Re: [spfbis] #24: RFC 4408: Reasonable DNS error limits

[Alessandro Vesely <[e-mail]>]

On Wed 23/Jan/2013 04:22:35 +0100 Scott Kitterman wrote:
> 
> The total discussion on record length would be:
> 
>    The published SPF record for a given domain name SHOULD remain

What does /SPF record/ mean there?  Is that a TXT record beginning
with "v=spf1" or any DNS record queried during an SPF evaluation?

How about:

     For efficiency and security reasons, the DNS records that a
     domain publishes for SPF  --that is, the policy record itself as
     well as any record it references even indirectly-- are subject
     to size restrictions.
?

>    small enough that the results of a query for it will fit within
>    512 octets.  This UDP limit is defined in <xref target="RFC1035"/>

It may make sense to relax that to 4096 or whatever number we deem to
be safe nowadays, accepting Andrew's offer to dig up a suitable ref.
(Doing so would enable publishers to replace IP4s with longer IP6s
without increasing the total number of queries, for example.)

>    section 2.3.4.  This will keep even older DNS implementations from
>    falling over to TCP.  Since the answer size is dependent on many
>    things outside the scope of this document, it is only possible to
>    give this guideline: If the combined length of the DNS name and
>    the text of all the records of a given type is under 450 characters,
>    then DNS answers ought to fit in UDP packets.  Note that when
>    computing the sizes for queries of the TXT format, one has to take
>    into account any other TXT records published at the domain name.

I'd rephrase the latter sentence as:

     For TXT records in particular, especially the first one, one has
     to take into account the size of any other TXT records published
     at the same domain name.

>    Records that are too long to fit in a single UDP packet could be
>    silently ignored by SPF verifiers due to firewall and other issues
>    that cause DNS over TCP to be less reliable than DNS over UDP.

Although that is  a /could be/, not a MAY, would we consider an
implementation to be conforming if it aborts SPF evaluation when it
finds unreasonably long records?  That's why I mentioned security in
the proposed rewording above.