Re: [spfbis] RFC6147 and RFC7208 interoperability issues

[Andrew Sullivan <[e-mail]>]

On Mon, Feb 07, 2022 at 12:09:11AM +0000, Klaus Frank wrote:
>On 2022-02-06 23:47, Andrew Sullivan wrote:
>
>But it wouldn't be "every TXT record". If it doesn't start with 
>"v=spf1" it can be passed as is and does not require parsing. And even 
>then it's also a defined structure and not "arbitrary".

That is only true if you assume that the only case that counts is SPF.  But of course, that probably _isn't_ true.  Moreover, you still have to look at every TXT record and examine the RDATA.  That's not true for the other kinds of records: if you're a DNS64 you know that the A records are something you're going to have to process and you can have a high confidence that you'll probably need to process PTR records too.  What you are proposing is that the DNS64 needs to grab every TXT too, then look at the RDATA and _decide_ whether to process it, which is way more complicated.

>Actually the only limitation for that is the SPF record not being 
>updated by DNS64.

Sounds like a pretty severe limitation to me!

>What do you have in mind? What else would be there?

Anything could be in a TXT record, and once we start setting the precedent that the DNS64 should do rewrites of arbitrary text to capture certain relevant IPv4 addresses and make them IPv6 addresses with the appropriate prefix, there's no reason one has to stop at SPF.  The whole argument for using TXT records for SPF was that it was easy and you get to put what you want in a TXT.  But since "you get to put what you want", you have to live with the fact that there's not structured data in there from the point of view of the DNS.  Just because some other protocol wants to overload TXT and put structure into it does not mean that the DNS ought to be handling that RDATA programmatically.  TXT is arbitrary text data.

>As nothing else contains IP addresses but only dns names. I've 
>looked at the other record types. Did I miss something?

There's nothing that says that SPF is the only use of TXT here, so I don't see how you looking at your sample is proof of anything.  If DNS64 is supposed to start munging TXT records then it needs to do so in some predictable way.  If instead you want a neat hack of the sort John Levine suggested in order to generate the records on the fly, I certainly see the utility.  But I don't think standardizing that as part of DNS64 is a good idea.

Best regards,

A

-- 
Andrew Sullivan
[e-mail]