Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-28 Thread Bjørn Mork
Måns Nilsson writes: > NS5 > 21 > DNSKEY3 > SPF 1 > A 28 > NSEC 62 > AFSDB 3 > RP1 > MX2 > CNAME 9 > SOA 2 > RRSIG 147 > TXT 6 > SSHFP 14 > SRV 20 > DS4 > Total:16 rrtypes in zone No TLSA records? Bjørn

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-28 Thread Måns Nilsson
Subject: Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking Date: Thu, Feb 28, 2019 at 08:47:19AM + Quoting Mike Meredith (mike.mered...@port.ac.uk): > On 27 Feb 2019 13:07:09 -0500, "John Levine" may have > written: > > The IETF one says that no

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-28 Thread Måns Nilsson
Subject: Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking Date: Wed, Feb 27, 2019 at 07:59:49PM -0800 Quoting Seth Mattinen (se...@rollernet.us): > On 2/27/19 7:02 PM, b...@theworld.com wrote: > > I have proposed many times to just move domain WHOIS data i

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-28 Thread Mike Meredith
On Wed, 27 Feb 2019 19:59:49 -0800, Seth Mattinen may have written: > We kind of have that with RP records. But does anyone do it? I used to before various IPAM vendors claimed it was deprecated; I've still got legacy code that queries for it (and the TXT equivalent) as well as the new gooey IPAM

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-28 Thread Mike Meredith
On 27 Feb 2019 13:07:09 -0500, "John Levine" may have written: > The IETF one says that nobody used type 99, and some of the few > implementations we saw were broken, so we deprecated it. And just after I'd finished adding in all the SPF records too, so I had to turn around and take all them out

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-27 Thread Seth Mattinen
On 2/27/19 7:02 PM, b...@theworld.com wrote: I have proposed many times to just move domain WHOIS data into a new RRTYPE and let whoever owns the domain put in that whatever they want, including (and perhaps most usefully for many) just a URL for further detail. We kind of have that with RP re

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-27 Thread Mark Andrews
> On 28 Feb 2019, at 1:13 pm, John R. Levine wrote: > > FYI: > >> SMTP transitioned from A to MX. > > No, it didn't. A surprising number of real mail hosts only publish an A, and > I lost the battle to say that MX shouldn't fall back to . It does. You have missed the point. No one p

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-27 Thread bzs
I have proposed many times to just move domain WHOIS data into a new RRTYPE and let whoever owns the domain put in that whatever they want, including (and perhaps most usefully for many) just a URL for further detail. Obviously registries/registrars/ICANN can require and maintain more specific a

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-27 Thread John R. Levine
FYI: SMTP transitioned from A to MX. No, it didn't. A surprising number of real mail hosts only publish an A, and I lost the battle to say that MX shouldn't fall back to . It does. SPF could have been the same except people were impatient and had unrealistic expectations of how long

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-27 Thread Mark Andrews
> On 28 Feb 2019, at 9:03 am, John R. Levine wrote: > > On Thu, 28 Feb 2019, Mark Andrews wrote: >> Agreed. Additionally it suddenly went from something being done along >> with a experiment to being “a experiment on can you transition to a new >> type”. The transition to type99 was well und

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-27 Thread John R. Levine
On Thu, 28 Feb 2019, Mark Andrews wrote: Agreed. Additionally it suddenly went from something being done along with a experiment to being “a experiment on can you transition to a new type”. The transition to type99 was well underway. ... No, really, we had numbers. Approximately nobody was u

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-27 Thread Mark Andrews
> On 28 Feb 2019, at 7:28 am, Måns Nilsson wrote: > > Subject: Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS > Hijacking Date: Wed, Feb 27, 2019 at 01:07:09PM -0500 Quoting John Levine > (jo...@iecc.com): >> In article <20190227161327.ga27...@bes

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-27 Thread Måns Nilsson
Subject: Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking Date: Wed, Feb 27, 2019 at 01:07:09PM -0500 Quoting John Levine (jo...@iecc.com): > In article <20190227161327.ga27...@besserwisser.org> you write: > >that is RFC 7208.[0] > > >[0

Re: a detour DANE, was A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-27 Thread John Levine
In article <20190227161327.ga27...@besserwisser.org> you write: >that is RFC 7208.[0] >[0] This document tries to deprecate RRTYPE 99 for SPF. By stating that >only TXT records can be trusted. ... This must be a very different RFC 7208 from the one that the IETF published. The IETF one says that