Subject: RE: tree walking (was - Re: [ietf-dkim] user level ssp)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 6 Sep 2006 21:31:41 -0700

> [mailto:[email-masked]] On Behalf Of Jim Fenton
> william(at)elan.net wrote:
> >
> > On Wed, 6 Sep 2006, Jim Fenton wrote:
> >
> >> The aspect of user-level SSP that concerns me equally is the 
> >> transaction load.  When user-level SSP is "turned on", the 
> verifier 
> >> MUST query for a user-level record in addition to the domain-level 
> >> record.  User-level queries are not as effectively cached, since 
> >> these are queries for individual addresses, not domains.
> >
> > Actually your tree-walking in general is what's most 
> troublesome to me.
> > This is what would cause the most problems and most extra 
> queries and 
> > cache misses (I know NXDOMAIN can be cached but don't 
> assume you can 
> > rely on it). And I don't think this will fly during 
> last-call and/or 
> > when DNS folks see this.
> The tree-walking issue (separate from the user-level SSP) 
> issue has concerned me too.  The allman-dkim-ssp-02 draft has 
> it down to 2 queries
> -- much improved from the previous revision, in part because 
> of the use of a separate RR.

The tree walking is definitely a liability to be discarded.

Once tree walking is discarded however we have made an incompatible change and we should therefore address the other issues. In particular the use of punctuation syntax which is needlessly opaque and error-prone.

Even with a custom RR it will be necessary to have a macro processor to generate wildcard records for existing nodes.

Use of custom RRs will not work with the Windows 2003 DNS server at an acceptable level. The server can be coaxed to emit the data but it is not possible to enter it using the standard administration interface and the server does not save the custom RR data.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: <[email-masked]>
Date: Thu, 7 Sep 2006 00:48:05 -0400

Even with a custom RR it will be necessary to have a macro processor to
generate wildcard records for existing nodes.

Completely missed what the above means, could you expound?

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
404-847-6397 
[email-masked] 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Hallam-Baker,
Phillip
Sent: Thursday, September 07, 2006 12:32 AM
To: Jim Fenton; william(at)elan.net
Cc: IETF-DKIM
Subject: RE: tree walking (was - Re: [ietf-dkim] user level ssp)

Once tree walking is discarded however we have made an incompatible
change and we should therefore address the other issues. In particular
the use of punctuation syntax which is needlessly opaque and
error-prone.

Even with a custom RR it will be necessary to have a macro processor to
generate wildcard records for existing nodes.

Use of custom RRs will not work with the Windows 2003 DNS server at an
acceptable level. The server can be coaxed to emit the data but it is
not possible to enter it using the standard administration interface and
the server does not save the custom RR data.

---

From: Jim Fenton <[email-masked]>
Date: Thu, 07 Sep 2006 09:17:57 -0700

> Once tree walking is discarded however we have made an incompatible change and we should therefore address the other issues. In particular the use of punctuation syntax which is needlessly opaque a…
I, for one, am not concerned with compatibility of changes for SSP
because I don't know of any significant deployed base for signing policy
in DomainKeys.

draft-allman-dkim-ssp-02 has already gotten rid of the punctuation
syntax.  Let me know what you think.
> Even with a custom RR it will be necessary to have a macro processor to generate wildcard records for existing nodes.
The limited (1-level) upward search in draft-allman-dkim-ssp-02 is an
attempt to relieve the need to publish SSP records to accompany all (for
example) A records in a domain.  I don't particularly like having to
search up even one level, but this seemed like a reasonable tradeoff to me.
> Use of custom RRs will not work with the Windows 2003 DNS server at an acceptable level. The server can be coaxed to emit the data but it is not possible to enter it using the standard administrati…
That's one data point; I don't know what the deployment share of various
DNS servers is but hopefully that information is available somewhere. 
We also need to consider the consequences of not being able to publish
SSP records; it doesn't prevent DKIM deployment, but provides a little
less information to verifiers.

-Jim