OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: DNAME records

From: mouss (moussnetoyen.net)
Date: Tue Apr 01 2008 - 12:00:25 CDT


Dan Lists wrote:
> On Tue, Apr 1, 2008 at 11:10 AM, mouss <moussnetoyen.net> wrote:
>
>
>> Dan Lists wrote:
>>
>>> I've started seeing these in my logs:
>>>
>>> Mar 31 19:59:40 server postfix/smtpd[1997]: gethostby*.getanswer: asked
>>>
>> for
>>
>>> "host.suba.example.com IN A", got type "DNAME"
>>>
>>> If I use host or ping, they correctly do a look up using the aliased
>>>
>> domain
>>
>>> and return/use the IP. Can postfix be configured to handle DNAME
>>>
>> records?
>>
>> what for?
>>
>>
>
> Postfix is complaining about it. I don't have any of the strict DNS checks
> on, but it might cause bounces if that stuff is turned on. At the very
> least, postfix should handle it gracefully and not complain since it is RFC
> compliant.
>
>

there are many thousands of RFCs. postfix complies with smtp related RFCs.
>
>>> For example, looking up host.suba.example.com you might get:
>>>
>>> suba.example.com has DNAME record subb.example.com
>>>
>>> Then you need to look up host.subb.example.com, which will return a
>>>
>> result.
>>
>> what problem are you trying to solve? please show a real IP instead of
>> theoritical stuff like example.com.
>>
>>
>
> I didn't think specifics would be necessary. Isn't it customary to change
> the names to protect the innocent/guilty?
>

there is no reason to protect a remote IP (one that is not your or
related to your organization). providing the IP gives no information to
a wanna be attacker. all IPs are known.
> Anyhow, I don't think it will hurt in this case:
>
> # host ip6.208-100-19.vswitch.static.steadfast.net
> vswitch.static.steadfast.net has DNAME record static.steadfast.net.
> ip6.208-100-19.vswitch.static.steadfast.net is an alias for
> ip6.208-100-19.static.steadfast.net.
> ip6.208-100-19.static.steadfast.net has address 208.100.19.6
>
>

I personally wouldn't accept mail from such generic rDNS client more
than once, but that may be just me... ;-p