Re: 9 reasons for dynamic authorization records

[email protected] wrote:
> (a) What is the problem with updating the zonefile every second? I 
> don't see any problems at all with it. If you said 100 times a second, 
> sure, then we can talk about potential issues, but once?

  The serial numbers will wrap quickly.  You'll also have to set small
timeouts, otherwise end hosts will cache old records for longer than
users may be on the network.  (Think 1/2 hr of free time between
flights at the airport...)

  To me, such short-term updates to DNS are more indicative of abuse
than proper use.  If short-term updates are required, then either we
need something other than DNS to store the records, or the alleged
solution is too inefficient to deploy in the real world.

  It should be possible for a domain to express a policy such as "mail
comes from IP's A, B, and C, or anyone signing messages with key X".
It should also be possible for the recipient to tell the roaming user
that they don't accept mail, even with key X, and that the roaming
user should send their mail through a real MX.

  The problem is that no one wants to cooperate.  Everyone wants their
personal network use pattern to be standardized, and to forbid most
other uses.  This lack of cooperation means that there's little
incentive to create a protocol which will result in cooperating peers.

  Alan DeKok.