RE: [Asrg] 5. Challenge/Response Internetworking - DNS wildcards (was 7. BCP - Verisign: All Your Misspelling Are Belong To Us)

["Eric Dean" <eric@purespeed.com>]

I still don't see how CRI will break.  We send CRI headers...we don't
get a response...how is that broken?

> -----Original Message-----
> From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of
Yakov
> Shafranovich
> Sent: Tuesday, September 16, 2003 8:48 AM
> To: ASRG list
> Subject: [Asrg] 5. Challenge/Response Internetworking - DNS wildcards
(was
> 7. BCP - Verisign: All Your Misspelling Are Belong To Us)
> 
> The message below has direct relevance to the CRI proposal,
specifically
> the part about verifying the sender via SMTP. With wildcards enabled,
> CRI via SMTP will break.
> 
> Yakov
> 
> -------- Original Message --------
> Subject: 7. BCP - Verisign: All Your Misspelling Are Belong To Us
> Date: Tue, 16 Sep 2003 01:26:23 -0400
> From: Yakov Shafranovich <research@solidmatrix.com>
> To: Brad Knowles <brad.knowles@skynet.be>
> CC: IRTF ASRG <asrg@ietf.org>
> References: <a06001a20bb8c10de2061@[10.0.1.2]>
> 
> PLEASE BE ADVISED THAT VERISIGN IS OPERATING AN SMTP SERVER AT THAT
> ADDRESS. The SMTP server appears fake, take a look at the following
> transaction:
> 
> ----snip---
> open 64.94.110.11 25
> 220 snubby1-wceast Snubby Mail Rejector Daemon v1.3 ready
> blahblahbla
> 250 OK
> blahblahbla
> 250 OK
> blahblabhjla
> 550 User domain does not exist.
> blahblbjhbj
> 250 OK
> blajbjbjb
> 221 snubby1-wceast Snubby Mail Rejector Daemon v1.3 closing
transmission
> channel
> 
> Connection to host lost.
> ----snip---
> 
> Brad Knowles wrote:
> 
> > Folks,
> >
> >     This was just posted to the NANOG mailing list.  There are
already
> > people who are working on hacking BIND to return NXDOMAIN for
wildcard
> > records in TLD zones, or perhaps for any reference to the specific
IP
> > address(es) they are using (so far, we only know about
64.94.110.11).
> > Meanwhile, many are already null-routing this IP address.
> >
> >     This affects us, because now anyone can send spam with an
address
> > like "i@spam.from.verisign.becausethisdomaindoesntreallyexist.net",
and
> > yet still have that pass standard anti-spam checks like "Does this
> > domain really exist in the DNS"?
> >
> >
> >     Another one for the service provider BCP, I think.
> >
> >
> >     Anyway, the full message announcing this "enhancement" is:
> >
> >> Date: Mon, 15 Sep 2003 19:24:29 -0400
> >> From: Matt Larson <mlarson@verisign.com>
> >> To: nanog@nanog.org
> >> Subject: Change to .com/.net behavior
> >>
> >>
> >> Today VeriSign is adding a wildcard A record to the .com and .net
> >> zones.  The wildcard record in the .net zone was activated from
> >> 10:45AM EDT to 13:30PM EDT.  The wildcard record in the .com zone
is
> >> being added now.  We have prepared a white paper describing
VeriSign's
> >> wildcard implementation, which is available here:
> >>
> >> http://www.verisign.com/resources/gd/sitefinder/implementation.pdf
> >>
> >> By way of background, over the course of last year, VeriSign has
been
> >> engaged in various aspects of web navigation work and study.  These
> >> activities were prompted by analysis of the IAB's recommendations
> >> regarding IDN navigation and discussions within the Council of
> >> European National Top-Level Domain Registries (CENTR) prompted by
DNS
> >> wildcard testing in the .biz and .us top-level domains.
Understanding
> >> that some registries have already implemented wildcards and that
> >> others may in the future, we believe that it would be helpful to
have
> >> a set of guidelines for registries and would like to make them
> >> publicly available for that purpose.  Accordingly, we drafted a
white
> >> paper describing guidelines for the use of DNS wildcards in
top-level
> >> domain zones.  This document, which may be of interest to the NANOG
> >> community, is available here:
> >>
> >> http://www.verisign.com/resources/gd/sitefinder/bestpractices.pdf
> >>
> >> Matt
> >> --
> >> Matt Larson <mlarson@verisign.com>
> >> VeriSign Naming and Directory Services
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Asrg mailing list
> Asrg@ietf.org
> https://www1.ietf.org/mailman/listinfo/asrg



_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg