Re: Generic records and DKIM

On Wed, 18 Mar 2009, Matthew Dempsky wrote:

> I see this example in RFC 4871:
> 
>    brisbane IN  TXT  ("v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ"
>                       "KBgQDwIRP/UC3SBsEmGqZ9ZJW3/DkMoGeLnQg1fWn7/zYt"
>                       "IxN2SnFCjxOCKG9v3b4jYfcTNh5ijSsq631uBItLa7od+v"
>                       "/RtdC2UzJ1lWT947qR+Rcac2gbto/NMqJ0fzfVjH4OuKhi"
>                       "tdY9tf6mcwGjaNBcWToIMmPSPDdQPNUYckcQ2QIDAQAB")
> 
> I'm not positive, but I understand this to be a TXT record split
> across 5 chunks.  dig(1)'s output is consistent with this, but I don't
> have a BIND server to test this against to confirm.

RFC1035 3.3.14 defines the TXT RDATA as containing '1 or more character
strings' and 3.3 defines character string as a single length octet
followed by that number of characters.  BIND is not needed; A hex dump
of a packet would be conclusive.

> It seems like judging from that, there shouldn't be any problems with
> tinydns-data splitting your TXT records into 127 byte chunks.  If it's
> still not working with the s/127/255/ change, I suspect your problem
> is somewhere else (e.g., publishing the wrong public key, formatting
> the DKIM record wrong, etc.).

DIG should give the right output...I don't know of any case with TXT
that Dig doesn't work right, so it seems odd and the cause should be
traced down...I agree that large TXT records need to work. 



On the question of use of DKIM and SPF: Spammers were the first to
adopt SPF, and I get a lot of DKIM spam, too.  It could really be that
very few DJBDNS sites use DKIM. Dnscache has a 512byte limit on the
packet size, though there are patches to increase this limit and support
EDNSO.  FYI, in response to another request, I'm putting together a page
on the 14 serious flaws with SPF identified to the IETF before approval
(15 or 16, I think if you include flaws discovered after SPF was
approved, including a DOS attack). Look for that on http://www.IADL.org
soon.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000