IETF Logo Mail Archive

Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

Michael StJohns <mstjohns@comcast.net> Mon, 11 August 2008 20:09 UTC

Return-Path: <owner-namedroppers@ops.ietf.org>
X-Original-To: ietfarch-dnsext-archive@core3.amsl.com
Delivered-To: ietfarch-dnsext-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 82C6B3A6856; Mon, 11 Aug 2008 13:09:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.496
X-Spam-Level:
X-Spam-Status: No, score=-0.496 tagged_above=-999 required=5 tests=[AWL=-0.059, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id omUtf0xOifw5; Mon, 11 Aug 2008 13:09:15 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 01FAC3A688E; Mon, 11 Aug 2008 13:09:15 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1KSdc5-0002Qv-7X for namedroppers-data@psg.com; Mon, 11 Aug 2008 20:03:33 +0000
Received: from [76.96.30.16] (helo=QMTA01.emeryville.ca.mail.comcast.net) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from <mstjohns@comcast.net>) id 1KSdc1-0002QV-J2 for namedroppers@ops.ietf.org; Mon, 11 Aug 2008 20:03:31 +0000
Received: from OMTA14.emeryville.ca.mail.comcast.net ([76.96.30.60]) by QMTA01.emeryville.ca.mail.comcast.net with comcast id 154e1a01f1HpZEsA183V1A; Mon, 11 Aug 2008 20:03:29 +0000
Received: from MIKES-LAPTOM.comcast.net ([69.140.151.110]) by OMTA14.emeryville.ca.mail.comcast.net with comcast id 183T1a00B2P9w058a83UrY; Mon, 11 Aug 2008 20:03:29 +0000
X-Authority-Analysis: v=1.0 c=1 a=RsSsFw0Y2BEA:10 a=cY4EPkZNyTwA:10 a=48vgC7mUAAAA:8 a=mXwbroN_EYgI7aQMUw0A:9 a=By90Z84A-yeFKhaXTKYA:7 a=TEac13WDZ9pLD_4biGj2qpodl_oA:4 a=iw4bf7yTzGQA:10 a=h9s5Ru71U4oA:10
X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9
Date: Mon, 11 Aug 2008 16:03:27 -0400
To: Mark Andrews <Mark_Andrews@isc.org>, namedroppers@ops.ietf.org
From: Michael StJohns <mstjohns@comcast.net>
Subject: Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?
In-Reply-To: <200808110118.m7B1If7Z052960@drugs.dv.isc.org>
References: <Your message of "Sun, 10 Aug 2008 20:02:06 +0200." <021101c8fb13$34634310$9d29c930$@com> <200808110118.m7B1If7Z052960@drugs.dv.isc.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-namedroppers@ops.ietf.org
Precedence: bulk
List-ID: <namedroppers.ops.ietf.org>
Message-Id: <E1KSdc5-0002Qv-7X@psg.com>

At 09:18 PM 8/10/2008, Mark Andrews wrote:

>> OK - but MX-records point to host names which point to A/AAAA records which
>> point to IP addresses...
>> If the bad guy is on the wire, he can intercept and replace your SMTP
>> traffic anyway. 
>> DNSSEC or not.
>> 
>> SRV-records also point to host names which...
>
>        DNS security is required for SMTP security to work. 

Absurd claim.

>How
>        else fo you securely workout who you are supposed to be
>        communicating with.

Um.. maybe with SSL?   Check the offered certificate matches some criteria to relate it to the name and that it chains back to someplace you trust.

I'm sure there are all sorts of arguments you could make on how this isn't sufficient - but DNSSEC only at MOST gives me a validatable mapping between a domain name and the ultimate IP address - it doesn't protect against post-resolution attacks of various flavors, so I could argue DNSSEC isn't sufficient.

SSL/TLS has the nice properties that I can deploy it per server (e.g. I can get incremental benefit), that I can do off-tree validations, and that a hell of a lot of servers already implement it.  DNSSEC can't be deployed per server (requires the zone to be signed even if mostly opted out), can't do off-tree validations (DLV is a hack - I might split a hair and call it off-tree, but it really is more of a trust anchor registry than anything else), and few SMTP servers (any?) implement DNSSEC resolution/validation.




>        Mark
>-- 
>Mark Andrews, ISC
>1 Seymour St., Dundas Valley, NSW 2117, Australia
>PHONE: +61 2 9871 4742                 INTERNET: Mark_Andrews@isc.org
>
>--
>to unsubscribe send a message to namedroppers-request@ops.ietf.org with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/namedroppers/>



--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

v2.23.0 | Report a Bug | By Email