[dnsext] SPF, a cautionary tale

["John Levine" <[e-mail]>]

> However, the point has been made with respect to SPF
>that it would have been better had it not been just a text record.

Uh, no.  SPF (the protocol) is overcomplex, with much of the
complexity ending up in the DNS records.  Decoding SPF records uses a
fairly complex parser; storing a tokenized version wouldn't help and
would probably be bulkier.

A decade ago there were a bunch of designated sender schemes kicking
around of which SPF was by far the most complicated and kludgy, but
it's the one that survived?  Why?  Partly it's because the proponents
of SPF were much better at PR than the rest of us, but mostly it's
because they correctly recognized that publishing the sender policies
in the DNS was the most difficult step, so SPF made it really easy to
do, even at the cost of making the rest of SPF much messier.  You go
to the SPF web wizard, check a few boxes to decribe your sending
setup, and it gives you a TXT record you can paste into your DNS and
you're done.  If stuff changes, e.g., the address of a mail host, or
the set of hosts your ISP uses, it's not your problem, your own SPF
record doesn't have to change.

SPF requires that mail recipients interpret a complex and fragile
description language to come up with a set of IP addresses for each
incoming message.  The other approaches had the sender publish the
addresses directly, rather than a rule for finding them.  But that
meant that senders had to do the equivalent work before publishing the
IPs, and had to update their DNS when the set changed.  That was and
is too hard for the small senders who are the bulk of sending domains
if not the bulk of mail, so SPF won.  (Don't argue, I'm describing the
actual history.)

SPF requires a ridiculous amount of work by recipients.  The source
for libspf2 is about 17,000 lines of code, and interpreting SPF
records requires more DNS queries than any other DNS application I
know.  But all this is to work around the chokepoint of publishing DNS
records, since everything else, looking them up, and calling libraries
from mail servers, is vastly easier.

Phill is right that 4408 added the type 99 record at the last minute
since it was otherwise blocked by the DNS theorists.  Nobody I know
ever thought there was a realistic chance of existing SPF users
switching.  There is a protocol bug in 4408 due to the last minute
insertion of type 99.  Apparently none of the type 99 enthusiasts
cared enough to review the changed spec and notice the bug, but of
course in the long run it didn't matter.

I agree that it's certainly somewhat easier to get an RRTYPE than it
was a decade ago, so long as you understand that you just ignore all
the nitpickery, but reasonable people still avoid doing so because
using a prefixed TXT or other existing type is so much easier.  It's
not just because they're all stupid.

R's,
John