Subject: Re: directory blocking for NORETRIEVE

From: Dan Stromberg <[email-masked]>
Date: Fri, 02 Oct 1998 11:36:41 -0700

Ayamura Kikuchi wrote:
> 
> > Include the 'password-check-kit' posted to the mailing list June 9, 1998,
> > by [email-masked].  This adds regular expression matching for
> > email addresses.  The original kit checks the DNS for A and MX RRs; only
> > MX records should be verified since A records should never be used for
> > delivery of email and the idea is to determine if the email address given
> > could possibly be correct.

Actually, A records -should- be verified.

Sure, using an MX instead of an A implies less load on DNS servers, but
a lot of people don't know this, and this is really just a somewhat
small performance issue, not something wuftpd should get into
enforcing.  Many people, including some experienced admins, use A's for
e-mail.  We don't (at least, nothing we set up in the last couple of
years), but I expect quite a number of sites do.

wuftpd should duplicate what sendmail does, not create its own rules.

So there should also be a CNAME check (or you could just go through the
C library for this part), and there should also (nasty as they are) be a
wildcard MX check (tho the DNS may do this transparently).

sendmail's dns_getcanonname() is perhaps the right function to emulate
or replicate.

When it comes to computer protocols, you should always be liberal in
what you accept, and conservative in what you produce.

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 2 Oct 1998 15:58:41 -0400 (EDT)

On Fri, 2 Oct 1998, Dan Stromberg wrote:

> Sure, using an MX instead of an A implies less load on DNS servers,
> but a lot of people don't know this, and this is really just a
> somewhat small performance issue, not something wuftpd should get into
> enforcing.  Many people, including some experienced admins, use A's
> for e-mail.  We don't (at least, nothing we set up in the last couple
> of years), but I expect quite a number of sites do.

This isn't a performance issue.  Sites concerned about performance will
likely want all the DNS activity removed (hence, the NO_DNS option in
VR8).

> wuftpd should duplicate what sendmail does, not create its own rules.

I believe the RFC (or at least a BCP) says you shouldn't attempt delivery
without an MX.  The proposition is the MX is advertisement of willingness
to accept mail and the lack of one should not be taken to mean the the
host will accept it directly.

Sendmail attempts the delivery on the supposition that (a) well, if it
takes it, that's fine but what we're hoping is (b) maybe an MX will show
up while this email is in the queue.

> wildcard MX check (tho the DNS may do this transparently).

Yes, the check should look through CNAMEs to see if the target has an MX.

> sendmail's dns_getcanonname() is perhaps the right function to emulate

Reading that function does point out the check will need to walk toward
the root domain ('.') to see if there are any wildcard MX records to be
found higher up.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Dan Stromberg <[email-masked]>
Date: Fri, 02 Oct 1998 13:09:28 -0700

> likely want all the DNS activity removed (hence, the NO_DNS option in

It's a performance issue to sendmail, according to the bat book.

> host will accept it directly.

This violates the "liberal in what you accept" principal.  You really
should be able to use an A.  If you refuse an e-mail address that
sendmail accepts, people are going to think wuftpd is confused about
what an e-mail address really is.  Hence you're going to end up
answering a bunch of silly questions about why it "doesn't work" - and
worse, simply drive people away from using sites configured with the DNS
check.  (Every bug report should be assumed to have 9 other people
who've encountered the same bug and just given up)

---

From: David Kovar <[email-masked]>
Date: Fri, 2 Oct 1998 13:19:30 -0700 (PDT)

> It's a performance issue to sendmail, according to the bat book.

According to the README in the cf section of the latest sendmail,
"nodns" is a "nop" at the moment. If you do not want DNS, you should
remove it from /etc/nsswitch.conf.

-David

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 2 Oct 1998 16:19:05 -0400 (EDT)

> It's a performance issue to sendmail, according to the bat book.

We're not writing sendmail.

> who've encountered the same bug and just given up)

We're not writing a mail server at all.

That adage is for protocol issues.  This is a security feature.  For
security it reads, "be draconian and if they don't like it, tough."

The idea is to see if the email address could possibly be delivered.  An
MX says 'yes'.  No MX says 'dunno, try again later'.  This is a security
check, there is no later to try.

--

---

From: Dan Stromberg <[email-masked]>
Date: Fri, 02 Oct 1998 13:51:04 -0700

> We're not writing sendmail.

Then be more careful with your contradictions.  You should have said
"not a performance issue to wuftpd" not "not a performance issue".

> security it reads, "be draconian and if they don't like it, tough."

If you refuse MXless A's, you're almost certainly going to drive away a
class of legitimate users you should have granted access to.

> check, there is no later to try.

According to the bat book, no MX says "try the A immediately", not "try
again later".  IE, an A alone works fine, it's just a bit slower (hence
my mention of the performance issue), because the DNS server gets two
requests instead of one (MX check, then A check; instead of just MX
check).

If you want "possibly delivered", as you say, then you need to check for
A's, assuming the bat book isn't incorrect.