Eric A. Hall wrote:
On 10/24/2006 4:01 PM, John Rudd wrote:
Eric A. Hall wrote:
Note that this is entirely legal, and even necessary:
[ root# ] host 207.65.71.14
14.71.65.207.in-addr.arpa is an alias for 14.in-addr.ntrg.com.
14.in-addr.ntrg.com is an alias for 14.in-addr.labs.ntrg.com.
14.in-addr.labs.ntrg.com domain name pointer bulldog.labs.ntrg.com.
All of that's ok. The question is:
is bulldog.labs.ntrg.com an A record, or a CNAME record?
That's the thing I have been testing for (is it a CNAME). That's the
thing that RFC1912 doesn't like (the PTR record itself, not merely
in-addr.arpa aliases that eventually get to the PTR record, but the PTR
record itself, may not _refer_to_ a CNAME record, it must refer to an A
record)
There's nothing that prohibits the target domain name entry of a PTR from
having a CNAME record. A PTR is just "a pointer to some other domain
name". The target domain name can have whatever records the owner feels
they need. It's probably something that should be discouraged, since
additional processing would be needed to obtain a complete answer, but on
its face it's not illegal (again RFC1912 is informational, is not
authoritative, and has significant errors).
You'd probably need a plugin to check for this, since you'd need to
generate your own query for the RRs associated with the target domain name
in order to get a definitive answer.
I'm not really sure this would be reliable spam-sign. I can imagine some
legitimate uses for this.
Like I said, it hasn't shown up in the my logs in the 15 or so months
I've been testing it. Which means it is:
a) probably not as used as you're saying
b) definitely not a useful test for what I'm doing
Though, I do think I need to build a plugin for the "hostname contains
hex encoded IP address" check. I just need to know where to start on
building a plugin, and being sure it can see the pseudo-headers. I
think I saw a little bit about that on the wiki for the first part, but
I have no idea about the second part (accessing the pseudo-headers from
within a plugin).
John
