Re: [dnsext] I-D Action:draft-ietf-dnsext-aliasing-requirements-00.txt

In message <alpine.LSU.2.00.1103031107460.14985@hermes-1.csi.cam.ac.uk>, Tony F
inch writes:
> On Tue, 1 Mar 2011, Alex Bligh wrote:
> >
> > However in each case in the 'S' variant of the protocol, you need to
> > provide a separate certificate for the alias to the canonical name,
> > which means you can't automatically configure / synthesise the alias
> > config in the same way you can for the non-'S' variant. What MX / SRV
> > are allowing you to do for services that support them is hide this with
> > another level of indirection.
> 
> The situation with TLS and SMTP is a mess. Inter-domain SMTP with TLS does
> not work with certificate validation. There is no specification for how to
> validate the TLS certificate for an MX server, and it is not obvious what
> such a specification should say. In practice the vast majority of deployed
> MX TLS certificates cannot be validated, neither against the MX owner name
> nor against the MX target.

If you read RFC 821 the HELO response should be used to check that
you are talking to the machine you are expecting to.

   3.5.  OPENING AND CLOSING

      At the time the transmission channel is opened there is an
      exchange to ensure that the hosts are communicating with the hosts
      they think they are.

      The following two commands are used in transmission channel
      opening and closing:

         HELO <SP> <domain> <CRLF>

         QUIT <CRLF>

      In the HELO command the host sending the command identifies
      itself; the command may be interpreted as saying "Hello, I am
      <domain>".

The MX owner name never make sense.  The MX target is *suposed*
to be the (singular) cannonical name of the machine.  The fact that
people abuse this doesn't mean that the MX target shouldn't be used.

> http://www.imc.org/ietf-smtp/mail-archive/msg05366.html
> 
> Message submission (RFC 4409) doesn't use MX records and works well with
> certificate validation, just like POP and IMAP. Note that these three
> protocols use the DNS in the same way as HTTP (and FTP, and telnet, and
> ssh, etc.) so I don't think HTTP is an outlier as Niall said - it's just
> old school.
> 
> > In https that's hard as the cert is chosen before the GET line comes
> > through.
> 
> This is what TLS server name indication is for.
> 
> Tony.
> -- 
> f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
> Plymouth, Biscay, FitzRoy: Northeast 5 to 7. Moderate or rough. Showers. Good
> .
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org