Re: 9 reasons for dynamic authorization records

Hadmut Danisch <[email protected]> wrote:
>   E.g. a company with 5,000 employees or ISPs with 50,000 customers
>   would have to update their zone file every second if the wanted 
>   to support their traveling employees/customers.

  This means that their network design is incorrect.  The travelling
employees can use VPN's to connect back to corporate headquarters to
send mail.  Companies that don't do that should understand that the
price for not doing that work is more work of a different nature.
(i.e. DNS updates)

> * This can be easily adapted to any site-specific authorization 
>   scheme. You need to lookup the current authorization state
>   only when an e-mail is actually sent and don't need to 
>   update your zone tables every time a user logs in or out.

  Again, that's a symptom of a bad design.

> * The reply and it's expiry/validity can depend on more than just the
>   sender address, e.g. the recipient address, the message-id, the
>   content-type, the receiver's country and legislation.

  Something similar can be expressed in DNS.

  While I understand it's useful to allow implementations and
deployments to vary depending on local requirements, supporting bad
network design is always a bad idea.

  Alan DeKok.