Subject: [Asrg] a plea for more hierarchy in DNS

From: Markus Stumpf <[email-masked]>
Date: Tue, 19 Oct 2004 00:40:44 +0200

We plan to widely implement greylisting.
For that we want to establish a whitelist of "wellknown" mailservers
to reduce the inpact and spare some useless rejections and time delays.

To build an initial list and to not be *that* dependant on IP addresses
we took some logfiles worth of some million connections and eliminated
all the obvious
    dyn-83-157-187-223.ppp.tiscali.fr [83.157.187.223]
    200-140-011-028.bsace705.dsl.brasiltelecom.net.br [200.140.11.28]
    dsl-201-129-15-54.prod-infinitum.com.mx [201.129.15.54]
    [ ... ]
stuff.

However we noticed that even mailserver farms are named as braindamaged
and hierarchy breaking as the example above. Why does it have to be
    mail-[0-9][0-9].iinet.net.au
instead of
    host[0-9][09-].mail.iinet.net.au

Or
    outfbmx___.isp.belgacom.be
    mail-relay_.ubc.ca
    mx_.uniserve.ca
    mx__.bluewin.ch
    cernmx__.cern.ch
    mta-_s-be-__.sunrise.ch
    mail-store-____.amazon.com
    smtp-out-____.amazon.com
    mail-out_.apple.com
    sj-iport-_-in.cisco.com
    cnnimail__.cnn.com
    siaag___.compuserve.com
    mxpool__.ebay.com
    mxsmfpool__.ebay.com
    fmr__.intel.com
    mail__.messagelabs.com
    inet-mail_.oracle.com
    exprod6mo_.postini.com
this list is endless and even companies that are deeply involved in the
Internet and eMail services and that use the Internet for ages seem to
not know how to do it right.

It would be more correct and so much easier to anti-greylist
    .mail.domain.tld
instead of adding 20 records
    mail-smtp-01.domainl.tld
    ...
    mail-smtp-20.domainl.tld

Why do they all flaten or reverse the RtoL hierarchy idea of the DNS as
soon as it reaches their own administration?
*sigh*

	\Maex

P.S. Yes, I am fully aware of the security implications caused by trusting
     information derived from a reverse DNS lookup.

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jochen Topf <[email-masked]>
Date: Tue, 19 Oct 2004 09:25:33 +0200

>     host[0-9][09-].mail.iinet.net.au

Because when you are an admin inside the organisation you'll use only
the hostname and not the FQDN most of the time. And you don't want to
ask yourself all the time whether "host165" is "host165.mail" or
"host165.web" or whatever (which depends on how your resolver is configured).

Jochen
-- 
Jochen Topf  [email-masked]  http://www.remote.org/jochen/  +49-721-388298

---

From: Matthias Leisi <[email-masked]>
Date: Tue, 19 Oct 2004 17:43:17 +0200

> to reduce the inpact and spare some useless rejections and time delays.

Not (only) for greylisting, but for general spam filter at a financial 
services company, I tried to initiate a DNS-based whitelist. I did not 
advance this idea further, but would be glad to participate in such an 
effort.

A very rough start is at http://matthias.leisi.net/dnswl/

Maybe the ASRG list is not the appropriate place to discuss, so maybe we 
can discuss it off list.

-- Matthias

-- 
Brain-Log                               http://matthias.leisi.net/

---

From: Markus Stumpf <[email-masked]>
Date: Tue, 19 Oct 2004 19:21:32 +0200

> "host165.web" or whatever (which depends on how your resolver is configured).

Exactly what is the difference between typing
    smtp-out-185
and
    185.smtp-out
Even the nummer of characters is the same.

And if you have a farm of mailservers or webserver which is used for
loadbalancing and you have to log in to those all the time you're
doing something wrong in principle.
And if an "admin" can't configure the prompt or window title or anything
else well enough that he can work with it and know where he is that is
not the problem of the rest of the Internet.
And if an "admin" doesn't know how to use CNAMEs or maybe even how to do
split DNS for his convenience it is quite a miserable admin.

If an "admin" cannot handle this he should probably talk to the people
at AOL or Yahoo or getit or many others that know how to do it right:
    imo-___.mx.aol.com
    lsvsm-m__.elist.aol.com
    web____.mail.in.yahoo.com
    ____.bulk.scd.yahoo.com
    nl__.mx.getit.de
or even gmail that uses about 10 different hosts, but they all have
the same name externally. This must be the horror for an admin, all
hosts with the same name.

	\Maex