ietf-asrg
[Top] [All Lists]

Re: [Asrg] antiphishing idea

2011-11-19 18:06:36
2011/11/19 Bill Cole <asrg3(_at_)billmail(_dot_)scconsult(_dot_)com>:

I understand both fairly well, but I appreciate your concern for my
understanding. It is unfortunate that there seems to be a language barrier
preventing you from coherently explaining my ignorance to me.

I do not need to explain coherently your ignorance to you since you're
doing pretty well job yourself.


It would be useful for you to think about how you are using the words
"should" and "could."

In my "bubble world" MUAs MUST submit emails to an MTA. Maybe not in
yours...that was why I´ve used "should".
SPF records tell the world which systems can send email for a
domain...so (as I said) MTAs are closely related to DNS servers for
that domain. With "closely related" I mean they must know each
other..then dynamic updates "could" be easily implemented !


In a previous job I managed mail servers for the US subsidiary of a major
global conglomerate headquartered in Germany. Due to control fetishists in
Berlin and Frankfurt and some corporate asset shuffling between parent
companies, some of the domains used by US employees had their authoritative
DNS in very stable zones on machines in Germany. At one point a US IT
manager insisted that we put SPF records in for one of those domains. That
took 6 weeks, because no one in the US had been informed when
responsibilities were shuffled in DE. Less than a year later when we were
migrating our mail servers to a new set of machines with new IP's, it took 3
weeks to get the SPF records changed because it was August (when apparently
virtually everyone in Germany is on vacation.) In getting that change done,
I learned that the authoritative DNS was running on hardware and software
that had not been updated since 1997, almost a decade of stability. The
person who told me this was very proud of it.

The point of that story: in the real world, there are generally functional
email and DNS systems that do not work anything like the way you think they
should now and really could not be adjusted to work as you want them without
significant modifications to the software, hardware, and humans involved.

you 're talking about the Internet about 15 years ago. As someone
said...when using open relays was a "good" practice ! do not confuse
stability with no improvement !
No human intervention is needed to get dynamic updates to work. You
only need that NS trust you and accept your updates. And obviously if
those conditions are met you dont even need that NS are close to
you....they can stay in germany!


It is not true today that every email message requires the creation of a new
DNS record. This is not even true for domains that have deployed SPF and
DKIM. It is quite possible for a domain to be stable for years with
thousands of messages per day flowing from its users.

It is not true, right ! but I did not say that. I think you're
confusing a DNS query with a creation of a RR !
I said that today for every email there is at least one DNS query. If
your server checks for a fqdn HELO or a correct map between IP and
names you have a query. If your server checks SPF you have another. If
your server checks DKIM you have another. Its true that some of them
can be cached.

.... I've worked with domains whose mail targets were
focused enough that they got less than a thousand SPF queries per week for
over a million messages sent, so 3 orders of magnitude boost in queries is
definitely possible if there were to be a query per message. 5 OoM may be a
stretch, but maybe not for a big bulk sender.

Well, you've worked in many places !  you got SPF queries in the
manner that others implement it or not. It is not an indicator of
query volumes !


sorry but you are stup.....

OK, that's not a language issue. We're done here.

sorry about that
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg