Re: [dnsext] I-D Action:draft-ietf-dnsext-aliasing-requirements-00.txt

[Tony Finch <[e-mail]>]

On Fri, 4 Mar 2011, Mark Andrews wrote:
>
> No.  SMTP is store and forward.

That makes no difference.

Most store-and-forward hops in SMTP are within an organization, and in
that situation mail routing is not based on the MX records of the
recipients' mail domains. (cf. message submission) The organization can
secure its mail transmission using its knowledge of its own setup.

The important and difficult case is inter-domain SMTP which does rely on
MX records and cannot rely on prior arrangements for authentication.

> The MX records (cryptographically verifiable with DNSSEC) say that you
> should be talking to mx.cam.ac.uk and if you don't get a TLS connection
> that says you are talking to that machine you should drop the SMTP
> connection.

TLS predates DNSSEC. It security model assumes DNSSEC does not exist.
Therefore TLS must authenticate the domain seen by the end user. It makes
no sense to authenticate the MX target hostname because that makes you
vulnerable to spoofing.

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Irish Sea: Variable 3 or 4. Slight. Fog patches. Moderate, occasionally very
poor.