IETF Logo Mail Archive

Re: [DNSOP] Draft Reverse DNS in IPv6 for Internet Service Providers

Hosnieh Rafiee <hosnieh.rafiee@huawei.com> Thu, 23 October 2014 11:59 UTC

Return-Path: <hosnieh.rafiee@huawei.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ACD601A9028 for <dnsop@ietfa.amsl.com>; Thu, 23 Oct 2014 04:59:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.211
X-Spam-Level:
X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wbeuz38ah9XF for <dnsop@ietfa.amsl.com>; Thu, 23 Oct 2014 04:59:13 -0700 (PDT)
Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4BD71A901F for <dnsop@ietf.org>; Thu, 23 Oct 2014 04:59:12 -0700 (PDT)
Received: from 172.18.7.190 (EHLO lhreml403-hub.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id BKW02643; Thu, 23 Oct 2014 11:59:07 +0000 (GMT)
Received: from LHREML513-MBB.china.huawei.com ([fe80::b810:863:a57e:3ff]) by lhreml403-hub.china.huawei.com ([::1]) with mapi id 14.03.0158.001; Thu, 23 Oct 2014 12:59:04 +0100
From: Hosnieh Rafiee <hosnieh.rafiee@huawei.com>
To: Mwendwa Kivuva <Kivuva@transworldafrica.com>, dnsop <dnsop@ietf.org>
Thread-Topic: [DNSOP] Draft Reverse DNS in IPv6 for Internet Service Providers
Thread-Index: AQHP7rPL0KGe3cgDe0WdvohVJ9Z2ypw9kcfQ
Date: Thu, 23 Oct 2014 11:59:03 +0000
Message-ID: <814D0BFB77D95844A01CA29B44CBF8A7A4BDBE@lhreml513-mbb.china.huawei.com>
References: <CAEhPqwq4-b7KzVUnOLYPnm2oOhLGmBNU8tCeGAA+NrZwJEuMyA@mail.gmail.com>
In-Reply-To: <CAEhPqwq4-b7KzVUnOLYPnm2oOhLGmBNU8tCeGAA+NrZwJEuMyA@mail.gmail.com>
Accept-Language: zh-CN, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.221.82.100]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-CFilter-Loop: Reflected
Archived-At: http://mailarchive.ietf.org/arch/msg/dnsop/sSsNlh-5e1gY7EViFvnHwfMvvaQ
Subject: Re: [DNSOP] Draft Reverse DNS in IPv6 for Internet Service Providers
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 23 Oct 2014 11:59:14 -0000


and given the weakness of the Reverse DNS access for security purposes, what problem is this draft trying to solve? If we need to find the host that has sent an email associated with an address, would we better let DKIM address that without a separate lookup in the receiving server? DKIM detects email spoofing by using digital signature allowing receiving mail exchangers to check that incoming mail from a domain is authorized by that domain's administrators. 

Is there a better way to approach the problem?

I do not claim it is a best way but I think CGA-TSIG can easily handle many similar scenarios.
You can check the old version here
http://datatracker.ietf.org/doc/draft-rafiee-intarea-cga-tsig/
and upcoming version here
<http://editor.rozanak.com/show.aspx?u=AZCDD03D4DBABD14DA80CDTAM  >

Hosnieh

v2.23.0 | Report a Bug | By Email