Subject: [ietf-dkim] New Issue: Applicability of SSP to subdomains

From: Jim Fenton <[email-masked]>
Date: Thu, 09 Nov 2006 20:02:18 -0800

In the process of preparing my slides for the recent WG meeting, it 
occurred to me that there is no requirement in the SSP requirements doc 
for SSP to apply to subdomains of a given domain.

The issue is this:  If an SSP record exists for example.com saying, for 
example, "I sign everything", it's probably not a good idea if an 
attacker can avoid that policy by sending mail from (for example) 
mail.example.com.  The recipient is still likely to associate the 
message with the example.com domain.

This can occur whether or not there actually is a mail.example.com 
subdomain, or some other sort of record (such as an A record) for 
mail.example.com.

It's also probably a good idea to require a flag in SSP that indicates 
whether the policy published there is intended to apply to subdomains.  
This would be used when the subdomains are under separate administrative 
control, and there is a desire to avoid having a parent's SSP "bleed 
through" to subdomains.

This also needs to be done to (sub-)*domains, e.g., q.w.e.r.t.y.example.com.

-Jim

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Michael Thomas <[email-masked]>
Date: Fri, 10 Nov 2006 07:19:08 -0800

Right. I was rather surprised that this was not in the security and/or 
discovery requirements
especially considering how much it drives the discovery process.

       Mike

Jim Fenton wrote:

> occurred to me that there is no requirement in the SSP requirements 
> doc for SSP to apply to subdomains of a given domain.
>
> The issue is this:  If an SSP record exists for example.com saying, 
> for example, "I sign everything", it's probably not a good idea if an 
> whether the policy published there is intended to apply to 
> subdomains.  This would be used when the subdomains are under separate 
> administrative control, and there is a desire to avoid having a 
> parent's SSP "bleed through" to subdomains.
>

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 10 Nov 2006 17:20:45 +0100

> control, and there is a desire to avoid having a parent's SSP "bleed

That's a horrible can of worms, or rather that was my impression after
SPF went through some include_subdomains=yes and "zone cut" iterations.

With a short op=nosub episode for a variant of the tree walk in CSV -
your proposal sounds like this now long dead op=nosub.

Can we get away with "don't" (i.e. not applicable to subdomains) here ?

Frank

---

From: John Levine <[email-masked]>
Date: 10 Nov 2006 16:37:06 -0000

>for SSP to apply to subdomains of a given domain.

We have definitely discussed this in the past, and as I recall there
was general agreement that it would be a good idea.

Unfortunately, it's not clear that there is any reasonable way to
implement it.  Wildcards don't work unless SSP has its own record type
and even then there's zone bloat issues, zone cuts aren't reliably
discoverable and aren't supposed to be semantically important to DNS
clients, and tree walks have all sorts of performance and DOS issues.

I'm not proposing that we try to sort this out now, but if it's really
a requirement that a policy record cover a domain's subdomains, we may
need to consider other approaches than publishing records in the
normal DNS tree.

R's,
John