Subject: RE: you must fill your zones with TXT records

From: "Gordon Fecyk" <[email-masked]>
Date: Tue, 10 Aug 2004 16:14:13 -0500

> Traditional remote domain verification involves checking that 
> the domain
> stated in an email address has a valid MX or A record published in the
> DNS. This implies that a spammer could send email "from" any 
> old machine
> with an A record and expect it to be accepted. Sender-ID does 
> not solve
> this problem unless you publish a -all record for EVERY HOST on your
> network, since in the absence of a Sender-ID record the recipient will
> fall back to the current behaviour.

This is where the automated tools come in.  Something to inspect the zone and
then push records through ddns for every node that doesn't already have a
MARID-style record.[1]

This is a flaw with every proposal that uses DNS, but it is not an
insurmountable one.  Not to mention that the wildcard issues were beaten to a
greasy spot on the floor, never mind beaten to death.

[1] Someone again said this was inexcusable but I never received an
explanation as to why.  Any takers?

-- 
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email-masked]>
Sometimes it's hard to tell where the game ends and where reality bites,
er, begins. <http://vmyths.com/resource.cfm?id=50&page=1>

---

From: Tony Finch <[email-masked]>
Date: Wed, 11 Aug 2004 08:57:46 +0100

On Tue, 10 Aug 2004, Gordon Fecyk wrote:
> insurmountable one.

The underlying problem is that all the proposals look at one individual RR
set at a time. They have no way of advertising a default policy that
covers an entire zone. There were some discussions on the SPF list about
searching for zone cuts (which would allow you to locate such a default
policy) but they didn't get very far.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
BERWICK ON TWEED TO WHITBY: WEST OR SOUTHWEST 2 OR 3 INCREASING 3 OR 4. FAIR.
GOOD. SLIGHT OR SMOOTH.