Re: [dnsext] Obsoleting SPF RRTYPE

[Patrik Fältström <[e-mail]>]

On 30 apr 2013, at 05:22, David Conrad <[e-mail]> wrote:

>> The only concern is that pushing more data into TXT records is that, if more than one application does this and involves the same name, we are increasing the number of large RRsets pushed around.
> 
> Well, no. That's not the only concern:
> 
> 1) it moves the mechanism to uniquify a DNS response out of the DNS library and into the application, forcing every protocol-specific library or application to have to deal with uniquifying the response in their own unique (and undoubtedly in some cases fascinating) way;
> 
> 2) given individual RR order within an RRset is not guaranteed, it significantly complicates TXT RDATA parsing logic for any application that cares about TXT RRs;
> 
> 3) It means you've reduced the amount of usable space in the RDATA since you have to have some unique string in the RDATA to key off of; and
> 
> 4) because other protocols may use TXT at the same (unfortunately common) ownername, it becomes more probable that the size of the response will go over the 512 limit resulting in fragmentation or fallback to TCP increases, which imposes potential load and reachability issues, not just for SPF but for any other protocol that is using TXT at that ownername

As I have written before:

5) As multiple different usages of RR in DNS use the same owner and class, separation of the records in the query/response must be done via prefix on the owner. This implies multiple records can end up on different sides of a zone cut where a DNSSEC administrative boundary is located. For example, the MX might be signed, but the TXT for the same domain, but with a prefix, might be unsigned. The security implications of such differences in DNSSEC implications (key rollower etc) has not been investigated. I believe it is a weakness, or rather, it is a strength that all records that are "similar" can have the same owner and because of that be in the same zone.

It was not a coincidence I took the initiative to write RFC 5507. I am _really_ concerned over use of TXT the way it is done by the SPF "solution".

   Patrik