Subject: Re: [ietf-dkim] Escaping things in key/ADSP records

From: Tony Hansen <[email-masked]>
Date: Fri, 31 Jul 2009 10:19:43 -0400

Mark Martinec wrote:
 > John Levine wrote:
 >> It is certainly the kind of bug that occurs in PHP scripts when the
 >> programmer doesn't perfectly understand the quoting rules.  It's
 >> happened to me.
 >
 > I'm collecting a set of common mistakes breaking DKIM signatures.

Pulling up a message from a while ago. Mark, did you ever get further 
with your set of common mistakes?

I had occasion to look at a number of DNS key records, and find the 
following common mistakes:

Sample size: 65456 DNS _domainkey (DKIM+DK) records

16	missing semi-colons between fields
1	missing any separators (k=rsap=....)
14	invalid quotation marks (") surrounding the entire record
2	invalid \" surrounding the entire record
5	invalid parens or paren+quotes surrounding the entire record
47	\-quoted characters, particularly \;
9	TTL value or other random DNS data showing up in the record
1	TTL value being in the record instead of the public key
17	random characters in the record, e.g. {, CRLF, backspace, SUB, >
113	SPF records being returned
13	key only, no p= or any other options
1	encoded ; as %3B
1	missing tag before =
8	other data in record (dkim=all, O=-, r=, &amp;, &quot;)
1	v=DKIM1 not first field in record
50	other random errors
---
299

I was not able to verify if any of the keys that had spaces within them 
were actually valid keys or not.

The good news is that of the sample, the majority of the records were 
just fine.

I'm wondering if there is a need for a web interface at dkim.org that 
would validate someone's _domainkey TXT record.

Thoughts?

	Tony Hansen
	[email-masked]
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jim Fenton <[email-masked]>
Date: Fri, 31 Jul 2009 10:22:37 -0700

Tony,

If you still have the records, can you count the number of records with
g=; ?  That's used in an example in some of the DomainKey specs and
works for DK but means "match nothing" for DKIM.

-Jim

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 31 Jul 2009 15:08:44 -0400

>would validate someone's _domainkey TXT record.
I'd say yes.  It would provide a good way to isolate record specific issues 
from other potential problems people are having error sources when 
troubleshooting.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 31 Jul 2009 13:24:00 -0700

> -----Original Message-----
> From: [email-masked] [mailto:ietf-dkim-
> [email-masked]] On Behalf Of Scott Kitterman
> Sent: Friday, July 31, 2009 12:09 PM
> To: [email-masked]
> Subject: Re: [ietf-dkim] Escaping things in key/ADSP records
> 

A verifier equipped with additional code to email sites whose keys or policy records contain errors might be useful.  Then again, it might also be obnoxious.

---

From: Steve Atkins <[email-masked]>
Date: Fri, 31 Jul 2009 14:02:20 -0700

(This may be a duplicate, I have too many email addresses)

> from other potential problems people are having error sources when

I have some perl code that does some validation for internal use; it'd
be fairly easy to turn it into a webapp.

Cheers,
   Steve