Subject: [ietf-smtp] Rfc5782bis?

From: Alessandro Vesely <[email-masked]>
Date: Sun, 13 Jan 2019 09:45:35 +0100

Hi all,

rfc8482 says:

   In some cases, it is possible to guess what the initiator wants in
   the answer (but not always).  Some implementations have implemented
   the spirit of this document by returning all RRsets of RRTYPE CNAME,
   MX, A, and AAAA that are present at the owner name while suppressing
   others.  This heuristic seems to work well in practice; [...]

I think someone should remark that the best guess to intention for DNSxL is to
return A and TXT.  However obvious that may seem, some implementors still get
it wrong.  For example:
https://www.mail-archive.com/[email-masked]/msg38961.html

Since rfc5782 details A and TXT semantics and operations, perhaps a new edition
could also clarify this point.

Best
Ale
--

---

From: "John Levine" <[email-masked]>
Date: 13 Jan 2019 11:41:18 -0500

>could also clarify this point.

Looking at a recent log file for one of my dnsbls, I see 113,617 A
queries, 7701 (useless) AAAA queries, 2311 TXT queries, and only 34
ANY.

The ANY queries look like they're from a few dusty forgotten servers,
no doubt run by people who will never understand that sending an ANY
query to a cache may or may not get you all the records.

R's,
John

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 14 Jan 2019 12:04:08 +0100

> queries, 7701 (useless) AAAA queries, 2311 TXT queries, and only 34

TXT and ANY are so small that could have been issued by hand.

> query to a cache may or may not get you all the records.

What sort of TXT does that dnsbl serve?  Zen.spamhaus.org returns just A
records whether I ask for A or for ANY.  If I ask for TXT, they return http
URLs that I could have synthesized myself from their A's.  So, yes, a server
who asks ANY or TXT to spamhaus is poorly coded/configured.

However, some lists return relevant information in TXT records.  I'll try and
get more stats from dnswl.org.

Best
Ale
--

---

From: "John R Levine" <[email-masked]>
Date: 14 Jan 2019 10:25:30 -0500

> who asks ANY or TXT to spamhaus is poorly coded/configured.

The same kind of synthesized ones that spamhaus does, because they both 
use rbldnsd.

If you want A records, ask for A records.  If you want TXT records, ask 
for TXT records.  If you want both, ask for one and then the other, which 
is what my DNSBL client does.  If you want unreliable junk, ask for ANY.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 15 Jan 2019 12:56:32 +0100

On Mon 14/Jan/2019 16:25:30 +0100 John R Levine wrote:
> The same kind of synthesized ones that spamhaus does, because they both use
> rbldnsd.

BTW, do you know if rbldnsd provides some options to respond to ANY?  I see
that bind has a "minimal-any" option to limit the response to one RRset (but
cannot find anything to respond HINFO.)

> If you want A records, ask for A records.  If you want TXT records, ask for TXT
> records.  If you want both, ask for one and then the other, which is what my
> DNSBL client does.

Isn't that wasteful?  What do you mean by "and then the other", does your
client wait for a positive response to A before querying TXT?  That doubles the
time, doesn't it?  Why not fire both queries at the same time?

Anyway, it's worth spelling it out.

> If you want unreliable junk, ask for ANY.

Got it!  Let me quote rfc6762, in case someone else read this thread.  Although
rfc6762 specifies mDNS, the following paragraphs are for regular DNS:

   A common misconception is that a Unicast DNS query for qtype "ANY"
   will elicit a response containing all matching records.  This is
   incorrect.  If there are any records that match the query, the
   response is required only to contain at least one of them, not
   necessarily all of them.

   This somewhat surprising behavior is commonly seen with caching
   (i.e., "recursive") name servers.  If a caching server receives a
   qtype "ANY" query for which it has at least one valid answer, it is
   allowed to return only those matching answers it happens to have
   already in its cache, and it is not required to reconsult the
   authoritative name server to check if there are any more records that
   also match the qtype "ANY" query.
                         https://tools.ietf.org/html/rfc6762#section-6.5

Best
Ale

---

From: Tony Finch <[email-masked]>
Date: Tue, 15 Jan 2019 14:42:46 +0000

Alessandro Vesely <[email-masked]> wrote:
>
> BTW, do you know if rbldnsd provides some options to respond to ANY?  I
> see that bind has a "minimal-any" option to limit the response to one
> RRset (but cannot find anything to respond HINFO.)

The reason BIND doesn't implement the HINFO option of RFC 8482 is because
HINFO synthesis requires on-demand DNSSEC signing of responses, which BIND
can't do. HINFO synthesis for ANY responses exists to help implementations
where it is expensive to iterate over all the RRtypes at a name. I don't
know of any HINFO synthesizers other than Cloudflare.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
St Davids Head to Great Orme Head, including St Georges Channel: West or
southwest 5 to 7. Slight or moderate, occasionally rough later. Occasional
rain. Moderate or good.