Re: [spfbis] RFC6147 and RFC7208 interoperability issues

[[e-mail]]

Yeah, I wasn't thrilled with the idea of SPF using TXT record way back 
when. It opened it for quite a few others who followed. Putting ip 
addresses there though is not something that is done for any other 
protocol or software I can immediately think of.

I'm curious, how does DNS64 inter-operates with DNSSEC? Would that not 
break it and make DNSSEC folks very uncomfortable about what others 
could decide to do?

I think it could be helpful to collect various protocol operational and 
similar issues for those running mail servers (and other servers) behind 
NAT64 and write informational RFC which would be soft of experimental 
best practice. I'd expect that some server software would have to add 
special features to be used in this setup.

On 2022-02-06 14:47, Andrew Sullivan wrote:

> Hi,
> 
> I'm one of the primary offenders behind DNS64.  I work for the Internet 
> Society but I am not speaking for them (or anyone eles) right now.
> 
> On Sun, Feb 06, 2022 at 02:57:08PM -0500, Scott Kitterman wrote:
> 
>> I think your original suggestion that an SPF record be modified by the 
>> DNS64
>> server to add ip6: mechanisms with <prefix> + <address> is a 
>> reasonable path
>> forward, but I think it's really an RFC 6147 discussion, not so much 
>> RFC 7208.
> 
> The problem with this is that it's importing the DNS64 intimate 
> knowledge of this protocol for TXT records, which means in effect that 
> DNS64 needs to start parsing arbitrary data in TXT records.  (There is 
> a reason DNS weenies always got upset about ignoring the strong typing 
> in DNS, and this is an example of it.)
> 
> DNS64, to be honest, was always sort of a hack that was intended to 
> make transition to v6 easier.  It really basically depended on the 
> strong data typing of A, AAAA, and PTR records in order to give it 
> clear places to insert itself.  "Look at every TXT record," doesn't 
> really support that plan.  I never thought we were designing it for 
> long life or high degrees of robustness, and I think it is likely to be 
> extremely difficult to operate a modern mail server on v6-only 
> infrastructure and be able to talk to v4-only mail servers.  In any 
> case, I guess it would be _possible_ to teach a DNS64 server to parse 
> and edit TXT records on the fly, but the idea that this is going to be 
> limited to SPF is, I suspect, a false hope.  For that reason, my 
> reaction is that it wouldn't be a great idea to do.  I nevertheless 
> sympathize with the desire, even though I am made nervous about the 
> implications.
> 
>> It is not, however, without risks.  RFC 7208 Section 3.4 gives advice 
>> on SPF
>> record size.  Your proposed approach would increase the record size, 
>> which, in
>> theory, could be problematic.  It might be that anything running on an 
>> IPv6
>> only network is modern enough that this isn't actually a problem.  I 
>> don't
>> know.
> 
> I'd be especially worried about RRset size, because a lot of stuff in 
> contemporary operations is jammed into TXT records (all those 
> application keys, for instance).  I can imagine cases where the change 
> could move the response size across the response size boundary, forcing 
> truncation and TCP fallback.
> 
> Best regards,
> 
> A