Re: [Uta] MTA-STS-03 review

[Daniel Margolis <[e-mail]>]

Hi,

Can you explain a little more what you mean? The mitigation is to publish a
new policy with the correct values, so certainly anyone who does so
pre-emptively is not likely to fall victim to a DoS attack. More
specifically, anyone who is _aware_ of this risk should simply ensure
untrusted individuals cannot publish content with a certificate for *.
example.com on "mta-sts.example.com"; the risk is for domains like (say)
tumblr.com who may inadvertently allow that.

On Tue, Apr 4, 2017 at 2:12 PM, ranjana mukhia <[e-mail]> wrote:

> Hi All,
>
> I have a basic question to ask related to the below-mentioned lines of the
> draft.
>
> >We additionally consider the Denial of Service risk posed by an
>
> >  attacker who can modify the DNS records for a victim domain.  Absent
> >   SMTP STS, such an attacker can cause a sending MTA to cache invalid
> >   MX records for a long TTL.  With SMTP STS, the attacker can
>
> >   additionally advertise a new, long-"max_age" SMTP STS policy with
> >  "mx" constraints that validate the malicious MX record, causing
> >   senders to cache the policy and refuse to deliver messages once the
> >   victim has resecured the MX records.
>
> >   This attack is mitigated in part by the ability of a victim domain to
> >   (at any time) publish a new policy updating the cached, malicious
> >   policy, though this does require the victim domain to both obtain a
> >   valid CA-signed certificate and to understand and properly configure
> >   SMTP STS.
>
>
>
> *can the above mentioned solution, provide the preemptive measure for avoiding the DOS attack?*
>
>
>
> Regards
>
> Ranjana
>
> Centre for Development  of Advanced Computing(CDAC),Bangalore(India)
>
>
>
>
> _______________________________________________
> Uta mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/uta
>
>