Steve Atkins wrote:
This is a single lookup by the client, no traversal,
>> no loop, required.
Your reasoning is unclear to me.
Given the domain a.b.c.d.e.f.g.h.i.j.k.foo, please explain what
single DNS query you would make and what answer you would
expect to receive.
The single DNS query syntax would be:
a.b.c.d.e.f.g.h.i.j.k._ssp.foo
The result will depend on what this organization is going to define for
policies at each level.
Practically speaking I can't imagine anyone using such a long set of
subdomains for email, but nevertheless, it will naturally need to be
part of the equation.
For the sake of simplicity, lets cut that down to a.b.c.d.foo.com, and
lets use a well understood tld, .com, just so we can make sense out of
it, but of course, it can be any valid TLD.
Again, it depends on what a company wishes for policies.
Example #1:
A company may want a I ALWAYS SIGN ALL DOMAINS, with NEVER exceptions
after the b.c.d.foo.com subdomains:
*._SSP 0 TXT policy=ALWAYS
*.b.c.d._SSP 0 TXT policy=NEVER
Example #2:
A company may want a global NOMAIL, with exceptions:
*._SSP 0 TXT policy=NOMAIL
_SSP 0 TXT policy=ALWAYS
*.d._SSP 0 TXT policy=NEVER
d._SSP 0 TXT policy=OPTIONAL
c.d._SSP 0 TXT policy=ALWAYS
b.c.d._SSP 0 TXT policy=OPTIONAL
*.b.c.d._SSP 0 TXT policy=NEVER
The client need only to do 1 query for the specific email domain provided.
Lets try some real test example queries for example #2 domain polices
using the isdg.net domain:
email: isdg.net
query --> _ssp.isdg.net
This will return the ALWAYS policy (2nd record)
email: z.isdg.net
query --> z._ssp.isdg.net
This will return the NOMAIL policy (1st record)
email: d.isdg.net
query --> d._ssp.isdg.net
This will return the OPTIONAL policy (4th record)
email: q.d.foo.com
query --> q.d._ssp.foo.com
This will return the NEVER policy (3rd record)
Again, it all depends on what you want and it seems that by using this
syntax, unless I'm missing something, it works. The DKIM DNS ADMIN with
the help of some fancy tool, he will be able to create complex policy
records.
Finally, I think if DNS server can't handle the sub-domain "unions" of
policies, then we should move to a syntax on the TXT record itself where
a more robust wildcard masking can be done by the client.
--
Sincerely
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html