Re: [dnsext] SPF, a cautionary tale

[Douglas Otis <[e-mail]>]

On May 4, 2013, at 8:16 AM, John R Levine <[e-mail]> wrote:

>>> ... and interpreting SPF records requires more DNS queries than any other DNS application I know.
> 
>> 	So what you are saying is that SPF is a carefully crafted DNS
>> 	DDoS attack because it was too hard to do the work inside your
>> 	own protocol?
> 
> Yup, just like CNAME.
> 
> In the decade that SPF has been around, the putative DDoS has never been observed in the wild, ever, despite Doug Otis warning us about it every 15 minutes since 4408 was a draft, and a few experiments I did with stunt DNS servers that returned giant trees of SPF records very slowly.  It turns out everyone does loop breaking, just like for CNAME.  It's a sloppy design from a decade ago that succeeded because it made an end run around the DNS provisioning problems of "better" alternatives.
> 
>> 	What ever happened to "Be Conservative in What you Send..."
> 
> It lost out to Stuff That Actually Exists Works Better than Stuff That Doesn't.
> 
> A decade ago, SPF was far from my favorite authentication design, but now it exists, it's more widely used than most standards track protocols, and it would be silly to pretend otherwise.  Hence the spfbis charter to standardize existing practice.

Dear John and Bill,

I have heard this canard several times as if it offers some level of assurance.  How does one know whether SPF sourced any particular DDoS related query?  These represent reverse PTR, TXT, A, AAAA record types at any location.

It is also wrong to suggest SPF specification represents existing practice. Not all providers implemented SPF macro components.  The decision to depreciate SPF (99) RRs happened at roughly the same level of local-part macro expansion use.  Use of local-part macros requires other mechanisms to prevent unlimited spoofing when SPF pass becomes independent of the sending client.  The impact that such clever mechanisms may have is unknown if they ever become popular. 

Thank you Bill for clearly expressing this opinion.

Regards,
Douglas Otis