Subject: RE: [Enum] A/AAAA records

From: "Stastny Richard" <[email-masked]>
Date: Thu, 6 Feb 2003 17:47:58 +0100

Jim
Thanks for the clarification.

I think I got the idea (maybe we have to chat about this in detail)

Anyway, I do not assume anybody using ENUM (e.g. my mother) is a Nominum
DNS specialist setting up his Tier 2 in this way;-)

regards
Richard

PS: if I call +44321 on my mobile phone, you answer the call ;-)

> -----Original Message-----
> From: Jim Reid [mailto:[email-masked]] 
> Sent: Thursday, February 06, 2003 5:15 PM
> To: Stastny Richard
> Cc: [email-masked]
> Subject: Re: [Enum] A/AAAA records 
> 
> 
> >>>>> "Richard" == Stastny Richard <[email-masked]> writes:
> 
>     >> For instance, I could duplicate the address of Microsoft's SIP
>     >> server with an entry in my signed zone under 4.4.e164.arpa.  So
>     >> even if microsoft.com isn't signed, there could be a signed
>     >> NAPTR record for sip.microsoft.com, albeit one depending on a
>     >> duplicate A/AAAA record for that SIP server that lives at say
>     >> sip.microsoft.1.2.3.4.4.e164.arpa. It's ugly but could help
>     >> until such times as microsoft.com was signed and there was a
>     >> chain of trust all the way to the root.
> 
>     Richard> Huh?
> 
>     Richard> Do you now something I do not now and could you please
>     Richard> elaborate.
> 
> Sure. Suppose I own the 1.2.3.4.4.e164.arpa zone. It 
> represents my telephone number. Assume Microsoft have a SIP 
> server at address 10.9.8.7, called sip.microsoft.com. My zone 
> is signed because e164.arpa is signed. microsoft.com isn't. 
> My zone file could have a NAPTR record
> resembling:
> 	1.2.3.4.4.e164.arpa. IN NAPTR .... 
> "sip:[email-masked]" So there's a link from my signed 
> zone to something which isn't signed; the scenario Peter 
> raised recently. However if I add some stuff to the 
> 1.2.3.4.4.e164.arpa zone, the info about that SIP server can 
> be signed, although under a different name. The zone file 
> might look like this (minus the SIGs and so on):
> 
>     1.2.3.4.4.e164.arpa. IN NAPTR ... 
> "[email-masked]"
>     sip.microsoft.1.2.3.4.4.e164.arpa. IN A 10.9.8.7
> 
> So provided I keep sip.microsoft.1.2.3.4.4.e164.arpa pointing 
> at the IP address of Microsoft's SIP server, it will all just 
> work fine. And it can all be signed with DNSSEC too since the 
> A record above would be in my signed zone. And since this 
> duplicate A record is in my zone, my name servers can return 
> it and its signature along with the request for the NAPTR 
> record, saving resolution of another domain name. This is 
> just another application of the old computing maxim: any 
> problem can be solved by adding another layer of indirection.
> 
> I hope this clears up any confusion.
> 
_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jim Reid <[email-masked]>
Date: Thu, 06 Feb 2003 09:04:35 -0800

>>>>> "Richard" == Stastny Richard <[email-masked]> writes:

    Richard> PS: if I call +44321 on my mobile phone, you answer the
    Richard> call ;-)

Sure, no problem. Just as long as your phone does ENUM lookups. I
control the 4.4.e164.arpa zone file. :-)
_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Michael Mealling <[email-masked]>
Date: 06 Feb 2003 12:16:25 -0500

> DNS specialist setting up his Tier 2 in this way;-)

Umm.. I don't think anyone is suggesting that your mother is going to be
administering her own nameserver. Her service provider will probably be
doing it for her at her direction. And I'm probably sure anyone who
would be doing that function for a service provider will at least have a
copy of DNS & BIND on their desk....

I appreciate your attempt to keep ENUM simplistic but I'm curious what
your application requirements are that force you to want to make your
implementation so simplistic as to be insecure and non-interoperable?

-MM