LWN: Comments on "Handicapping New DNS Extensions and Applications (O'ReillyNet)"

Re: SPF

ldo — Wed, 24 Jan 2007 01:43:10 +0000

SPF is broken by design and won't get fixed. Those looking for spam filters are better off looking elsewhere.

Why do you say that? The article seems to assert quite the opposite:

We suggested in the webinar that there was no reason not to implement SPF: it's easy to set up, and there are no disadvantages to publishing a list of mail servers that are allowed to send email from your domain names.

Handicapping New DNS Extensions and Applications (O'ReillyNet)

job — Sun, 21 Jan 2007 15:57:22 +0000

SPF is broken by design and won't get fixed. Those looking for spam filters are better off looking elsewhere.

CERT records

micha — Sat, 13 Jan 2007 17:50:15 +0000

Peter wrote: "And last and most importantly, when we have a trusted CERT record and it matches we can just accept the certificate, even if it is signed by a CA we do not recognize or even if it is just self signed."

But what would be the downsides? Wouldn't it make easier for phishers to fool the innocent users by providing a fully accepted SSL certificate by simply a CERT record? You would require the users to trust the DNS even more, but spammers and phishers currently have no problem to register domains on the fly and will have no problem to manage their DNS.

I don't know whether DNS can bear this burden of trust.

Micha

CERT records

weasel — Sat, 13 Jan 2007 17:26:45 +0000

What I would really like to see is SSL (x509) certificates or better just their fingerprint in DNS, and browsers (and other programs like your jabber client, MUA, etc.) making use of it.

Maybe something like
_443._tcp.example.org. CERT <magicbytes that say what this is> 17:37:8B:EE:E4:FF:96:D9:0A:B4:5B:57:56:08:D6:8E
(One could also imagine using the service name instead of the port number, but I guess the port is the smarter choice).

In the absense of such a CERT record clients would behave the same as now, that is do their CA verification dance and all.

If a CERT record is found but the fingerprint does not match the certificate a warning should be issued.

If a CERT record is found and we do not have a trusted (DNSSEC signed) answer then we still do the CA thing, but whether that fails or not we can still inform the user of what we found.

And last and most importantly, when we have a trusted CERT record and it matches we can just accept the certificate, even if it is signed by a CA we do not recognize or even if it is just self signed.

--
Peter