Re: Implementing DANE for qmail

Erwin Hoffmann <[email protected]> Sun, 9 Apr 2017 20:07:07 +0200
Newsgroups	gmane.mail.qmail.general
Message-ID	<[email protected]>
Hi Manvendra,


> Am 09.04.2017 um 17:52 schrieb Manvendra Bhangui <[email protected]>:
> 
> I have been thinking about this and have followed this document
> 
> https://www.ietf.org/mail-archive/web/dane/current/pdfk2DbQF0Oxs.pdf
> 
> What I have understood is this
> 
> For Domain owners
> publish a TLSA Resource Record (RR) and enforce your servers to use TLS.

Mail clients ;-)

> 
> For clients
> query the TLSA RR and then decide to connect or not. This will require
> modification to qmail-remote.

Better not too many.

> As specified in the DANE protocol RFC,
> the TLSA RR resulting from a DNS Query must be validated by DNSSEC.

Hm. I doubt it. You will find a good explanation of TLSA/DNSSEC/DJBDNS in my text book 'Technik der IP-Netze' (unfortunately just in German).

> It
> is MUST that the zone which has a TLSA RR must be signed by DNSSEC and
> the applications which query the domain for TLSA RR validation should
> use a DNSSEC aware resolver. This is where I am confused. Do all
> resolver setup support DNSSEC?

No. qmail-remote uses a stub-resolver and DNSSEC/TLS validation could/should be done by means of a proxy.

> 
> Is there anyone working on this? If yes, how difficult would this be
> to implement?
> 

You can briefly check, that this is on my agenda for s/qmail. The hard part is the validating DNS resolver.
It is easy with DJBDNS. DNSSEC is be definition not secure but depends a X.509 system (not PKI) -- the one to avoid according to TLSA.

Apart from that, PKI still needs to be supported.


Regards.
--eh.

PS. Within s/qmail Cert Pinning is supported which is great on peer-2-peer base, but of course does not scale like TLSA.


> --
> Regards Manvendra - http://www.indimail.org
> GPG Pub Key
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC7CBC760014D250C
> 

Dr. Erwin Hoffmann | FEHCom | http://www.fehcom.de | PGP Key-Id: EE00CF65
signature.asc (application/pgp-signature, 842 B)