Re: DNSSEC - Signature Only vs the MX/A issue.

[Mike StJohns <Mike.StJohns@nominum.com>]

Not exactly.  See my previous note to Mark.  SO still protects the 
atomicity of an RRSet - you can delete ALL of the SRV records or none 
of them.  If you delete all of them at a label, the lookup fails and 
you can't proceed.  If you do retrieve the SRV records and then 
lookup the referenced A records, the worse that can happen is that 
one or more of the individual A records is deleted and an attacker 
can steer you to one specific system (from the list of validated names).


At 08:58 AM 11/28/2006, Stephane Bortzmeyer wrote:
> On Sun, Nov 26, 2006 at 10:26:55PM -0500,
>  Mike StJohns <Mike.StJohns@nominum.com> wrote
>  a message of 51 lines which said:
>
> > I chatted briefly with John Klensin about deprecating this MX/A
> > alternate in the next revision to RFC2821 - comments on whether this
> > is a reasonable approach?
>
> Unfortunately, there are other records that are vulnerable to this
> attack (SRV, NAPTR), not just MX.
>
> --
> to unsubscribe send a message to namedroppers-request@ops.ietf.org with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>