Re: [spfbis] RFC6147 and RFC7208 interoperability issues

[Klaus Frank <[e-mail]>]

On 2022-02-06 23:47, Andrew Sullivan wrote:
> It really basically depended on the strong data typing of A, AAAA, and 
> PTR records in order to give it clear places to insert itself.  "Look 
> at every TXT record," doesn't really support that plan. 

But it wouldn't be "every TXT record". If it doesn't start with "v=spf1" 
it can be passed as is and does not require parsing. And even then it's 
also a defined structure and not "arbitrary".

On 2022-02-06 23:47, Andrew Sullivan wrote:
> I never thought we were designing it for long life or high degrees of 
> robustness, and I think it is likely to be extremely difficult to 
> operate a modern mail server on v6-only infrastructure and be able to 
> talk to v4-only mail servers.

Actually the only limitation for that is the SPF record not being 
updated by DNS64... And for outgoing it's not an issue at all. A 
stateless NAT64 mapping is enough...

A combination of stateless and statefull NAT64 is enough to cover all 
the ugly IPv4 stuff. Also because IPv4 was already highly NAT44ed 
anyway. There is no difference between a mail server behind a NAT44 and 
one behind a NAT64 as long as the correct public facing IP is used in 
the configuration of one owns SPF record...

But tbh, in some situations it would be very helpful if I could just 
swap the calls for generating IPv4 packets by one that generates IPv6 
packets instead. I thought about writing something that works via 
LD_PRELOAD similarly to torsocks or IP2Unix, but it went way over my 
head to make it anything close to performant and reliable...

On 2022-02-06 23:47, Andrew Sullivan wrote:
> but the idea that this is going to be limited to SPF is, I suspect, a 
> false hope.  For that reason, my reaction is that it wouldn't be a 
> great idea to do.
What do you have in mind? What else would be there? From my point of few 
the only thing missing for a complete DNS64 rewrite is the SPF record. 
As nothing else contains IP addresses but only dns names. I've looked at 
the other record types. Did I miss something?