Re: [dnsext] SPF, a cautionary tale

[[e-mail]]

On Sat, May 04, 2013 at 11:16:38AM -0400, John R Levine wrote:
> >>... and interpreting SPF records requires more DNS queries than any 
> >>other DNS application I know.
> 
> >	So what you are saying is that SPF is a carefully crafted DNS
> >	DDoS attack because it was too hard to do the work inside your
> >	own protocol?
> 
> Yup, just like CNAME.
>

	excuse me,  how do you reconcile your first statement; "more DNS queries
	than -any- other DNS application I know"  with "just like CNAME"

	CNAME semantics and behaviour are well known and studied.  You get -ONE-
	redirect.   Other DNS tricks have been DNS-abusive and have been abandon
	(BITSTRING) or redesigned (KEY/SIG).

> In the decade that SPF has been around, the putative DDoS has never been 
> observed in the wild, ever, despite Doug Otis warning us about it every 15 
> minutes since 4408 was a draft, and a few experiments I did with stunt DNS 
> servers that returned giant trees of SPF records very slowly.  It turns 
> out everyone does loop breaking, just like for CNAME.  It's a sloppy 
> design from a decade ago that succeeded because it made an end run around 
> the DNS provisioning problems of "better" alternatives.

	care to publish the experiment and its results?
	I'd like to replicate it.

> >	What ever happened to "Be Conservative in What you Send..."
> 
> It lost out to Stuff That Actually Exists Works Better than Stuff That 
> Doesn't.


	actually, not so much - there is certainly a whole lot of parasitic 
	behaviour in this decades work - there appears to be evidence that 
	the SPF RR type exists and works.

> A decade ago, SPF was far from my favorite authentication design, but now 
> it exists, it's more widely used than most standards track protocols, and 
> it would be silly to pretend otherwise.  Hence the spfbis charter to 
> standardize existing practice.

	Now that I have a hard time believing... "more widely used that most
	standards track protocols"  is a mightly big brush.  Perhaps you want
	to focus on SMTP authentication - then I would have an easier time 
	believing you.

> R's,
> John