Subject: RE: SSP RR vs TXT [was Re: [ietf-dkim] SSP and o= values]

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 27 Mar 2006 21:13:53 -0800

The statement made by Microsoft was that none of the Microsoft DNS servers
have the ability to publish new RRs without breaking the administration
model completely. In particular they have no administration tool for
entering the RRs and no way to save them out.
 
It is possible to enter RR values into the database by non standard
administration interfaces but not by a method that survives a reboot.
 
Given the amount of disinformation and the refusal of the DNS group to
accept the statements made by Microsoft then I am not too inclined to accept
heresay statements on the subject now. 
 
For deployment of a new RR to be possible it must be supported to production
quality for the platform concerned. On the windows platform that means that
it has to be possible to enter the RR through the standard administrative
interface. 

There are a few changes in Windows 2003 R2. In particular the server can be
configured to allow through DNSSEC records from other DNS servers and to
accept zone transfers for unsupported records. I am unable to find a
description of how to enter an unsupported RR through either the command
line or GUI.
 
On the plus size the default UDP packet size is 1260 bytes, not 512. If we
are all so confident that new RRs will work then why does everyone (Olafur
included) pay such strict attention to this particular limit? 
 
I think that what we are seeing here is more wishful thinking by people who
are not going to be damaged by the consequences. If they can get us to make
DKIM dependent on deployment of the infrastructure necessary to support new
RRs then they don't have to do that job. 

  _____  

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Jim Fenton
Sent: Monday, March 27, 2006 11:20 PM
To: Hector Santos
Cc: [email-masked]
Subject: Re: SSP RR vs TXT [was Re: [ietf-dkim] SSP and o= values]

Hector Santos wrote: 

----- Original Message -----

From: "Jim Fenton"  <mailto:[email-masked]> <[email-masked]>

To:  <mailto:[email-masked]> <[email-masked]>

- There is only a small deployment of SSP records at this point

- There are good reasons for going to a new RR

- Unlike key records, there's no way to advertise whether to do a TXT or

"new RR" query for SSP

it seems like there are good reasons to accelerate the definition and

adoption a new RR for SSP.  In its most terse form, the "practices"

could mostly be defined as a number of independent, one-bit values.  In

any case, spending a lot of time on a definition that assumes TXT

records doesn't seem productive.

During MARID,  it is was my understanding that  non-active directory

versions of Microsoft DNS servers do no support the addition of new RR

records and during MARID this was one primary reason for sticking with TXT

(besides its obvious simplicity).

Is this correct?  If so, it is important?

This is all hearsay, but what I hear is that this problem was corrected in
SP2.

-Jim

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Hector Santos" <[email-masked]>
Date: Tue, 28 Mar 2006 02:42:20 -0500

I have to agree 100% here Philip.

My recollection of the issue was related to Active Directory (AD)visions
versus the non-Active Directory versions.  For example, we don't use AD, so
this might be an issue for us.  I believe there were some example shown
where Windows DNS IP Helper API (iphlpapi.dll) and/or it was not available
on all platforms. But I didn't remember the specifics.

Anyway, I brought it up because last week you did point it out and it seemed
this critical point was missed.

But I have a few more bald spots on my head understanding why it is being
discussed when we can't even get over the hump with Mike's compatibility
concerns. :-)  Doesn't make sense.

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

----- Original Message -----
From: "Hallam-Baker, Phillip" <[email-masked]>

---

From: Tony Hansen <[email-masked]>
Date: Tue, 28 Mar 2006 08:46:45 -0500

So it sounds like their database *will* support the additional RR
values, it's just that they don't make it easy to use them.

Until they get their standard interface fixed, it sounds like Microsoft
(or a 3rd party) could provide an alternative interface that
additionally stored the RRs in a separate database that would survive
the reboot, and included a service that ran at boot time that would
reload those additional RRs into the real database.

Please correct me if I'm misunderstanding something here.

	Tony Hansen
	[email-masked]

Hallam-Baker, Phillip wrote:
> The statement made by Microsoft was that none of the Microsoft DNS
> servers have the ability to publish new RRs without breaking the
> administration model completely. In particular they have no
> administration tool for entering the RRs and no way to save them out.
>  
> accept the statements made by Microsoft then I am not too inclined to
> accept heresay statements on the subject now.
>  
> For deployment of a new RR to be possible it must be supported to
> production quality for the platform concerned. On the windows platform
> that means that it has to be possible to enter the RR through the
> standard administrative interface.
>  
>  
> There are a few changes in Windows 2003 R2. In particular the server can
> be configured to allow through DNSSEC records from other DNS servers and
> to accept zone transfers for unsupported records. I am unable to find a
> On the plus size the default UDP packet size is 1260 bytes, not 512. If
> we are all so confident that new RRs will work then why does everyone
> (Olafur included) pay such strict attention to this particular limit?
>  
> I think that what we are seeing here is more wishful thinking by people
> who are not going to be damaged by the consequences. If they can get us
> to make DKIM dependent on deployment of the infrastructure necessary to
> support new RRs then they don't have to do that job.

---

From: "Hector Santos" <[email-masked]>
Date: Tue, 28 Mar 2006 10:04:09 -0500

Follow the MARID May/2004 "Wild Card MXes" Thread at:

http://www.mhonarc.org/archive/html/ietf-mxcomp/2004-05/msg00504.html
http://www.mhonarc.org/archive/html/ietf-mxcomp/2004-05/msg00461.html

Bob Atkinson seems to explain in detail.

---
Hector

----- Original Message -----
From: "Tony Hansen" <[email-masked]>
To: "Hallam-Baker, Phillip" <[email-masked]>; "IETF DKIM WG"
<[email-masked]>
Sent: Tuesday, March 28, 2006 8:46 AM
Subject: Re: SSP RR vs TXT [was Re: [ietf-dkim] SSP and o= values]

---

From: "william(at)elan.net" <[email-masked]>
Date: Tue, 28 Mar 2006 09:33:38 -0800 (PST)

> Please correct me if I'm misunderstanding something here.

Yes, this is fairly close to how I remember it from discussions on MARID.
MS folks there were a lot more concerned about their proxy server
(I called it firewall in previous message which is not quite so).

-- 
William Leibzon
Elan Networks
[email-masked]