Subject: Re: SPF I-D for review: draft-schlitt-spf-classic-00.txt

From: Paul Vixie <[email-masked]>
Date: Tue, 11 Jan 2005 21:23:35 +0000

> It sounds very dangerous.

yes.  see RFC 1535 (and perhaps RFC 1536) to understand the dangers
inherent in client-side dns surfing.

> However, the load on the TLD servers could be greatly diminished by
> adding a TLD TXT record with a very high TTL.

no.  enough broken dns clients out there fail to cache anything at all,
positive or negative, that the presence of a TLD TXT RR would not slow
down the rate at which these queries were generated, or needlessly and
endlessly repeated.

> I am not saying it's a solution to the problem. Just yet another hack.
> The application should never query the TLD servers (nor lvl 2 for e.g.
> .uk) for SPF-records of any kind.

i had not even considered .CO.UK (et al) when i wrote my "less than two
labels" recommendation.  there's basically no way to appropriately limit
the search based on the TLD or SLD.  since there's also absolutely no
reason to do this kind of searching from the client side -- whatever they
use to look up MX will work to look up TXT -- which means, wildcards or
masqueradenames.  this "search the parent" logic has to be removed, or
replaced with a "MUST NOT" of some kind.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Wed, 12 Jan 2005 14:57:28 +0000

> Yes it would.

no, actually, it would not.

> That there are some broken clients does not mean that all others will
> misbehave.

i didn't say all others would misbehave.  i said that the rate at which
these queries were generated, or needless and endlessly repeated, would
not be affected by the presence of a TLD TXT RR.

> And if you are lucky they even have a cache in front of them - but you
> assume that is broken too, I suppose - we have all seen repetetive
> queries on our servers.  Fine.  But it still has an effect for all
> correctly functioning implementations.  So I think you are
> exaggerating a little bit when you say plainly that it will have no
> effect.

the dominant effects will come from the people who don't cache.  for more
information on this, see all three papers at

	    http://dns.measurement-factory.com/writings/

> (and I still don't think it's a solution to a problem)

hopefully we're on the same page now.