Subject: [ietf-dkim] Consensus check: Domain Existence Check

From: Stephen Farrell <[email-masked]>
Date: Thu, 29 May 2008 10:45:22 +0100

There has been considerable debate in the past few weeks regarding the
need for a check for domain existence in ADSP.

I think we've had sufficient time for debating this, let's decide.
Please respond to this by Friday June 6th.

The text in question (from section 4.2.2 of draft-ietf-dkim-ssp-03)
is as follows:

   2.  _Verify Domain Exists._ The host MUST perform a DNS query for a
       record corresponding to the Author Domain (with no prefix).  The
       type of the query can be of any type, since this step is only to
       determine if the domain itself exists in DNS.  This query MAY be
       done in parallel with the query made in step 2.  If the result of
       this query is an "NXDOMAIN" error, the algorithm MUST terminate
       with an appropriate error.

          NON-NORMATIVE DISCUSSION: Any resource record type could be
          used for this query since the existence of a resource record
          of any type will prevent an "NXDOMAIN" error.  MX is a
          reasonable choice for this purpose is because this record type
          is thought to be the most common for likely domains, and will
          therefore result in a result which can be more readily cached
          than a negative result.

There are three options that have been actively discussed:

a. Keep.  Retain the current text as-is.

b. Modify, i.e. keep, but with a different set of records.  It was
suggested that the current NXDOMAIN is incorrect, and that MX, A, and
AAAA records for the domain should be queried, with the existence of
any of these records indicating a domain that is potentially used for
email. If we have consensus for this option, then we may well need a
subsequent poll to decide the details.

c. Remove.  Remove the text as being out of scope for the ADSP
specification.  Some text may need to be added pointing out the need for
a domain existence check elsewhere. If the consensus is for removal,
then we should consider what, if anything, the specification should
refer to for performing the domain existence check.

Please just answer "keep", "modify", or "remove" in this thread, and use
a different subject line for any discussion.

Thanks,
Stephen.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Tony Finch <[email-masked]>
Date: Thu, 29 May 2008 11:43:36 +0100

b. Modify

draft-levine-dkim-adsp-00 is OK.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
IRISH SEA: SOUTHWEST 4 BECOMING VARIABLE 3 OR LESS. SLIGHT OR MODERATE.
SHOWERS, FOG PATCHES. MODERATE, OCCASIONALLY VERY POOR.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John Levine <[email-masked]>
Date: 29 May 2008 14:06:08 -0000

>b. Modify

Replace with the text from draft-levine-adsp-00

That's why we posted it, after all.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Eliot Lear <[email-masked]>
Date: Thu, 29 May 2008 16:10:52 +0200

Stephen Farrell wrote:
> b. Modify, i.e. keep, but with a different set of records.
>    

As I suggested in my own message.  Specify the records.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jeff Macdonald <[email-masked]>
Date: Thu, 29 May 2008 13:39:42 +0000

I too like the wording in draft-levine-dkim-adsp-00, but I'm not sure if
that means a modify or remove. draft-levine-dkim-adsp-00 doesn't list
steps like the current -03 draft does.

-- 
:: Jeff Macdonald | Director of Messaging Technologies
:: e-Dialog | [email-masked]
:: 131 Hartwell Ave. | Lexington, MA 02421
:: v: 781-372-1922 | f: 781-863-8118
:: www.e-dialog.com

---

From: Steve Atkins <[email-masked]>
Date: Thu, 29 May 2008 07:48:14 -0700

> There are three options that have been actively discussed:

Modify.

(I might be talked into "keep", but "remove" would be a complete
non-starter.)

Cheers,
   Steve

---

From: Jeff Macdonald <[email-masked]>
Date: Thu, 29 May 2008 15:50:54 +0000

> steps like the current -03 draft does.

I'd like to switch this to MODIFY with discussion on what the modified
text should be.

---

From: "Siegel, Ellen" <[email-masked]>
Date: Thu, 29 May 2008 11:30:41 -0400

b. Modify

Replace with the text in draft-levine-dkim-adsp-00

Ellen

___________________________
Ellen Siegel
Constant Contact
[email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Thu, 29 May 2008 09:16:06 -0700

> steps like the current -03 draft does.

How is that its section 4.3 does not qualify as listing steps?

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: <[email-masked]>
Date: Thu, 29 May 2008 16:03:17 +0000

modify (though I only slightly prefer that to keep)

> Date: Thu, 29 May 2008 10:45:22 +0100> From: [email-masked]> To: [email-masked]> Subject: [ietf-dkim] Consensus check: Domain Existence Check> > > There has been considerable debate in the past few weeks regarding the> need for a check for domain existence in ADSP.> > I think we've had sufficient time for debating this, let's decide.> Please respond to this by Friday June 6th.> > The text in question (from section 4.2.2 of draft-ietf-dkim-ssp-03)> is as follows:> > 2. _Verify Domain Exists._ The host MUST perform a DNS query for a> record corresponding to the Author Domain (with no prefix). The> type of the query can be of any type, since this step is only to> determine if the domain itself exists in DNS. This query MAY be> done in parallel with the query made in step 2. If the result of> this query is an "NXDOMAIN" error, the algorithm MUST terminate> with an appropriate error.> > NON-NORMATIVE DISCUSSION: Any resource record type could be> used for this query since the existence of a resource record> of any type will prevent an "NXDOMAIN" error. MX is a> reasonable choice for this purpose is because this record type> is thought to be the most common for likely domains, and will> therefore result in a result which can be more readily cached> than a negative result.> > There are three options that have been actively discussed:> > a. Keep. Retain the current text as-is.> > b. Modify, i.e. keep, but with a different set of records. It was> suggested that the current NXDOMAIN is incorrect, and that MX, A, and> AAAA records for the domain should be queried, with the existence of> any of these records indicating a domain that is potentially used for> email. If we have consensus for this option, then we may well need a> subsequent poll to decide the details.> > c. Remove. Remove the text as being out of scope for the ADSP> specification. Some text may need to be added pointing out the need for> a domain existence check elsewhere. If the consensus is for removal,> then we should consider what, if anything, the specification should> refer to for performing the domain existence check.> > Please just answer "keep", "modify", or "remove" in this thread, and use> a different subject line for any discussion.> > Thanks,> Stephen.> > > > > _______________________________________________> NOTE WELL: This list operates according to > http://mipassoc.org/dkim/ietf-list-rules.html
_________________________________________________________________
Keep your kids safer online with Windows Live Family Safety.
http://www.windowslive.com/family_safety/overview.html?ocid=TXT_TAGLM_WL_Refresh_family_safety_052008

---

From: Jim Fenton <[email-masked]>
Date: Thu, 29 May 2008 10:30:41 -0700

> a different subject line for any discussion.

Keep.

-Jim

---

From: Eric Allman <[email-masked]>
Date: Thu, 29 May 2008 10:35:24 -0700

keep

---

From: "Frank Ellermann" <[email-masked]>
Date: Thu, 29 May 2008 20:37:17 +0200

> (I might be talked into "keep", but "remove"
> would be a complete non-starter.)

Same here.

 Frank

---

From: Douglas Otis <[email-masked]>
Date: Thu, 29 May 2008 12:02:09 -0700

b. Modify.

(It seems this is again asking members of the list to respond with  
"remove" instead of "delete".)

-Doug

---

From: Joerg Backschues <[email-masked]>
Date: Thu, 29 May 2008 20:59:15 +0200

Stephen Farrell wrote:

> b. Modify, i.e. keep, but with a different set of records. [...]

That´s it: modify

-- 
Greetings
Jörg Backschues

---

From: "Al Iverson" <[email-masked]>
Date: Thu, 29 May 2008 17:13:52 -0400

Keep.

(Though I could be convinced that "modify" is OK.)

Best,
Al

-- 
Al Iverson on Spam and Deliverability, see http://www.spamresource.com
News, stats, info, and commentary on blacklists: http://www.dnsbl.com
My personal website: http://www.aliverson.com -- Chicago, IL, USA
Remove "lists" from my email address to reach me faster and directly.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Arvel Hathcock <[email-masked]>
Date: Thu, 29 May 2008 22:44:32 -0500

Keep

Arvel

---

From: Tony Hansen <[email-masked]>
Date: Fri, 30 May 2008 00:53:08 -0400

> a different subject line for any discussion.

modify.

	Tony Hansen
	[email-masked]

---

From: Tony Hansen <[email-masked]>
Date: Fri, 30 May 2008 01:28:37 -0400

Stephen Farrell wrote:
 > Please just answer "keep", "modify", or "remove" in this thread, and
 > use a different subject line for any discussion.

(Using a different subject line as requested.)

My conclusions from reading ssp-03 and the proposed rewording of section 
4.3 found in levine-adsp-00 and otis-adsp-02 is that:

    *	ssp-03 and levine-adsp-00 require that you check that the domain 
exists. otis-adsp-02 makes it an optional test.

    *	checking NXDOMAIN is not a perfect check for the test "is this 
domain a MAIL SYSTEM", but can be considered a "sufficient" check for 
the purposes of ADSP.

    *	levine-adsp-00 provides a superset of methods for *how* to 
determine if the domain exists: the NXDOMAIN test and the "check MX & 
A/AAAA" method from SMTP. It leaves it up to the implementation to 
choose the algorithm that works best for it.

    *	otis-adsp-02 only specifies the "check MX & A/AAAA" method from 
SMTP, but indicates that an NXDOMAIN return value breaks out of the 
first part of the test.

    *	as implied by otis-adsp-02, checking NXDOMAIN can be treated as an 
optimization for one of the failure paths of the "check MX & A/AAAA" 
method. (If you check for the MX records and get NXDOMAIN, you know you 
don't need to explicitly check for A/AAAA records because you've already 
been told that they don't exist.)

    *	from discussions on the list, not all implementations may be able 
to take advantage of that optimization.

Weighing the above, I find the text in levine-adsp-00 as the most 
palatable wording for this test. Hence my "modify" vote.

	Tony Hansen
	[email-masked]

---

From: "Charles Lindsey" <[email-masked]>
Date: Fri, 30 May 2008 11:17:43 +0100

> Please respond to this by Friday June 6th.

Modify (or maybe keep) - at least let us move on to discussion of how to  
do it, rather than whether to do it.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131                       
   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Tony Hansen <[email-masked]>
Date: Fri, 30 May 2008 08:20:48 -0400

And then I forgot to change the subject line. Sigh. - Tony

---

From: "MH Michael Hammer (5304)" <[email-masked]>
Date: Fri, 30 May 2008 08:36:43 -0400

> Please just answer "keep", "modify", or "remove" in this thread, and
use
> a different subject line for any discussion.

Modify

---

From: Jon Callas <[email-masked]>
Date: Fri, 30 May 2008 05:16:11 -0700

> subsequent poll to decide the details.

B. Modify. I would go along with a consensus that what's in draft- 
levine-adsp-00, especially because I'm with J.D. Falk that I'm tired  
of debating it and think we should build something. I think the Levine  
text is good enough, but am willing to listen to suggestions on tweaks.

	Jon

---

From: Jeff Macdonald <[email-masked]>
Date: Fri, 30 May 2008 14:37:06 +0000

On Fri, 2008-05-30 at 01:28 -0400, Tony Hansen wrote:

> exists.

Yes, except the outcome is different. Or that is how I interpret the
text. ssp-03 says:

If the result of this query is an "NXDOMAIN" error, the algorithm MUST
terminate with an appropriate error.

>From this text, I don't really understand what the appropriate error is.
I suspect it really should say "appropriate result". I came to this
conclusion after reading Eric's comments earlier in the year:

                           Subject: 
Re: [ietf-dkim] New Issue:
protecting a domain name vs.
protecting a    domain tree
                              Date: 
Wed, 09 Apr 2008 10:46:16 -0700
(13:46 EDT)

"... and the absence  of an ADSP record means that unsigned mail must be
deemed legitimate. Without step 2 there is nothing example.com can do to
protect its name space."

Eric doesn't really say what to do with such a message, but I suspect
he'd like us to discard it.

levine-adsp-00 says:

The verifier MUST return an appropriate error result for Author Domains
that are outside the scope of ADSP.

To me, "outside the scope" allows a receiver to assume the message is
legitimate, assuming no other checks besides ADSP are done.

If these 2 points have been hashed out before, I apologize.

---

From: John Levine <[email-masked]>
Date: 30 May 2008 15:23:31 -0000

>I suspect it really should say "appropriate result".

It's intended to say that you know the address is no good.  I agree the
wording could be improved.

R's,
John

---

From: <[email-masked]>
Date: Fri, 30 May 2008 08:01:09 -0400

MAY

---

From: Damon <[email-masked]>
Date: Fri, 30 May 2008 12:14:19 -0400

Modify

---

From: [email-masked] (Wietse Venema)
Date: Fri, 30 May 2008 12:38:35 -0400 (EDT)

modify

(clean up the definition of what is out-of-scope, clean up the
handling of out-of-scope domains).

	Wietse