Re: [dnsext] I-D Action:draft-ietf-dnsext-aliasing-requirements-00.txt

[Masataka Ohta <[e-mail]>]

Tony Finch wrote:

> Note that SMTP is able to use one transaction to send a message with
> multiple recipients at different domains hosted on the same server. So the
> server needs to be able to present a certificate authenticating all of the
> mail domains it hosts.

> Now perhaps this mess - both the protocol mess and the deployment mess -
> can be fixed by using the firmer foundations that DNSSEC provides, but
> that requires protocol development.

Just say "another level of indirection" or another CNAME.

By making CNAME domain names pointed by MXes different for each
mail domain name, and letting SMTP think servers with different
CNAME domain names are different servers even if they are
aliases of a single server, TLS should work with MX.

	mail0.example.com	MX 0 mail0.example.net
	mail1.example.com	MX 0 mail1.example.net
	mail0.example.net	CNAME mx.example.net
	mail1.example.net	CNAME mx.example.net

It's like differentiating name based virtual servers by different
CNAMEs pointed from different SVRs, as I pointed out a few weeks
ago.

A problem is that RFC1034 has a wrong example for reasoning
against recursive aliasing. But, it should be fixed. I'll post
an errata with a separate subject.

						Masataka Ohta