Re: [spfbis] RFC6147 and RFC7208 interoperability issues

[Andrew Sullivan <[e-mail]>]

Hi,

I'm one of the primary offenders behind DNS64.  I work for the Internet Society but I am not speaking for them (or anyone eles) right now.

On Sun, Feb 06, 2022 at 02:57:08PM -0500, Scott Kitterman wrote:

>I think your original suggestion that an SPF record be modified by the DNS64
>server to add ip6: mechanisms with <prefix> + <address> is a reasonable path
>forward, but I think it's really an RFC 6147 discussion, not so much RFC 7208.

The problem with this is that it's importing the DNS64 intimate knowledge of this protocol for TXT records, which means in effect that DNS64 needs to start parsing arbitrary data in TXT records.  (There is a reason DNS weenies always got upset about ignoring the strong typing in DNS, and this is an example of it.)

DNS64, to be honest, was always sort of a hack that was intended to make transition to v6 easier.  It really basically depended on the strong data typing of A, AAAA, and PTR records in order to give it clear places to insert itself.  "Look at every TXT record," doesn't really support that plan.  I never thought we were designing it for long life or high degrees of robustness, and I think it is likely to be extremely difficult to operate a modern mail server on v6-only infrastructure and be able to talk to v4-only mail servers.  In any case, I guess it would be _possible_ to teach a DNS64 server to parse and edit TXT records on the fly, but the idea that this is going to be limited to SPF is, I suspect, a false hope.  For that reason, my reaction is that it wouldn't be a great idea to do.  I nevertheless sympathize with the desire, even though I am made nervous about the implications.

>It is not, however, without risks.  RFC 7208 Section 3.4 gives advice on SPF
>record size.  Your proposed approach would increase the record size, which, in
>theory, could be problematic.  It might be that anything running on an IPv6
>only network is modern enough that this isn't actually a problem.  I don't
>know.

I'd be especially worried about RRset size, because a lot of stuff in contemporary operations is jammed into TXT records (all those application keys, for instance).  I can imagine cases where the change could move the response size across the response size boundary, forcing truncation and TCP fallback.

Best regards,

A

-- 
Andrew Sullivan
[e-mail]