Re: [dnsext] I-D Action:draft-ietf-dnsext-aliasing-requirements-00.txt

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Tony F
inch writes:
> On Fri, 4 Mar 2011, Mark Andrews wrote:
> >
> > No.  SMTP is store and forward.
> 
> That makes no difference.

It makes all the difference in the world.  MX records DO NOT AND NEVER
HAVE DEFINED FINAL DELIVER they have only ever defined the NEXT HOP.
 
> Most store-and-forward hops in SMTP are within an organization, and in
> that situation mail routing is not based on the MX records of the
> recipients' mail domains. (cf. message submission) The organization can
> secure its mail transmission using its knowledge of its own setup.
> 
> The important and difficult case is inter-domain SMTP which does rely on
> MX records and cannot rely on prior arrangements for authentication.

And that is done by publishing MX records (secure with DNSSEC) or in their
absence (secure with DNSSEC) constructing a MX record from the A/AAAA records
(secure with DNSSEC).
 
> > The MX records (cryptographically verifiable with DNSSEC) say that you
> > should be talking to mx.cam.ac.uk and if you don't get a TLS connection
> > that says you are talking to that machine you should drop the SMTP
> > connection.
> 
> TLS predates DNSSEC.

Yes and it did not work securely because there was no way to validate
the DNS responses.

> It security model assumes DNSSEC does not exist.

The security model assumed the DNS responses were good.  We can now
prove they are good.

> Therefore TLS must authenticate the domain seen by the end user. It makes
> no sense to authenticate the MX target hostname because that makes you
> vulnerable to spoofing.

Nope.  Flawed logic here.

> Tony.
> -- 
> f.anthony.n.finch  <[e-mail]>  http://dotat.at/
> Irish Sea: Variable 3 or 4. Slight. Fog patches. Moderate, occasionally very
> poor.
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]