Re: [dbound] draft-brotman-rdbd

"John R. Levine" <> Mon, 01 April 2019 02:00 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 47CBF1201D0 for <>; Sun, 31 Mar 2019 19:00:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1536-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id rKmjOx1cArrX for <>; Sun, 31 Mar 2019 19:00:12 -0700 (PDT)
Received: from ( [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 7DB5B1200EC for <>; Sun, 31 Mar 2019 19:00:12 -0700 (PDT)
Received: (qmail 41330 invoked from network); 1 Apr 2019 02:00:11 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple;; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=a16e.5ca170ab.k1903; bh=Z/ZqA4ACUW31S+AX1tGED54cz9dS1f6v9GMtbOS6o5Q=; b=rnhLcSM8odPxbKqcv1RVEZyI+gUICRHb4gO7Tp3hZU67GOBWgr14gWhMa8aThsRWoXmzj8LDR3xc4duU9En5W226yDeDTIkCzPUHAZsF7aD4AP/DRhtHmtYJxRbGfGlpaTlIze7oWC5Ph5daFd4EGZvBvN3AHpIbHMSWdy1NtJbdnYkHRRpdx4bttztnGjMWNW6jT6a1s/jzTEn2HImavrb9xSAiiCHpERKy1bGKX2ExoJOa+5Lv30qX3EkHUE7Q
Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.2 ECDHE-RSA AES-256-GCM AEAD) via TCP6; 01 Apr 2019 02:00:10 -0000
Date: 31 Mar 2019 22:00:10 -0400
Message-ID: <alpine.OSX.2.21.1903312150240.9966@ary.qy>
From: "John R. Levine" <>
To: "Stephen Farrell" <>
In-Reply-To: <>
References: <> <alpine.OSX.2.21.1903311818070.8860@ary.qy> <> <alpine.OSX.2.21.1903312059110.9650@ary.qy> <>
User-Agent: Alpine 2.21 (OSX 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
Archived-At: <>
Subject: Re: [dbound] draft-brotman-rdbd
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS tree bounds <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 01 Apr 2019 02:00:14 -0000

On Mon, 1 Apr 2019, Stephen Farrell wrote:

> For example, if a relying-party has seen the same public key used for a 
> relating domain N times or for N years, and sees that public key used 
> again, then that relying-party can treat that differently, compared to a 
> public key just seen now, without any DNSSEC. ...

> That trust-model for signatures is entirely as was done for DKIM.

Well, there's the problem -- this is completely different from the trust 
model for DKIM.

For one thing, DKIM associates a key in the DNS with signatures in 
messages.  The DKIM key is public but the message isn't.  In this design, 
both ends are in the DNS and both are public.

More to the point, although I realize that a lot of DKIM signers never 
rotate their keys, that is universally agreed to be bad practice.  I 
rotate my DKIM keys every month, so you'll never see a key record of mine 
for more than about seven weeks (a month plus some slop at each end.)  I 
would be pretty surprised if anyone considered a DKIM key record more 
credible because it had been around for a long time.

John Levine,, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail.