[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Trouble with Sender Authentication
On Nov 7, 2006, at 11:42 AM, Frank Ellermann wrote:
Douglas Otis wrote:
Promotion of SPF effectively thwarts any consideration of
alternatives on spf- discuss.
You'll tell us when you've found a better way to partition all IPs
into three sets PASS, FAIL, or DUNNO (with as many variants of
DUNNO as you need).
The RFC3123 permits more than 50 CIDRs per transaction when address
registration is desired. A better choice would be to authenticate
the EHLO as an address literal or host name. The EHLO in any form
can then be associated with an originating domain. Any number of
flags may then indicate the nature of the association and the level
of assurance offered. With this technique only _one_ small
transaction is made against a message targeted resource and is much
safer from a DDoS concern.
For examples of such a scheme see:
http://www.sonic.net/~dougotis/id/draft-otis-dkim-dosp-02.html
Nice to see that you agree that your data doesn't back up your
claims, but even your 64:1 number is bogus.
How so?
Because 100/11 is a bit more than 9, and 100/12 is a bit less than 9.
There is about 640 bytes of traffic for each of the 100 transactions
representing 64,000 bytes of generated traffic. When a message is
about 1000 bytes, the ratio of SPF traffic per message is then 64:1
or 64K bytes of DNS traffic per message.
a gift given an attacker by those executing SPF script.
The stuff is called "SPF policy" or "SPF record", not "SPF script".
A possible >6K bytes of SPF script (a series of instructions carried
out in a specific order) must be executed to obtain an answer. The
answer might involve the comparison of multi faceted PTR
transactions, two stage MX transactions within CDIRs, and/or direct
addresses transactions within CIDRs at macro generated locations
compared against SMTP client addresses. There is also checks for any
answer from address transactions at macro constructed locations. No
answer is assured without executing the instructed transactions and
applying the indicated Boolean logic. This script also contains
includes, redirects and default statements. SPF is the epitome of a
script. In contrast, APL does not involve subsequent instructed
transactions to obtain an answer and would not be described as a script.
-Doug