Re: [dnsext] SPF, a cautionary tale

[Douglas Otis <[e-mail]>]

On May 4, 2013, at 6:22 PM, [e-mail] wrote:

> On Sat, May 04, 2013 at 11:16:38AM -0400, John R Levine wrote:
>>>> ... and interpreting SPF records requires more DNS queries than any 
>>>> other DNS application I know.
>> 
>>> 	So what you are saying is that SPF is a carefully crafted DNS
>>> 	DDoS attack because it was too hard to do the work inside your
>>> 	own protocol?
>> 
>> Yup, just like CNAME.
>> 
> 
> 	excuse me,  how do you reconcile your first statement; "more DNS queries
> 	than -any- other DNS application I know"  with "just like CNAME"
> 
> 	CNAME semantics and behaviour are well known and studied.  You get -ONE-
> 	redirect.   Other DNS tricks have been DNS-abusive and have been abandon
> 	(BITSTRING) or redesigned (KEY/SIG).
> 
>> In the decade that SPF has been around, the putative DDoS has never been 
>> observed in the wild, ever, despite Doug Otis warning us about it every 15 
>> minutes since 4408 was a draft, and a few experiments I did with stunt DNS 
>> servers that returned giant trees of SPF records very slowly.  It turns 
>> out everyone does loop breaking, just like for CNAME.  It's a sloppy 
>> design from a decade ago that succeeded because it made an end run around 
>> the DNS provisioning problems of "better" alternatives.
> 
> 	care to publish the experiment and its results?
> 	I'd like to replicate it.
> 
>>> 	What ever happened to "Be Conservative in What you Send..."
>> 
>> It lost out to Stuff That Actually Exists Works Better than Stuff That 
>> Doesn't.
> 
> 
> 	actually, not so much - there is certainly a whole lot of parasitic 
> 	behaviour in this decades work - there appears to be evidence that 
> 	the SPF RR type exists and works.
> 
>> A decade ago, SPF was far from my favorite authentication design, but now 
>> it exists, it's more widely used than most standards track protocols, and 
>> it would be silly to pretend otherwise.  Hence the spfbis charter to 
>> standardize existing practice.
> 
> 	Now that I have a hard time believing... "more widely used that most
> 	standards track protocols"  is a mightly big brush.  Perhaps you want
> 	to focus on SMTP authentication - then I would have an easier time 
> 	believing you.
> 
>> R's,
>> John

Dear Bill and John,

May I also add, SPF verification of the Mail From parameter provides authorization for Non-Delivery Notifications.  It does not provide any form of Authentication.

Regards,
Douglas Otis