Subject: Re: [spfbis] Possible new issue: Be more liberal with the syntax?

From: Arthur Thisell <[email-masked]>
Date: Wed, 7 Mar 2012 08:35:43 -0800 (PST)

> I don't know what the ADs will say about it,
*sigh*  Clearly, I needed more coffee before posting this morning.  

> No hat.  It's funny you should say that; there's currently a great
> deal of gnashing of teeth over how you can do that.  How can you
> unambiguously tell a domain name from an IPv4 address?  What if the
> list of TLDs changes dramatically?

A domain name must have at least one ALPHA character in each label, an IPv4 address must have all numeric labels (in the range of 0-255), and an IPv6 address basically must have a colon.   This is all spelled out in the ABNF in RFC 4408 (see ip4-network, ip6-network and domain-spec).   Somewhere in the MARID posts, here is a regular expression that matches all valid SPF records.   The RFC 4408 ABNF is restricted enough that it can be run through ABNF->re converts.

If there are real issues distinguishing these, then it is likely that the RFC 4408 ABNF is wrong and needs to be fixed/clarified.

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 7 Mar 2012 13:02:14 -0500

No hat.

On Wed, Mar 07, 2012 at 08:35:43AM -0800, Arthur Thisell wrote:
> 
> A domain name must have at least one ALPHA character in each label,
> an IPv4 address must have all numeric labels (in the range of
> 0-255), and an IPv6 address basically must have a colon.  This is
> all spelled out in the ABNF in RFC 4408 (see ip4-network,
> ip6-network and domain-spec).

This is interesting, and I hadn't put it together before.  I think
your argument isn't quite right, but I think you're nevertheless
correct that under RFC 4408 rules you _can_ unambiguously
differentiate these three different types of thing.  Phew.

For those who care about the argument:

RFC 1123 has some rules about host names (not, actually, domain names;
RFC 3696, which is the basis for section 8.1 in RFC 4408, is
informational, but 1123 assuredly isn't.  Confusion about host
vs. domain names is rampant, and I'm going to glide over it for now).
Depending on how you read it, RFC 1123 either makes a normative claim
that top-level labels in host names must be "alphabetic" (which in the
context means [a-zA-Z]) or else makes a statement about then-current
root zone policy.  There is an open dispute about which interpretation
of 1123 is right.

This turns out to be important because some time ago ICANN started
delegating DNS names from the root using IDNA.  Every one of those
labels starts with "xn--", which means that at the very least there
will be hyphens (non-alphabetic characters) in there; it works out
that digits are also possible.

This means that every one of those new TLDs will fail any strict SPF
checker if they're really doing what section 8.1 of 4408 says.

I may be misreading it, but I don't think 4408 requires an alphabetic
character in every label.  If it does, it's seriously broken.  While
RFC 952 required every label to start with an alphabetic character
(thereby ensuring that every label had at least one alphabetic
character), RFC 1123 explicitly relaxed this requirement, as the
DISCUSSION in section 2.1 makes clear:

           If a dotted-decimal number can be entered without such
           identifying delimiters, then a full syntactic check must be
           made, because a segment of a host domain name is now allowed
           to begin with a digit and could legally be entirely numeric
           (see Section 6.1.2.4).  However, a valid host name can never
           have the dotted-decimal form #.#.#.#, since at least the
           highest-level component label will be alphabetic.

(It's actually the "will be alphabetic" bit at the end of that
DISCUSSION that is the source of controversy.)

RFC 4408 does give us some reason for hope, however, and that it that
it also has rules about IPv4 and IPv6 addresses, which allow us to
distinguish even when, in general, we might not be able to.  (The
general problem is that IP addresses can appear in forms that are
_not_ the usual forms, but since there is a restriction on what an IP
address could be, we might be ok.)  

Unless I'm misreading it, RFC 4408 doesn't enforce the "must be
alphabetic" rule, but instead just requires an alphabetic at the
beginning of the label:

   toplabel         = ( *alphanum ALPHA *alphanum ) /
                      ( 1*alphanum "-" *( alphanum / "-" ) alphanum )
                      ; LDH rule plus additional TLD restrictions
                      ; (see [RFC3696], Section 2)
   alphanum         = ALPHA / DIGIT

So RFC 4408 is actually more relaxed than RFC 1123 (on the "strict"
reading), but that's a good thing because the actual root zone needs
it to be more relaxed.

Best,

A

-- 
Andrew Sullivan
[email-masked]