ietf-mxcomp
[Top] [All Lists]

Re: TECH-OMISSION: Security considerations and limit scope

2004-08-30 13:51:24

On Mon, 30 Aug 2004 11:59:34 -0700, Douglas Otis 
<dotis(_at_)mail-abuse(_dot_)org> wrote:

The use of exists and ptr record types adds a burden the recipient may
not wish to endure.  There should be a warning that this type of record
may be rejected.

If you are going to do this, you should treat exists and ptr
separately.  ptr record types almost certainly don't add a burden to
the recipient.  The reason is that pretty much all MTAs do a reverse
lookup on the client's IP address anyway for inclusion in the
Received: header.  The ptr check can therefore be implemented without
an additional DNS lookup.

The exists header can, of course, lead to extra DNS lookups.  Note
also that if you are worried about extra DNS lookups, the include
directive can definitely be responsible for more DNS traffic.  I think
that the flexibility offered by exists and include is very useful in a
number of situations, and so would rather not see "reasonable" use of
the mechanisms deprecated, though clearly we would also like clients
not to feel compelled to go through with "unreasonable" checks. 
Recursion limits are a step in the right direction; whether or not
they suffice will be seen when we deploy this stuff...

[I also believe that a few changes, like allowing the negation of
operators, would significantly reduce (but not eliminate) the need for
include and exists.  However, I recognize such discussion is no longer
in scope, and don't want to distract from the topic at hand...]

David


<Prev in Thread] Current Thread [Next in Thread>