Re: [dnsext] I-D Action:draft-ietf-dnsext-aliasing-requirements-00.txt

[Tony Finch <[e-mail]>]

On Fri, 4 Mar 2011, Mark Andrews wrote:
>
> It makes all the difference in the world.  MX records DO NOT AND NEVER
> HAVE DEFINED FINAL DELIVER they have only ever defined the NEXT HOP.

MX record define the inter-domain hop, which is where the mail crosses a
trust boundary, and where authentication is required.

The other store-and-forward hops (from submission to outgoing border
relay; and from incoming border MX to final delivery or to alias
redirector) are within trust boundaries and so they are easier to
authenticate.

> > TLS predates DNSSEC.
>
> Yes and it did not work securely because there was no way to validate
> the DNS responses.

TLS doesn't try to validate the DNS responses, it verifies that you have
successfully connected to a server that can act for the domain you wanted
to reach. If TLS validation succeeds the DNS lookup must necessarily have
given you the right result.

It isn't possible to use DNSSEC to secure a TCP connection to a server
because it doesn't verify that no-one has hijacked the IP address. I don't
know why you keep bringing it up.

Note that these issues are not specific to SMTP: XMPP has similar
difficulties with s2s authentication.

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Sole, Lundy, Fastnet: Mainly northeasterly 4 or 5, occasionally 6 in Sole.
Slight or moderate, occasionally rough in Sole and Fastnet. Mainly fair.
Moderate or good.