Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Doug Barton
On 03/04/2014 11:58 AM, Paul Vixie wrote: Doug Barton wrote: ... However, in general: 1. Anyone can put anything in a PTR record. There is no safe assumption that the content is accurate. s/anyone/the owner of the netblock/ Well, if you're really going to get that specific, it's "The oper

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Lawrence K. Chen, P.Eng.
On 03/04/14 04:20, Jim Reid wrote: > On 3 Mar 2014, at 17:26, Stephen Malone wrote: > >> 1. In general, can I trust PTR records? Is ownership of the target >> domain validated at setup time by ISPs, and if yes, how is this done? > > Define what you mean by "trust" and "validate". For bo

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Lyle
On 3/3/2014 11:26 AM, Stephen Malone wrote: Hi Folks, For PTR records out there that are pointing to domains other than those that you control, I'm looking to understand common practice around their setup. Two questions: 1.In general, can I trust PTR records? Is ownership of the target dom

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Paul Vixie
Doug Barton wrote: > ... However, in general: > > 1. Anyone can put anything in a PTR record. There is no safe > assumption that the content is accurate. s/anyone/the owner of the netblock/ implication: you can trust that an IN-ADDR.ARPA or IP6.ARPA PTR reflects the will of the netblock owner,

Re: [dns-operations] signing reverse zones

2014-03-04 Thread Lawrence K. Chen, P.Eng.
On 02/10/14 18:05, Mark Andrews wrote: > > In message > > , Mark Boolootian writes: >> I'm interested in knowing if it is standard practice amongst folks to >> sign .arpa zones. Is there a compelling use case for signing reverse >> zones? > > All zones should be signed. For structured zones

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Jothan Frakes
I totally concur on PTR = nice but not really trusted. I can example it as being an accessory in determination of trust, though. As a component of trust heuristics, on SMTP mailers that are 'first hop', some mailers look for a direct match between the MX and the A record returned for _HOSTNAME_ a

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Doug Barton
The OP specifically said "anti-spam providers" in the context of "is there a risk that the target domain could be blacklisted by anti-spam providers?" I am assuming that everyone here (including the OP) knows that specific anti-spam solutions that you would run on your mail servers look for v

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread WBrown
Doug wrote on 03/04/2014 12:48:03 PM: > 2. In my experience (which is not thorough, but also not zero) anti-spam > folks are completely uninterested in what's in the PTR, and generally do > not do any blacklisting by domain name in the sense you seem to mean. Not exactly true. Many insist th

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Jo Rhett
On Mar 4, 2014, at 9:48 AM, Doug Barton wrote: > 2. In my experience (which is not thorough, but also not zero) anti-spam > folks are completely uninterested in what's in the PTR, and generally do not > do any blacklisting by domain name in the sense you seem to mean. You mean except for all t

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Doug Barton
Ignoring that Jim's response was a bit snarky, and also ignoring the other responses you've already received, it's hard to answer your question without knowing a bit more about what you're up to. However, in general: 1. Anyone can put anything in a PTR record. There is no safe assumption that

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Peter Koch
On Mon, Mar 03, 2014 at 05:26:54PM +, Stephen Malone wrote: > 1. In general, can I trust PTR records? Is ownership of the target > domain validated at setup time by ISPs, and if yes, how is this done? the presence and content of a PTR RR is solely controlled by who ever controls the co

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread George Michaelson
PTR records can exist in any zone. They matter when they lie under in-addr.arpa and ip6.arpa because gethostbyaddr() roots queries in that name path. But, lets be clear, you can jam a PTR into any place you like. its just an RR. under .ARPA, The zones which administer PTR records are strongly alig

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Glen Wiley
I have seen ISPs and hosting proividers reluctant to offer to add PTR records for blocks that they control that point to hosts in domains out of their control. As a result you end up with either no PTR or a PTR that points an IP to a host that isn't relevant or correct as far as what the Internet

Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Jim Reid
On 3 Mar 2014, at 17:26, Stephen Malone wrote: > 1. In general, can I trust PTR records? Is ownership of the target > domain validated at setup time by ISPs, and if yes, how is this done? Define what you mean by "trust" and "validate". For bonus points, define "ownership". > 2. If

[dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Stephen Malone
Hi Folks, For PTR records out there that are pointing to domains other than those that you control, I’m looking to understand common practice around their setup. Two questions: 1. In general, can I trust PTR records? Is ownership of the target domain validated at setup time by ISPs, and