Subject: [ietf-dkim] A record for _domainkey.$DOMAIN?

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 6 Oct 2008 13:43:40 +0200

Surveying the deployment of DKIM in the ".fr" top-level domain, I
notice the vast majority of domains with a _domainkey subdomain have a
A record for the subdomain (check jeunes-sapeurs-pompiers.fr or
journeedelentrepreneur.fr).

I do not think it is legitimate but I may miss something. Any
reasonable use of such a record?
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 6 Oct 2008 16:38:24 +0200

On Mon, Oct 06, 2008 at 02:33:40PM -0000,
 John Levine <[email-masked]> wrote 
 a message of 51 lines which said:

> Those aren't _domainkey records -- they're just wildcards.

Ah, yes, thanks, I should have thought of it. And I should not have
used ANY for the DNS queries.

Side note: what's the best way to test that a given domain has DKIM
records? Since I do not know the selectors (and since there is no way
to get the list of them), querying ANY for _domainkey.$DOMAIN (and
checking there is no NXDOMAIN) seemed a good idea. 

With wildcards, I cannot use ANY (or A) so, at the present time, I use
uncommon record types such as MG. A better idea?

---

From: Mark Martinec <[email-masked]>
Date: Mon, 6 Oct 2008 16:00:23 +0200

Stephane Bortzmeyer,
> reasonable use of such a record?

They just have a wildcard DNS entry, a lookup for _domainkey or foo
or whatever would return the same A record:

$ host '*.jeunes-sapeurs-pompiers.fr'
*.jeunes-sapeurs-pompiers.fr has address 91.121.53.53

$ host '*.journeedelentrepreneur.fr'
*.journeedelentrepreneur.fr has address 194.206.126.204

As far as DKIM/DK is concerned, there is no _domainkey TXT record.
A presence of and A record does not mean anything special.

  Mark

---

From: John L <[email-masked]>
Date: Mon, 6 Oct 2008 16:09:38 +0100 (BST)

> checking there is no NXDOMAIN) seemed a good idea.

Basically, you can't unless you happen to see mail from the domain and 
snag the key record.

I'd suggest doing a lookup for A for _domainkey.$DOMAIN, and if you get 
NOERROR (that is, 0 records but no error code), then check *.$DOMAIN.  If 
the latter gives you NXDOMAIN, that's a pretty strong hint that there's 
something real under _domainkey.  If you get an A record for 
_domainkey.$DOMAIN, that's an almost sure indication that you've hit a 
wildcard, but if you want you can still check *.$DOMAIN to see if it might 
instead be severe misconfiguration.

ANY queries probably won't do what you want, since your cache will return 
whatever it happens to have for that name, which may or may not be all of 
what the authoritative server has.

R's,
John

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 6 Oct 2008 17:27:06 +0200

On Mon, Oct 06, 2008 at 04:09:38PM +0100,
 John L <[email-masked]> wrote 

> what the authoritative server has.

I disagree. The cache will return "whatever it happens to have for
that name" if it has something (otherwise, it will go to the
authoritative server). So, if the cache returns NOERROR, it means that
the _domainkey subdomain exists (unless there is a wildcard).
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: SM <[email-masked]>
Date: Mon, 06 Oct 2008 07:54:09 -0700

>reasonable use of such a record?

Neither DomainKeys nor DKIM use such a record.  You are getting that 
A record for these domains as there is a wildcard DNS record.

Regards,
-sm

---

From: John Levine <[email-masked]>
Date: 6 Oct 2008 14:33:40 -0000

R's,
John

$ dig *.jeunes-sapeurs-pompiers.fr    

; <<>> DiG 9.4.2 <<>> *.jeunes-sapeurs-pompiers.fr
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1458
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;*.jeunes-sapeurs-pompiers.fr.  IN      A

;; ANSWER SECTION:
*.jeunes-sapeurs-pompiers.fr. 38400 IN  A       91.121.53.53

;; Query time: 103 msec
;; SERVER: 208.31.42.32#53(208.31.42.32)
;; WHEN: Mon Oct  6 10:32:02 2008
;; MSG SIZE  rcvd: 62

$ dig *.journeedelentrepreneur.fr a

; <<>> DiG 9.4.2 <<>> *.journeedelentrepreneur.fr a
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 430
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;*.journeedelentrepreneur.fr.   IN      A

;; ANSWER SECTION:
*.journeedelentrepreneur.fr. 172800 IN  A       194.206.126.204

;; Query time: 105 msec
;; SERVER: 208.31.42.32#53(208.31.42.32)
;; WHEN: Mon Oct  6 10:32:52 2008
;; MSG SIZE  rcvd: 61

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 20 Oct 2008 16:13:32 +0200

On Mon, Oct 06, 2008 at 04:09:38PM +0100,
 John L <[email-masked]> wrote 
 a message of 22 lines which said:

> I'd suggest doing a lookup for A for _domainkey.$DOMAIN, and if you
> get NOERROR (that is, 0 records but no error code), then check
> *.$DOMAIN.

I've finally used such an algorithm, but more detailed (you can find a
lot of strange things in the DNS). I attach the Python module which
tests if a domain has a wildcard.

But it does not solve completely my "find DKIM records" problem since,
now, I find the records only in non-wildcarded domains. The wildcarded
domains may be have DKIM and may be not, there is no way of finding it
in the DNS. So, it seems you cannot really survey the deployment of
DKIM by just asking the DNS (unlike what happens with SPF).

Thanks for all those who helped.

---

From: Jim Fenton <[email-masked]>
Date: Mon, 20 Oct 2008 09:12:29 -0700

Stephane,

Since it sounds like you have looked, what proportion of domains you
surveyed has a wildcard?  What kinds of wildcards are there:   MX
wildcards?  Wildcarded A records?  Wildcarded TXT due to SPF?

-Jim

Stephane Bortzmeyer wrote:
> ------------------------------------------------------------------------
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 21 Oct 2008 10:38:30 +0200

On Mon, Oct 20, 2008 at 09:12:29AM -0700,
 Jim Fenton <[email-masked]> wrote 
 a message of 37 lines which said:

> surveyed has a wildcard?

It will be officially announced at the next RIPE meeting 
<http://www.ripe.net/ripe/meetings/ripe-57/agendas/dns.html> :-)

In ".fr", 18 % of the 1.2 million domains have wildcards (all RR types
together). Among the remaining 82 %, none have a _domainkey subdomain.

> What kinds of wildcards are there: MX wildcards?  Wildcarded A
> records?  Wildcarded TXT due to SPF?

Not tested per RR type yet. Added in the TODO.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html