Subject: [Enum] A/AAAA records

From: "Stastny Richard" <[email-masked]>
Date: Thu, 6 Feb 2003 14:38:11 +0100

Hi Jim,

You wrote:

> For 
> instance, I could duplicate the address of Microsoft's SIP 
> server with an entry in my signed zone under 4.4.e164.arpa. 
> So even if microsoft.com isn't signed, there could be a 
> signed NAPTR record for sip.microsoft.com, albeit one 
> depending on a duplicate A/AAAA record for that SIP server 
> that lives at say sip.microsoft.1.2.3.4.4.e164.arpa. It's 
> ugly but could help until such times as microsoft.com was 
> signed and there was a chain of trust all the way to the root.
> 

Huh?

I have heard rumors about A records ENUM,
but "say sip.microsoft.1.2.3.4.4.e164.arpa." is new for me.

Do you now something I do not now and could you please elaborate.

I do not know about the numbering plan in UK (who knows;-), but
from my SG2 knowledge "+44321microsoftsip" does not look quite
like an E.164 number, not even in Redmond.

regards
Richard
_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jim Reid <[email-masked]>
Date: Thu, 06 Feb 2003 08:15:06 -0800

>>>>> "Richard" == Stastny Richard <[email-masked]> writes:

    >> For instance, I could duplicate the address of Microsoft's SIP
    >> server with an entry in my signed zone under 4.4.e164.arpa.  So
    >> even if microsoft.com isn't signed, there could be a signed
    >> NAPTR record for sip.microsoft.com, albeit one depending on a
    >> duplicate A/AAAA record for that SIP server that lives at say
    >> sip.microsoft.1.2.3.4.4.e164.arpa. It's ugly but could help
    >> until such times as microsoft.com was signed and there was a
    >> chain of trust all the way to the root.

    Richard> Huh?

    Richard> Do you now something I do not now and could you please
    Richard> elaborate.

Sure. Suppose I own the 1.2.3.4.4.e164.arpa zone. It represents my
telephone number. Assume Microsoft have a SIP server at address
10.9.8.7, called sip.microsoft.com. My zone is signed because e164.arpa
is signed. microsoft.com isn't. My zone file could have a NAPTR record
resembling:
	1.2.3.4.4.e164.arpa. IN NAPTR .... "sip:[email-masked]"
So there's a link from my signed zone to something which isn't signed;
the scenario Peter raised recently. However if I add some stuff to the
1.2.3.4.4.e164.arpa zone, the info about that SIP server can be signed,
although under a different name. The zone file might look like this
(minus the SIGs and so on):

    1.2.3.4.4.e164.arpa. IN NAPTR ... "[email-masked]"
    sip.microsoft.1.2.3.4.4.e164.arpa. IN A 10.9.8.7

So provided I keep sip.microsoft.1.2.3.4.4.e164.arpa pointing at the
IP address of Microsoft's SIP server, it will all just work fine. And
it can all be signed with DNSSEC too since the A record above would be
in my signed zone. And since this duplicate A record is in my zone, my
name servers can return it and its signature along with the request
for the NAPTR record, saving resolution of another domain name. This
is just another application of the old computing maxim: any problem
can be solved by adding another layer of indirection.

I hope this clears up any confusion.
_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum