IETF Logo Mail Archive

Re: [DNSOP] [dns-operations] dnsop-any-notimp violates the DNS standards

Tony Finch <dot@dotat.at> Mon, 09 March 2015 14:58 UTC

Return-Path: <fanf2@hermes.cam.ac.uk>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDD321A8A7C for <dnsop@ietfa.amsl.com>; Mon, 9 Mar 2015 07:58:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.211
X-Spam-Level:
X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4cGXRAEyaWV8 for <dnsop@ietfa.amsl.com>; Mon, 9 Mar 2015 07:58:30 -0700 (PDT)
Received: from ppsw-51.csi.cam.ac.uk (ppsw-51.csi.cam.ac.uk [131.111.8.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 076131A8BB5 for <dnsop@ietf.org>; Mon, 9 Mar 2015 07:54:28 -0700 (PDT)
X-Cam-AntiVirus: no malware found
X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/
Received: from hermes-1.csi.cam.ac.uk ([131.111.8.51]:53445) by ppsw-51.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.157]:25) with esmtpa (EXTERNAL:fanf2) id 1YUz4c-0000b9-XF (Exim 4.82_3-c0e5623) (return-path <fanf2@hermes.cam.ac.uk>); Mon, 09 Mar 2015 14:54:26 +0000
Received: from fanf2 by hermes-1.csi.cam.ac.uk (hermes.cam.ac.uk) with local id 1YUz4c-0004vr-8k (Exim 4.72) (return-path <fanf2@hermes.cam.ac.uk>); Mon, 09 Mar 2015 14:54:26 +0000
Date: Mon, 09 Mar 2015 14:54:26 +0000
From: Tony Finch <dot@dotat.at>
X-X-Sender: fanf2@hermes-1.csi.cam.ac.uk
To: "D. J. Bernstein" <djb@cr.yp.to>
In-Reply-To: <20150309110803.4516.qmail@cr.yp.to>
Message-ID: <alpine.LSU.2.00.1503091438050.23307@hermes-1.csi.cam.ac.uk>
References: <20150309110803.4516.qmail@cr.yp.to>
User-Agent: Alpine 2.00 (LSU 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"
Sender: Tony Finch <fanf2@hermes.cam.ac.uk>
Archived-At: <http://mailarchive.ietf.org/arch/msg/dnsop/4L_CbzMMoG90oEUfrz2YO9PmBw8>
Cc: dnsop@ietf.org, dns-operations@dns-oarc.net
Subject: Re: [DNSOP] [dns-operations] dnsop-any-notimp violates the DNS standards
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Mar 2015 14:58:32 -0000

D. J. Bernstein <djb@cr.yp.to> wrote:

> My "qmail" software is very widely deployed (on roughly 1 million SMTP
> server IP addresses) and, by default, relies upon ANY queries in a way
> that is guaranteed to work by the mandatory DNS standards.

There are three bugs in the way qmail uses ANY queries.

(1) qmail uses ANY queries for domain canonicalization on outgoing
messages, as specified by RFC 1123. But canonicalization is not required
by the current SMTP specification. It is a waste of time. Fixing this bug
would make bug (3) moot.

(2) qmail's DNS response buffer is too small to accommodate a complete DNS
message, so it fails if it gets a large response. It uses the low-level
libc resolver API which can easily handle large responses, including
fallback to TCP, so it is a pity that qmail breaks this part of the
resolver's functionality. This bug means it is not guaranteed to work.

(3) Using an ANY query suppresses alias processing, so qmail makes a
series of queries to follow CNAME chains. This is inefficient and
wasteful. If you make an A or MX query, the DNS server will chase the
CNAME chain for you, so you only need to make one query to get the
canonical name.

Tony.
-- 
f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
Trafalgar: Easterly 5 or 6 in far southeast, otherwise northerly 4 or 5.
Moderate or rough. Mainly fair. Good.

v2.23.0 | Report a Bug | By Email