Subject: RE: [Asrg] 6. Proposals - rDNS and DNS considerations

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 2 Dec 2003 16:31:44 -0800

Following on on the rDNS track I did some investigation on the rDNS and DNS
side. The following issues were raised off list:

1) Is rDNS stable enough to depend on?
	Maybe. The quality of the data registered for North America and
European zones is 'reasonable'. It is not great but not ridiculous. The
quality of the data in the Asian zones is not at all good.

	One issue to consider is that some of the NICs have been proposing
to kill rDNS since "nobody uses it and it is no damn use".

	The feeling I got was that if a proposal that depended on rDNS was
deployed it would probably create a sufficient incentive for folk to fix the
stuff that needs fixing.

2) Can rDNS support other record types?
	I have not got a definitive answer here yet but the answer so far is
'don't see why not'. The 'reverse DNS' is only a chunk of the .arpa address
space that has been repurposed. There is nothing magic about it.

	The state of rDNS suggests that if anyone has an app out there that
is so fragile that it would be broken by a few TXT records then the best
thing to do is to blow it up now and put it out of our misery. RTFM

	There may be a theoretical chance that someone has built something
that depends on an assumption that rDNS is monolithic and unchanged. This
chance appears to be very small and the chance we should care is negligible.

3) (DNS and rDNS) Should we use TXT records or some new record type?
	The issues here are political and technical. The technical issues
have been discussed at some length. Basically getting a new record type is
the Kosher way to do the job but the issue of what the impact on the
deployed infrastracture would be is somewhat muddy. I don't think we need to
bother with the clarification, the political issues determine the matter.

	To get a DNS resource record assigned we have to have an (IETF)
standard. It is possible that the DNSEXT working group could act quickly,
this seems to mean order of 18 months to be realistic. That is not going to
be acceptable. It is not like we get a record type assignment and then get
to work with it.

	I described the RMX and SPF approaches. Encoding protocol names into
the DNS is now acceptable and is compatible with 'fast' tracking through the
working group. When I described the idea of encoding IP addresses I got a
period of silence and then 'thats what folk call a domain name hack'. I did
not get a feeling that the process would be at all short. Basically this is
the sort of proposal where people start suggesting that you build something
other than DNS.

	My take is that we should use TXT and if anyone criticizes us tell
them we will consider using a resource record if they tell us the numbers in
advance, otherwise no deal. [There is a reason I started using all those URI
based namespace designators, I loath registration processes, particularly
when they are used for control]

4) What are the realistic DNS spoofing and IPO address poisoning
vulnerabilities?
	Good news here, I have not got a definitive word but BIND9 is highly
resistant to domain name cache poisoning. There are still a lot of people
using BIND8 for performance reasons but that is not a major concern for us.
If you are running BIND8 turn on LMAP and then find spammers are attacking
you with cache poisoning you upgrade to BIND9.

	The IP spoofing issue seems to be unimportant. Although DNS is not
proof against this attack it is in practice pretty difficult with a low
probability of success and is very easy for the victim to detect.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 3 Dec 2003 01:56:37 +0100

> side. The following issues were raised off list:

Thanks. This is great stuff.

> be acceptable. It is not like we get a record type assignment and then get

Due to the threat caused by spam it might happen that the DNSEXT working
group could speed up things. However this would IMHO require that the
proposal is a stable and practicable solution with a high probability of
success. QTYPE is two octets and I don't think DNS will take large
damage if it turns out that one TYPE has been "misassigned" ;-)

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 02 Dec 2003 20:01:28 -0500

> damage if it turns out that one TYPE has been "misassigned" ;-)

I would like to make a suggestion related to this proposal. There are 
two separate issues involved here: one has to do with the idea itself, 
and another with the implementation. In order to be able to gauge the 
issue itself better before getting into the nitty-gritty of the 
implementation details, a discussion of the idea would be useful, either 
as a separate document, or as part of the main document. This should 
follow the checklist in the end of 
(http://www.ietf.org/internet-drafts/draft-crocker-spam-techconsider-02.txt).

If you can do that, that would help us analyze and look at different 
issues better.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"I ate your Web page. / Forgive me. It was juicy / And tart on my 
tongue." (MIT's 404 Message)
-------

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 02 Dec 2003 22:16:09 -0500

> to kill rDNS since "nobody uses it and it is no damn use".

Are you refering to the regional registries (RIPE, APNIC, etc.)?

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"And this too shall come to pass"
-------