Re: Same DNS records for different checks

On Sun, Oct 26, 2003 at 12:41:05AM -0400, Yakov Shafranovich wrote:
> My question to you guys is as follows:
> 
> There are two approachs outlined here:
> 1. HELO checks.
> 2. MAIL FROM checks.
> 
> These different types of checks - can they rely on data stored in the 
> same DNS records - can we use the same DNS record for both checks?

Well, I think we already agreed on the fact, that we consider the
HELO argument as a full hostname, while MAIL FROM checks take a
domain part only (or full e-mail address).

So in most (but not in all) cases the DNS record will be found 
at different positions in DNS and thus can be different.
But people might wish to give their relays domain- instead of
hostnames.


But there are two side effects of using the same : 

1. If we do use the same record in principle, then any relay (called
   HOST) will be allowed to always send messages with sender addresses
   ...@HOST .


2. If a relay is allowed to send messages from ...@DOMAIN, it will 
   always be allowed to call itself DOMAIN in the HELO. 


This would imply to use the same record type, but to search at
different places, e.g. _rmxh.DOMAIN and _rmxs.DOMAIN. This would solve
any ambiguity, but on the cost of additional DNS queries in some
cases. But in many cases the HELO name differs from the domain name
anyway, so the cases where it actually causes _additional_ queries
would be rather rare.

There is also an administrative overhead, which could be minimized
by

_rmxh  CNAME _rmxs....

if the admin wants to have the same entry for both.


Yeah, I think this could work.

Hadmut