Re: Deprecating SPF

Hi,

Carsten Strotmann <[email protected]> writes:
>
> I did some tests on Windows 2008 (R2) in 2009 or 2010 and found that the
> Microsoft server does support RFC 3597 for zones loaded from a master
> (by zonetransfer) or from a masterfile, but there is no way to add or
> edit the data through the GUI (if is however possible to add the records
> to a plain text DNS master file using a text editor, if I remember
> correctly). I haven't tested zones stored in Active Directory.
>

I have done some tests using the current Windows 2012 DNS Server (I
probably will test Windows 2012R2 later in October, but I don't expect
much difference from the results below. If I find differences, I will
report here).

Test-Setup: 
DNS Master: Fedora 19 Linux with BIND
9.9.3-rl.13207.22-P2-RedHat-9.9.3-5.P2.fc19 (Extended Support Version)

DNS Slave: Windows 2012 GA dns.exe 
Version 6.2.9200.16384

Record Types supported by Windows 2012 GUI:
AFSDB, CNAME, ATMA, DS, DHCID, DNSKEY
DNAME, A, AAAA, HINFO, ISDN, MX, MG
MB, MINFO, NAPTR, NXT, PTR, KEY, MR
RP, RT, SRV, SIG, TXT, WKS, X25

It is not possible (to my knowledge) to add other record types other
than the ones above using the Microsoft GUI or command line utilities. 

Therefore the Windows DNS Server was configured to fetch a master zone
from a BIND DNS Server. The zone on the master contained one SPF and one
TLSA record.

After adding the slave zone to Windows 2012, the Windows DNS server did
a full zonetrasfer (AXFR) from the BIND Master. The zonefile created on
disk contained the SPF and TLSA records in hexadecimal encoded format:

(one long line)
_443._tcp    30 #52 03 00 01 54 fffffff3 fffffffd ffffff87 76 
    32 ffffffa4 1c 65 ffffffb0 ffffffff 4e 50 ffffffe2 54 ffffffdd 7d 18
    73 48 62 31 ffffffdc 6c ffffffd5 ffffffe9 ffffffc1 ffffffc1 ffffff96
    3d 1e 4e 

(one long line)
spf          30 #99 12 76 3d 73 70 66 31 20 2b 61 20 2b 6d 78 20 2d 61
    6c 6c 

After the first AXFR, the Windows DNS Server did reply correctly to SPF
and TLSA queries (tested using "dig").

However, the Windows DNS Server fails to load the written zonefile once
restarted. It complains about unknown RRs. The error messages are
similar than the ones seen for the IXFR below.

After the initial zonetransfer using AXFR, the zonetransfer for changes
are done using IXFR. The same records that could be loaded successfully
using AXFR are now failing:

Error 1 while IXFR from BIND master:
The DNS server encountered an non-writeable or unknown resource record
(RR) type when writing the zone database to file. The event data is
applicable RR type.

Error 2 after IXFR from BIND master: 
The DNS server encountered an unknown or unsupported resource record
(RR) type #99 in zone file example.com.dns at line 24.  Although the
DNS server continues to load, ignoring this RR, it is recommended that
you either correct the record type or remove this RR from the zone
file.  The zone file is located in the %SystemRoot%\System32\Dns
directory.

I have not found a practical way to provision a Windows 2012 DNS Server
with SPF (or TLSA) records.

However it seems as if the Windows 2012 DNS server engine can work with
unknown RRs, but the zone loader/parser and the IXFR code cannot.

It might be interesting to get a statement from Microsoft on the support
of unknown RRs (deliberate decision not support unknown RRs, no demand
from customers, problem not known ...).

Best regards

Carsten



_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext