdEeAVAbuxkaQPUT_JOfM>
Cc: dane WG list <dane@ietf.org>
Subject: Re: [dane] Delivery of email if MX is not signed
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 23 Aug 2015 19:34:01 -0000

On Sun, 23 Aug 2015, Patrik Fältström wrote:

> What I think I see in the draft is that "DANE and SMTP" is either "on" or "off", and I want more shades of gray.

Well yes. Because you either authenticate or fail to authenticate and
refuse to deliver. We cannot decide whether or not to deliver in shades
of grey.

So we have:

- unsigned domain -> deliver without authentication, allow any TLS credential
- signed domain with unsined mx target -> deliver without authentication, allow any TLS credential
- signed domain with signed mx target -> deliver only if authentication succeeded.

You seem to want something like:

- unsigned domain with signed mx target -> deliver if authentication
   succeeds - despite possible spoofed MX record

What is the result of the last one? "Verified TLS to potential rogue server" ? I don't think we
would call that verified.

Paul

v2.23.0 | Report a Bug | By Email