Re: [DNSOP] Validating responses when following unsigned CNAME chains...

Michael StJohns <> Thu, 30 April 2020 18:31 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8CFC23A0EC2 for <>; Thu, 30 Apr 2020 11:31:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id h2DhEmx4a1rN for <>; Thu, 30 Apr 2020 11:31:19 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id EED363A0EBA for <>; Thu, 30 Apr 2020 11:31:18 -0700 (PDT)
Received: by with SMTP id g26so2030019qtv.13 for <>; Thu, 30 Apr 2020 11:31:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language; bh=emR7EOhdk7g/tvdiB7iuTLqmKwwHx281Cki9BL/u4TM=; b=ZOatqu9Ib3mfHpisLlqBefpLdVTzjQD6f/fjPQkk8WuubdgvGpmFI2uSCo94ftWXNq jxVql9YND6gsGf2WxsaDBThwzAfMlujDg6qN170yNnnR3tlJpuK63rVE1Ro7sR+Kvuv0 a8ua0P3ePpQ2PNvtmolfaCqfLS4Bk9kM5IHYxwQ1jjIGpey15/EnwplAxSyniELZPzdQ Pe75tWneB/Poh8sCj050VLli/lTkhED7WU8g30J9qqeuUCYeINY56FFv6dmt6Zs8MrUE GHhx6/Vd6iMCKNAi/XL9Wf26R3mZpTBT12O8m4F5KaspSk41941Iu+1b15wNWi13npcH 9CxQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language; bh=emR7EOhdk7g/tvdiB7iuTLqmKwwHx281Cki9BL/u4TM=; b=H1kxg161ac1AMD6iACxBiIYSkOFDLDOyQr/C6rZlfrAfuCasdMVxAsD6VBdsKxTDzS 2IIk63ZlhdsjJN+Dn1brKh9ylg8Qugp/EhcJs9Dz0yT0L8osNbRzUTCCz2MKmCIY9jXr JF2tiQl66sxdrKGBzocPl3aZGmNLI7ZDDTG/suhM+1QkhDd/Y/wOVaqCMyRufpHb2AMF mEB/5E/EHd4MsvhX2ssOaYB3mkIGW0bI5iRVBco1U0/hYIsL+7TJRiTG9OaNFLJDsyBs +c6z8HoMbrACIFPYGnCcZhqnQCL1k80LAZlcJGefE1gka15ZmyB6xULO0DLfQru6K3rY AFMg==
X-Gm-Message-State: AGi0PuafdvXvkLRZxA/SbcZm1rdy27phpOEAoFBofCbTcm6wfxP5Hjtr tCPK2zCRnxdDSwVB367tGpv2f9rVgik87w==
X-Google-Smtp-Source: APiQypJI+ZFui5iF8+Lbm/kA3cGCIuklUuI0jeqAljEF3k7bykJqqBUZmJINv0zZVtkJkgaUuqHDhA==
X-Received: by 2002:aed:253c:: with SMTP id v57mr5055257qtc.63.1588271476999; Thu, 30 Apr 2020 11:31:16 -0700 (PDT)
Received: from [] ( []) by with ESMTPSA id e186sm680010qkb.40.2020. (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 30 Apr 2020 11:31:15 -0700 (PDT)
To: Ted Lemon <>
References: <> <> <>
From: Michael StJohns <>
Message-ID: <>
Date: Thu, 30 Apr 2020 14:31:13 -0400
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: multipart/alternative; boundary="------------EA73503DBFFBC4C0C6B2FF5F"
Content-Language: en-US
Archived-At: <>
Subject: Re: [DNSOP] Validating responses when following unsigned CNAME chains...
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 30 Apr 2020 18:31:23 -0000

On 4/30/2020 11:15 AM, Ted Lemon wrote:
> On Apr 29, 2020, at 8:01 PM, Michael StJohns < 
> <>> wrote:
>> If you've got an securely insecure (e.g. delegation was to an 
>> insecure zone at some point) CNAME that points into a secure zone, I 
>> would say your result is probably Bogus  or Unsecure as you haven't 
>> any way to evaluate trust.  I don't think you can bootstrap security 
>> this way.
> I agree that you can’t bootstrap security this way. I would agree that 
> the answer can’t have the AD bit set. However, I don’t see why this 
> arrangement should be considered bogus.
Because an attacker can twiddle with a CNAME.  So while the recipient 
sees a CNAME pointing at a validatable end item, that may not have been 
the end name the publisher provided.   I'd probably say unsecure though, 
as I don't expect the client can detect bogus in this case unless there 
was a rule saying this was a bogus configuration.


ps - What's the validation level for a secured CNAME that points at an 
unsecured CNAME that points to a secured A record?