Copy latest SMTP-with-DANE - draft 11
[exim.git] / doc / doc-txt / draft-ietf-dane-smtp-with-dane.txt
5DANE V. Dukhovni
6Internet-Draft Two Sigma
7Intended status: Standards Track W. Hardaker
8Expires: November 26, 2014 Parsons
9 May 25, 2014
12 SMTP security via opportunistic DANE TLS
13 draft-ietf-dane-smtp-with-dane-10
17 This memo describes a downgrade-resistant protocol for SMTP transport
18 security between Mail Transfer Agents (MTAs) based on the DNS-Based
19 Authentication of Named Entities (DANE) TLSA DNS record. Adoption of
20 this protocol enables an incremental transition of the Internet email
21 backbone to one using encrypted and authenticated Transport Layer
22 Security (TLS).
24Status of This Memo
26 This Internet-Draft is submitted in full conformance with the
27 provisions of BCP 78 and BCP 79.
29 Internet-Drafts are working documents of the Internet Engineering
30 Task Force (IETF). Note that other groups may also distribute
31 working documents as Internet-Drafts. The list of current Internet-
32 Drafts is at
34 Internet-Drafts are draft documents valid for a maximum of six months
35 and may be updated, replaced, or obsoleted by other documents at any
36 time. It is inappropriate to use Internet-Drafts as reference
37 material or to cite them other than as "work in progress."
39 This Internet-Draft will expire on November 26, 2014.
41Copyright Notice
43 Copyright (c) 2014 IETF Trust and the persons identified as the
44 document authors. All rights reserved.
46 This document is subject to BCP 78 and the IETF Trust's Legal
47 Provisions Relating to IETF Documents
48 ( in effect on the date of
49 publication of this document. Please review these documents
50 carefully, as they describe your rights and restrictions with respect
51 to this document. Code Components extracted from this document must
52 include Simplified BSD License text as described in Section 4.e of
56Dukhovni & Hardaker Expires November 26, 2014 [Page 1]
58Internet-Draft SMTP security via opportunistic DANE TLS May 2014
61 the Trust Legal Provisions and are provided without warranty as
62 described in the Simplified BSD License.
64Table of Contents
66 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
67 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
68 1.2. Background . . . . . . . . . . . . . . . . . . . . . . . 5
69 1.3. SMTP channel security . . . . . . . . . . . . . . . . . . 6
70 1.3.1. STARTTLS downgrade attack . . . . . . . . . . . . . . 6
71 1.3.2. Insecure server name without DNSSEC . . . . . . . . . 7
72 1.3.3. Sender policy does not scale . . . . . . . . . . . . 7
73 1.3.4. Too many certification authorities . . . . . . . . . 8
74 2. Identifying applicable TLSA records . . . . . . . . . . . . . 8
75 2.1. DNS considerations . . . . . . . . . . . . . . . . . . . 8
76 2.1.1. DNS errors, bogus and indeterminate responses . . . . 8
77 2.1.2. DNS error handling . . . . . . . . . . . . . . . . . 11
78 2.1.3. Stub resolver considerations . . . . . . . . . . . . 11
79 2.2. TLS discovery . . . . . . . . . . . . . . . . . . . . . . 12
80 2.2.1. MX resolution . . . . . . . . . . . . . . . . . . . . 13
81 2.2.2. Non-MX destinations . . . . . . . . . . . . . . . . . 15
82 2.2.3. TLSA record lookup . . . . . . . . . . . . . . . . . 17
83 3. DANE authentication . . . . . . . . . . . . . . . . . . . . . 19
84 3.1. TLSA certificate usages . . . . . . . . . . . . . . . . . 19
85 3.1.1. Certificate usage DANE-EE(3) . . . . . . . . . . . . 20
86 3.1.2. Certificate usage DANE-TA(2) . . . . . . . . . . . . 21
87 3.1.3. Certificate usages PKIX-TA(0) and PKIX-EE(1) . . . . 22
88 3.2. Certificate matching . . . . . . . . . . . . . . . . . . 23
89 3.2.1. DANE-EE(3) name checks . . . . . . . . . . . . . . . 23
90 3.2.2. DANE-TA(2) name checks . . . . . . . . . . . . . . . 23
91 3.2.3. Reference identifier matching . . . . . . . . . . . . 24
92 4. Server key management . . . . . . . . . . . . . . . . . . . . 25
93 5. Digest algorithm agility . . . . . . . . . . . . . . . . . . 26
94 6. Mandatory TLS Security . . . . . . . . . . . . . . . . . . . 27
95 7. Note on DANE for Message User Agents . . . . . . . . . . . . 28
96 8. Interoperability considerations . . . . . . . . . . . . . . . 29
97 8.1. SNI support . . . . . . . . . . . . . . . . . . . . . . . 29
98 8.2. Anonymous TLS cipher suites . . . . . . . . . . . . . . . 29
99 9. Operational Considerations . . . . . . . . . . . . . . . . . 30
100 9.1. Client Operational Considerations . . . . . . . . . . . . 30
101 9.2. Publisher Operational Considerations . . . . . . . . . . 30
102 10. Security Considerations . . . . . . . . . . . . . . . . . . . 31
103 11. IANA considerations . . . . . . . . . . . . . . . . . . . . . 31
104 12. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 31
105 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 32
106 13.1. Normative References . . . . . . . . . . . . . . . . . . 32
107 13.2. Informative References . . . . . . . . . . . . . . . . . 33
108 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 33
112Dukhovni & Hardaker Expires November 26, 2014 [Page 2]
114Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1171. Introduction
119 This memo specifies a new connection security model for Message
120 Transfer Agents (MTAs). This model is motivated by key features of
121 inter-domain SMTP delivery, in particular the fact that the
122 destination server is selected indirectly via DNS Mail Exchange (MX)
123 records and that neither email addresses nor MX hostnames signal a
124 requirement for either secure or cleartext transport. Therefore,
125 aside from a few manually configured exceptions, SMTP transport
126 security is of necessity opportunistic.
128 This specification uses the presence of DANE TLSA records to securely
129 signal TLS support and to publish the means by which SMTP clients can
130 successfully authenticate legitimate SMTP servers. This becomes
131 "opportunistic DANE TLS" and is resistant to downgrade and MITM
132 attacks. It enables an incremental transition of the email backbone
133 to authenticated TLS delivery, with increased global protection as
134 adoption increases.
136 With opportunistic DANE TLS, traffic from SMTP clients to domains
137 that publish "usable" DANE TLSA records in accordance with this memo
138 is authenticated and encrypted. Traffic from legacy clients or to
139 domains that do not publish TLSA records will continue to be sent in
140 the same manner as before, via manually configured security, (pre-
141 DANE) opportunistic TLS or just cleartext SMTP.
143 Problems with existing use of TLS in MTA to MTA SMTP that motivate
144 this specification are described in Section 1.3. The specification
145 itself follows in Section 2 and Section 3 which describe respectively
146 how to locate and use DANE TLSA records with SMTP. In Section 6, we
147 discuss application of DANE TLS to destinations for which channel
148 integrity and confidentiality are mandatory. In Section 7 we briefly
149 comment on potential applicability of this specification to Message
150 User Agents.
1521.1. Terminology
154 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
156 "OPTIONAL" in this document are to be interpreted as described in
157 [RFC2119].
159 The following terms or concepts are used through the document:
161 Man-in-the-middle or MITM attack: Active modification of network
162 traffic by an adversary able to thereby compromise the
163 confidentiality or integrity of the data.
168Dukhovni & Hardaker Expires November 26, 2014 [Page 3]
170Internet-Draft SMTP security via opportunistic DANE TLS May 2014
173 secure, bogus, insecure, indeterminate: DNSSEC validation results,
174 as defined in Section 4.3 of [RFC4035].
176 Validating Security-Aware Stub Resolver and Non-Validating
177 Security-Aware Stub Resolver:
178 Capabilities of the stub resolver in use as defined in [RFC4033];
179 note that this specification requires the use of a Security-Aware
180 Stub Resolver; Security-Oblivious stub-resolvers MUST NOT be used.
182 opportunistic DANE TLS: Best-effort use of TLS, resistant to
183 downgrade attacks for destinations with DNSSEC-validated TLSA
184 records. When opportunistic DANE TLS is determined to be
185 unavailable, clients should fall back to opportunistic TLS below.
186 Opportunistic DANE TLS requires support for DNSSEC, DANE and
187 STARTTLS on the client side and STARTTLS plus a DNSSEC published
188 TLSA record on the server side.
190 (pre-DANE) opportunistic TLS: Best-effort use of TLS that is
191 generally vulnerable to DNS forgery and STARTTLS downgrade
192 attacks. When a TLS-encrypted communication channel is not
193 available, message transmission takes place in the clear. MX
194 record indirection generally precludes authentication even when
195 TLS is available.
197 reference identifier: (Special case of [RFC6125] definition). One
198 of the domain names associated by the SMTP client with the
199 destination SMTP server for performing name checks on the server
200 certificate. When name checks are applicable, at least one of the
201 reference identifiers MUST match an [RFC6125] DNS-ID (or if none
202 are present the [RFC6125] CN-ID) of the server certificate (see
203 Section 3.2.3).
205 MX hostname: The RRDATA of an MX record consists of a 16 bit
206 preference followed by a Mail Exchange domain name (see [RFC1035],
207 Section 3.3.9). We will use the term "MX hostname" to refer to
208 the latter, that is, the DNS domain name found after the
209 preference value in an MX record. Thus an "MX hostname" is
210 specifically a reference to a DNS domain name, rather than any
211 host that bears that name.
213 delayed delivery: Email delivery is a multi-hop store & forward
214 process. When an MTA is unable forward a message that may become
215 deliverable later, the message is queued and delivery is retried
216 periodically. Some MTAs may be configured with a fallback next-
217 hop destination that handles messages that the MTA would otherwise
218 queue and retry. In these cases, messages that would otherwise
219 have to be delayed, may be sent to the fallback next-hop
220 destination instead. The fallback destination may itself be
224Dukhovni & Hardaker Expires November 26, 2014 [Page 4]
226Internet-Draft SMTP security via opportunistic DANE TLS May 2014
229 subject to opportunistic or mandatory DANE TLS as though it were
230 the original message destination.
232 original next hop destination: The logical destination for mail
233 delivery. By default this is the domain portion of the recipient
234 address, but MTAs may be configured to forward mail for some or
235 all recipients via designated relays. The original next hop
236 destination is, respectively, either the recipient domain or the
237 associated configured relay.
239 MTA: Message Transfer Agent ([RFC5598], Section 4.3.2).
241 MSA: Message Submission Agent ([RFC5598], Section 4.3.1).
243 MUA: Message User Agent ([RFC5598], Section 4.2.1).
245 RR: A DNS Resource Record
247 RRset: A set of DNS Resource Records for a particular class, domain
248 and record type.
2501.2. Background
252 The Domain Name System Security Extensions (DNSSEC) add data origin
253 authentication, data integrity and data non-existence proofs to the
254 Domain Name System (DNS). DNSSEC is defined in [RFC4033], [RFC4034]
255 and [RFC4035].
257 As described in the introduction of [RFC6698], TLS authentication via
258 the existing public Certification Authority (CA) PKI suffers from an
259 over-abundance of trusted parties capable of issuing certificates for
260 any domain of their choice. DANE leverages the DNSSEC infrastructure
261 to publish trusted public keys and certificates for use with the
262 Transport Layer Security (TLS) [RFC5246] protocol via a new "TLSA"
263 DNS record type. With DNSSEC each domain can only vouch for the keys
264 of its directly delegated sub-domains.
266 The TLS protocol enables secure TCP communication. In the context of
267 this memo, channel security is assumed to be provided by TLS. Used
268 without authentication, TLS provides only privacy protection against
269 eavesdropping attacks. With authentication, TLS also provides data
270 integrity protection to guard against MITM attacks.
280Dukhovni & Hardaker Expires November 26, 2014 [Page 5]
282Internet-Draft SMTP security via opportunistic DANE TLS May 2014
2851.3. SMTP channel security
287 With HTTPS, Transport Layer Security (TLS) employs X.509 certificates
288 [RFC5280] issued by one of the many Certificate Authorities (CAs)
289 bundled with popular web browsers to allow users to authenticate
290 their "secure" websites. Before we specify a new DANE TLS security
291 model for SMTP, we will explain why a new security model is needed.
292 In the process, we will explain why the familiar HTTPS security model
293 is inadequate to protect inter-domain SMTP traffic.
295 The subsections below outline four key problems with applying
296 traditional PKI to SMTP that are addressed by this specification.
297 Since SMTP channel security policy is not explicitly specified in
298 either the recipient address or the MX record, a new signaling
299 mechanism is required to indicate when channel security is possible
300 and should be used. The publication of TLSA records allows server
301 operators to securely signal to SMTP clients that TLS is available
302 and should be used. DANE TLSA makes it possible to simultaneously
303 discover which destination domains support secure delivery via TLS
304 and how to verify the authenticity of the associated SMTP services,
305 providing a path forward to ubiquitous SMTP channel security.
3071.3.1. STARTTLS downgrade attack
309 The Simple Mail Transfer Protocol (SMTP) [RFC5321] is a single-hop
310 protocol in a multi-hop store & forward email delivery process. SMTP
311 envelope recipient addresses are not transport addresses and are
312 security-agnostic. Unlike the Hypertext Transfer Protocol (HTTP) and
313 its corresponding secured version, HTTPS, where the use of TLS is
314 signaled via the URI scheme, email recipient addresses do not
315 directly signal transport security policy. Indeed, no such signaling
316 could work well with SMTP since TLS encryption of SMTP protects email
317 traffic on a hop-by-hop basis while email addresses could only
318 express end-to-end policy.
320 With no mechanism available to signal transport security policy, SMTP
321 relays employ a best-effort "opportunistic" security model for TLS.
322 A single SMTP server TCP listening endpoint can serve both TLS and
323 non-TLS clients; the use of TLS is negotiated via the SMTP STARTTLS
324 command ([RFC3207]). The server signals TLS support to the client
325 over a cleartext SMTP connection, and, if the client also supports
326 TLS, it may negotiate a TLS encrypted channel to use for email
327 transmission. The server's indication of TLS support can be easily
328 suppressed by an MITM attacker. Thus pre-DANE SMTP TLS security can
329 be subverted by simply downgrading a connection to cleartext. No TLS
330 security feature, such as the use of PKIX, can prevent this. The
331 attacker can simply disable TLS.
336Dukhovni & Hardaker Expires November 26, 2014 [Page 6]
338Internet-Draft SMTP security via opportunistic DANE TLS May 2014
3411.3.2. Insecure server name without DNSSEC
343 With SMTP, DNS Mail Exchange (MX) records abstract the next-hop
344 transport endpoint and allow administrators to specify a set of
345 target servers to which SMTP traffic should be directed for a given
346 domain.
348 A PKIX TLS client is vulnerable to MITM attacks unless it verifies
349 that the server's certificate binds the public key to a name that
350 matches one of the client's reference identifiers. A natural choice
351 of reference identifier is the server's domain name. However, with
352 SMTP, server names are obtained indirectly via MX records. Without
353 DNSSEC, the MX lookup is vulnerable to MITM and DNS cache poisoning
354 attacks. Active attackers can forge DNS replies with fake MX records
355 and can redirect email to servers with names of their choice.
356 Therefore, secure verification of SMTP TLS certificates matching the
357 server name is not possible without DNSSEC.
359 One might try to harden TLS for SMTP against DNS attacks by using the
360 envelope recipient domain as a reference identifier and requiring
361 each SMTP server to possess a trusted certificate for the envelope
362 recipient domain rather than the MX hostname. Unfortunately, this is
363 impractical as email for many domains is handled by third parties
364 that are not in a position to obtain certificates for all the domains
365 they serve. Deployment of the Server Name Indication (SNI) extension
366 to TLS (see [RFC6066] Section 3) is no panacea, since SNI key
367 management is operationally challenging except when the email service
368 provider is also the domain's registrar and its certificate issuer;
369 this is rarely the case for email.
371 Since the recipient domain name cannot be used as the SMTP server
372 reference identifier, and neither can the MX hostname without DNSSEC,
373 large-scale deployment of authenticated TLS for SMTP requires that
374 the DNS be secure.
376 Since SMTP security depends critically on DNSSEC, it is important to
377 point out that consequently SMTP with DANE is the most conservative
378 possible trust model. It trusts only what must be trusted and no
379 more. Adding any other trusted actors to the mix can only reduce
380 SMTP security. A sender may choose to further harden DNSSEC for
381 selected high-value receiving domains, by configuring explicit trust
382 anchors for those domains instead of relying on the chain of trust
383 from the root domain. Detailed discussion of DNSSEC security
384 practices is out of scope for this document.
3861.3.3. Sender policy does not scale
392Dukhovni & Hardaker Expires November 26, 2014 [Page 7]
394Internet-Draft SMTP security via opportunistic DANE TLS May 2014
397 Sending systems are in some cases explicitly configured to use TLS
398 for mail sent to selected peer domains. This requires sending MTAs
399 to be configured with appropriate subject names or certificate
400 content digests to expect in the presented server certificates.
401 Because of the heavy administrative burden, such statically
402 configured SMTP secure channels are used rarely (generally only
403 between domains that make bilateral arrangements with their business
404 partners). Internet email, on the other hand, requires regularly
405 contacting new domains for which security configurations cannot be
406 established in advance.
408 The abstraction of the SMTP transport endpoint via DNS MX records,
409 often across organization boundaries, limits the use of public CA PKI
410 with SMTP to a small set of sender-configured peer domains. With
411 little opportunity to use TLS authentication, sending MTAs are rarely
412 configured with a comprehensive list of trusted CAs. SMTP services
413 that support STARTTLS often deploy X.509 certificates that are self-
414 signed or issued by a private CA.
4161.3.4. Too many certification authorities
418 Even if it were generally possible to determine a secure server name,
419 the SMTP client would still need to verify that the server's
420 certificate chain is issued by a trusted Certification Authority (a
421 trust anchor). MTAs are not interactive applications where a human
422 operator can make a decision (wisely or otherwise) to selectively
423 disable TLS security policy when certificate chain verification
424 fails. With no user to "click OK", the MTAs list of public CA trust
425 anchors would need to be comprehensive in order to avoid bouncing
426 mail addressed to sites that employ unknown Certification
427 Authorities.
429 On the other hand, each trusted CA can issue certificates for any
430 domain. If even one of the configured CAs is compromised or operated
431 by an adversary, it can subvert TLS security for all destinations.
432 Any set of CAs is simultaneously both overly inclusive and not
433 inclusive enough.
4352. Identifying applicable TLSA records
4372.1. DNS considerations
4392.1.1. DNS errors, bogus and indeterminate responses
448Dukhovni & Hardaker Expires November 26, 2014 [Page 8]
450Internet-Draft SMTP security via opportunistic DANE TLS May 2014
453 An SMTP client that implements opportunistic DANE TLS per this
454 specification depends critically on the integrity of DNSSEC lookups,
455 as discussed in Section 1.3. This section lists the DNS resolver
456 requirements needed to avoid downgrade attacks when using
457 opportunistic DANE TLS.
459 A DNS lookup may signal an error or return a definitive answer. A
460 security-aware resolver must be used for this specification.
461 Security-aware resolvers will indicate the security status of a DNS
462 RRset with one of four possible values defined in Section 4.3 of
463 [RFC4035]: "secure", "insecure", "bogus" and "indeterminate". In
464 [RFC4035] the meaning of the "indeterminate" security status is:
466 An RRset for which the resolver is not able to determine whether
467 the RRset should be signed, as the resolver is not able to obtain
468 the necessary DNSSEC RRs. This can occur when the security-aware
469 resolver is not able to contact security-aware name servers for
470 the relevant zones.
472 Note, the "indeterminate" security status has a conflicting
473 definition in section 5 of [RFC4033].
475 There is no trust anchor that would indicate that a specific
476 portion of the tree is secure.
478 SMTP clients following this specification SHOULD NOT distinguish
479 between "insecure" and "indeterminate" in the [RFC4033] sense. Both
480 "insecure" and RFC4033 "indeterminate" are handled identically: in
481 either case unvalidated data for the query domain is all that is and
482 can be available, and authentication using the data is impossible.
483 In what follows, when we say "insecure", we include also DNS results
484 for domains that lie in a portion of the DNS tree for which there is
485 no applicable trust anchor. With the DNS root zone signed, we expect
486 that validating resolvers used by Internet-facing MTAs will be
487 configured with trust anchor data for the root zone. Therefore,
488 RFC4033-style "indeterminate" domains should be rare in practice.
489 From here on, when we say "indeterminate", it is exclusively in the
490 sense of [RFC4035].
492 As noted in section 4.3 of [RFC4035], a security-aware DNS resolver
493 MUST be able to determine whether a given non-error DNS response is
494 "secure", "insecure", "bogus" or "indeterminate". It is expected
495 that most security-aware stub resolvers will not signal an
496 "indeterminate" security status in the RFC4035-sense to the
497 application, and will signal a "bogus" or error result instead. If a
498 resolver does signal an RFC4035 "indeterminate" security status, this
499 MUST be treated by the SMTP client as though a "bogus" or error
500 result had been returned.
504Dukhovni & Hardaker Expires November 26, 2014 [Page 9]
506Internet-Draft SMTP security via opportunistic DANE TLS May 2014
509 An MTA making use of a non-validating security-aware stub resolver
510 MAY use the stub resolver's ability, if available, to signal DNSSEC
511 validation status based on information the stub resolver has learned
512 from an upstream validating recursive resolver. In accordance with
513 section 4.9.3 of [RFC4035]:
515 ... a security-aware stub resolver MUST NOT place any reliance on
516 signature validation allegedly performed on its behalf, except
517 when the security-aware stub resolver obtained the data in question
518 from a trusted security-aware recursive name server via a secure
519 channel.
521 To avoid much repetition in the text below, we will pause to explain
522 the handling of "bogus" or "indeterminate" DNSSEC query responses.
523 These are not necessarily the result of a malicious actor; they can,
524 for example, occur when network packets are corrupted or lost in
525 transit. Therefore, "bogus" or "indeterminate" replies are equated
526 in this memo with lookup failure.
528 There is an important non-failure condition we need to highlight in
529 addition to the obvious case of the DNS client obtaining a non-empty
530 "secure" or "insecure" RRset of the requested type. Namely, it is
531 not an error when either "secure" or "insecure" non-existence is
532 determined for the requested data. When a DNSSEC response with a
533 validation status that is either "secure" or "insecure" reports
534 either no records of the requested type or non-existence of the query
535 domain, the response is not a DNS error condition. The DNS client
536 has not been left without an answer; it has learned that records of
537 the requested type do not exist.
539 Security-aware stub resolvers will, of course, also signal DNS lookup
540 errors in other cases, for example when processing a "ServFail"
541 RCODE, which will not have an associated DNSSEC status. All lookup
542 errors are treated the same way by this specification, regardless of
543 whether they are from a "bogus" or "indeterminate" DNSSEC status or
544 from a more generic DNS error: the information that was requested
545 cannot be obtained by the security-aware resolver at this time. A
546 lookup error is thus a failure to obtain the relevant RRset if it
547 exists, or to determine that no such RRset exists when it does not.
549 In contrast to a "bogus" or an "indeterminate" response, an
550 "insecure" DNSSEC response is not an error, rather it indicates that
551 the target DNS zone is either securely opted out of DNSSEC validation
552 or is not connected with the DNSSEC trust anchors being used.
553 Insecure results will leave the SMTP client with degraded channel
554 security, but do not stand in the way of message delivery. See
555 section Section 2.2 for further details.
560Dukhovni & Hardaker Expires November 26, 2014 [Page 10]
562Internet-Draft SMTP security via opportunistic DANE TLS May 2014
5652.1.2. DNS error handling
567 When a DNS lookup failure (error or "bogus" or "indeterminate" as
568 defined above) prevents an SMTP client from determining which SMTP
569 server or servers it should connect to, message delivery MUST be
570 delayed. This naturally includes, for example, the case when a
571 "bogus" or "indeterminate" response is encountered during MX
572 resolution. When multiple MX hostnames are obtained from a
573 successful MX lookup, but a later DNS lookup failure prevents network
574 address resolution for a given MX hostname, delivery may proceed via
575 any remaining MX hosts.
577 When a particular SMTP server is securely identified as the delivery
578 destination, a set of DNS lookups (Section 2.2) MUST be performed to
579 locate any related TLSA records. If any DNS queries used to locate
580 TLSA records fail (be it due to "bogus" or "indeterminate" records,
581 timeouts, malformed replies, ServFails, etc.), then the SMTP client
582 MUST treat that server as unreachable and MUST NOT deliver the
583 message via that server. If no servers are reachable, delivery is
584 delayed.
586 In what follows, we will only describe what happens when all relevant
587 DNS queries succeed. If any DNS failure occurs, the SMTP client MUST
588 behave as described in this section, by skipping the problem SMTP
589 server, or the problem destination. Queries for candidate TLSA
590 records are explicitly part of "all relevant DNS queries" and SMTP
591 clients MUST NOT continue to connect to an SMTP server or destination
592 whose TLSA record lookup fails.
5942.1.3. Stub resolver considerations
596 A note about DNAME aliases: a query for a domain name whose ancestor
597 domain is a DNAME alias returns the DNAME RR for the ancestor domain,
598 along with a CNAME that maps the query domain to the corresponding
599 sub-domain of the target domain of the DNAME alias [RFC6672].
600 Therefore, whenever we speak of CNAME aliases, we implicitly allow
601 for the possibility that the alias in question is the result of an
602 ancestor domain DNAME record. Consequently, no explicit support for
603 DNAME records is needed in SMTP software, it is sufficient to process
604 the resulting CNAME aliases. DNAME records only require special
605 processing in the validating stub-resolver library that checks the
606 integrity of the combined DNAME + CNAME reply. When DNSSEC
607 validation is handled by a local caching resolver, rather than the
608 MTA itself, even that part of the DNAME support logic is outside the
609 MTA.
611 When a stub resolver returns a response containing a CNAME alias that
612 does not also contain the corresponding query results for the target
616Dukhovni & Hardaker Expires November 26, 2014 [Page 11]
618Internet-Draft SMTP security via opportunistic DANE TLS May 2014
621 of the alias, the SMTP client will need to repeat the query at the
622 target of the alias, and should do so recursively up to some
623 configured or implementation-dependent recursion limit. If at any
624 stage of CNAME expansion an error is detected, the lookup of the
625 original requested records MUST be considered to have failed.
627 Whether a chain of CNAME records was returned in a single stub
628 resolver response or via explicit recursion by the SMTP client, if at
629 any stage of recursive expansion an "insecure" CNAME record is
630 encountered, then it and all subsequent results (in particular, the
631 final result) MUST be considered "insecure" regardless of whether any
632 earlier CNAME records leading to the "insecure" record were "secure".
634 Note, a security-aware non-validating stub resolver may return to the
635 SMTP client an "insecure" reply received from a validating recursive
636 resolver that contains a CNAME record along with additional answers
637 recursively obtained starting at the target of the CNAME. In this
638 all that one can say is that some record in the set of records
639 returned is "insecure", but it is possible that the initial CNAME
640 record and a subset of the subsequent records are "secure".
642 If the SMTP client needs to determine the security status of the DNS
643 zone containing the initial CNAME record, it may need to issue an a
644 separate query of type "CNAME" that returns only the initial CNAME
645 record. In particular in Section 2.2.2 when insecure A or AAAA
646 records are found for an SMTP server via a CNAME alias, it may be
647 necessary to perform an additional CNAME query to determine whether
648 the DNS zone in which the alias is published is signed.
6502.2. TLS discovery
652 As noted previously (in Section 1.3.1), opportunistic TLS with SMTP
653 servers that advertise TLS support via STARTTLS is subject to an MITM
654 downgrade attack. Also some SMTP servers that are not, in fact, TLS
655 capable erroneously advertise STARTTLS by default and clients need to
656 be prepared to retry cleartext delivery after STARTTLS fails. In
657 contrast, DNSSEC validated TLSA records MUST NOT be published for
658 servers that do not support TLS. Clients can safely interpret their
659 presence as a commitment by the server operator to implement TLS and
662 This memo defines four actions to be taken after the search for a
663 TLSA record returns secure usable results, secure unusable results,
664 insecure or no results or an error signal. The term "usable" in this
665 context is in the sense of Section 4.1 of [RFC6698]. Specifically,
666 if the DNS lookup for a TLSA record returns:
672Dukhovni & Hardaker Expires November 26, 2014 [Page 12]
674Internet-Draft SMTP security via opportunistic DANE TLS May 2014
677 A secure TLSA RRset with at least one usable record: A connection to
678 the MTA MUST be made using authenticated and encrypted TLS, using
679 the techniques discussed in the rest of this document. Failure to
680 establish an authenticated TLS connection MUST result in falling
681 back to the next SMTP server or delayed delivery.
683 A Secure non-empty TLSA RRset where all the records are unusable: A
684 connection to the MTA MUST be made via TLS, but authentication is
685 not required. Failure to establish an encrypted TLS connection
686 MUST result in falling back to the next SMTP server or delayed
687 delivery.
689 An insecure TLSA RRset or DNSSEC validated proof-of-non-existent TLSA
690 records:
691 A connection to the MTA SHOULD be made using (pre-DANE)
692 opportunistic TLS, this includes using cleartext delivery when the
693 remote SMTP server does not appear to support TLS. The MTA MAY
694 retry in cleartext when delivery via TLS fails either during the
695 handshake or even during data transfer.
697 Any lookup error: Lookup errors, including "bogus" and
698 "indeterminate", as explained in Section 2.1.1 MUST result in
699 falling back to the next SMTP server or delayed delivery.
701 An SMTP client MAY be configured to require DANE verified delivery
702 for some destinations. We will call such a configuration "mandatory
703 DANE TLS". With mandatory DANE TLS, delivery proceeds only when
704 "secure" TLSA records are used to establish an encrypted and
705 authenticated TLS channel with the SMTP server.
707 When the original next-hop destination is an address literal, rather
708 than a DNS domain, DANE TLS does not apply. Delivery proceeds using
709 any relevant security policy configured by the MTA administrator.
710 Similarly, when an MX RRset incorrectly lists a network address in
711 lieu of an MX hostname, if the MTA chooses to connect to the network
712 address DANE TLSA does not apply for such a connection.
714 In the subsections that follow we explain how to locate the SMTP
715 servers and the associated TLSA records for a given next-hop
716 destination domain. We also explain which name or names are to be
717 used in identity checks of the SMTP server certificate.
7192.2.1. MX resolution
721 In this section we consider next-hop domains that are subject to MX
722 resolution and have MX records. The TLSA records and the associated
723 base domain are derived separately for each MX hostname that is used
724 to attempt message delivery. DANE TLS can authenticate message
728Dukhovni & Hardaker Expires November 26, 2014 [Page 13]
730Internet-Draft SMTP security via opportunistic DANE TLS May 2014
733 delivery to the intended next-hop domain only when the MX records are
734 obtained securely via a DNSSEC validated lookup.
736 MX records MUST be sorted by preference; an MX hostname with a worse
737 (numerically higher) MX preference that has TLSA records MUST NOT
738 preempt an MX hostname with a better (numerically lower) preference
739 that has no TLSA records. In other words, prevention of delivery
740 loops by obeying MX preferences MUST take precedence over channel
741 security considerations. Even with two equal-preference MX records,
742 an MTA is not obligated to choose the MX hostname that offers more
743 security. Domains that want secure inbound mail delivery need to
744 ensure that all their SMTP servers and MX records are configured
745 accordingly.
747 In the language of [RFC5321] Section 5.1, the original next-hop
748 domain is the "initial name". If the MX lookup of the initial name
749 results in a CNAME alias, the MTA replaces the initial name with the
750 resulting name and performs a new lookup with the new name. MTAs
751 typically support recursion in CNAME expansion, so this replacement
752 is performed repeatedly until the ultimate non-CNAME domain is found.
754 If the MX RRset (or any CNAME leading to it) is "insecure" (see
755 Section 2.1.1), DANE TLS need not apply, and delivery MAY proceed via
756 pre-DANE opportunistic TLS. That said, the protocol in this memo is
757 an "opportunistic security" protocol, meaning that it strives to
758 communicate with each peer as securely as possible, while maintaining
759 broad interoperability. Therefore, the SMTP client MAY proceed to
760 use DANE TLS (as described in Section 2.2.2 below) even with MX hosts
761 obtained via an "insecure" MX RRset. For example, when a hosting
762 provider has a signed DNS zone and publishes TLSA records for its
763 SMTP servers, hosted domains that are not signed may still benefit
764 from the provider's TLSA records. Deliveries via the provider's SMTP
765 servers will not be subject to active attacks when sending SMTP
766 clients elect to make use of the provider's TLSA records.
768 When the MX records are not (DNSSEC) signed, an active attacker can
769 redirect SMTP clients to MX hosts of his choice. Such redirection is
770 tamper-evident when SMTP servers found via "insecure" MX records are
771 recorded as the next-hop relay in the MTA delivery logs in their
772 original (rather than CNAME expanded) form. Sending MTAs SHOULD log
773 unexpanded MX hostnames when these result from insecure MX lookups.
774 Any successful authentication via an insecurely determined MX host
775 MUST NOT be misrepresented in the mail logs as secure delivery to the
776 intended next-hop domain. When DANE TLS is mandatory (Section 6) for
777 a given destination, delivery MUST be delayed when the MX RRset is
778 not "secure".
784Dukhovni & Hardaker Expires November 26, 2014 [Page 14]
786Internet-Draft SMTP security via opportunistic DANE TLS May 2014
789 Otherwise, assuming no DNS errors (Section 2.1.1), the MX RRset is
790 "secure", and the SMTP client MUST treat each MX hostname as a
791 separate non-MX destination for opportunistic DANE TLS as described
792 in Section 2.2.2. When, for a given MX hostname, no TLSA records are
793 found, or only "insecure" TLSA records are found, DANE TLSA is not
794 applicable with the SMTP server in question and delivery proceeds to
795 that host as with pre-DANE opportunistic TLS. To avoid downgrade
796 attacks, any errors during TLSA lookups MUST, as explained in
797 Section 2.1.1, cause the SMTP server in question to be treated as
798 unreachable.
8002.2.2. Non-MX destinations
802 This section describes the algorithm used to locate the TLSA records
803 and associated TLSA base domain for an input domain not subject to MX
804 resolution. Such domains include:
806 o Each MX hostname used in a message delivery attempt for an
807 original next-hop destination domain subject to MX resolution.
808 Note, MTAs are not obligated to support CNAME expansion of MX
809 hostnames.
811 o Any administrator configured relay hostname, not subject to MX
812 resolution. This frequently involves configuration set by the MTA
813 administrator to handle some or all mail.
815 o A next-hop destination domain subject to MX resolution that has no
816 MX records. In this case the domain's name is implicitly also its
817 sole SMTP server name.
819 Note that DNS queries with type TLSA are mishandled by load balancing
820 nameservers that serve the MX hostnames of some large email
821 providers. The DNS zones served by these nameservers are not signed
822 and contain no TLSA records, but queries for TLSA records fail,
823 rather than returning the non-existence of the requested TLSA
824 records.
826 To avoid problems delivering mail to domains whose SMTP servers are
827 served by the problem nameservers the SMTP client MUST perform any A
828 and/or AAAA queries for the destination before attempting to locate
829 the associated TLSA records. This lookup is needed in any case to
830 determine whether the destination domain is reachable and the DNSSEC
831 validation status of the chain of CNAME queries required to reach the
832 ultimate address records.
834 If no address records are found, the destination is unreachable. If
835 address records are found, but the DNSSEC validation status of the
836 first query response is "insecure" (see Section 2.1.3), the SMTP
840Dukhovni & Hardaker Expires November 26, 2014 [Page 15]
842Internet-Draft SMTP security via opportunistic DANE TLS May 2014
845 client SHOULD NOT proceed to search for any associated TLSA records.
846 With the problem domains, TLSA queries will lead to DNS lookup errors
847 and cause messages to be consistently delayed and ultimately returned
848 to the sender. We don't expect to find any "secure" TLSA records
849 associated with a TLSA base domain that lies in an unsigned DNS zone.
850 Therefore, skipping TLSA lookups in this case will also reduce
851 latency with no detrimental impact on security.
853 If the A and/or AAAA lookup of the "initial name" yields a CNAME, we
854 replace it with the resulting name as if it were the initial name and
855 perform a lookup again using the new name. This replacement is
856 performed recursively.
858 We consider the following cases for handling a DNS response for an A
859 or AAAA DNS lookup:
861 Not found: When the DNS queries for A and/or AAAA records yield
862 neither a list of addresses nor a CNAME (or CNAME expansion is not
863 supported) the destination is unreachable.
865 Non-CNAME: The answer is not a CNAME alias. If the address RRset
866 is "secure", TLSA lookups are performed as described in
867 Section 2.2.3 with the initial name as the candidate TLSA base
868 domain. If no "secure" TLSA records are found, DANE TLS is not
869 applicable and mail delivery proceeds with pre-DANE opportunistic
870 TLS (which, being best-effort, degrades to cleartext delivery when
871 STARTTLS is not available or the TLS handshake fails).
873 Insecure CNAME: The input domain is a CNAME alias, but the ultimate
874 network address RRset is "insecure" (see Section 2.1.1). If the
875 initial CNAME response is also "insecure", DANE TLS does not
876 apply. Otherwise, this case is treated just like the non-CNAME
877 case above, where a search is performed for a TLSA record with the
878 original input domain as the candidate TLSA base domain.
880 Secure CNAME: The input domain is a CNAME alias, and the ultimate
881 network address RRset is "secure" (see Section 2.1.1). Two
882 candidate TLSA base domains are tried: the fully CNAME-expanded
883 initial name and, failing that, then the initial name itself.
896Dukhovni & Hardaker Expires November 26, 2014 [Page 16]
898Internet-Draft SMTP security via opportunistic DANE TLS May 2014
901 In summary, if it is possible to securely obtain the full, CNAME-
902 expanded, DNSSEC-validated address records for the input domain, then
903 that name is the preferred TLSA base domain. Otherwise, the
904 unexpanded input-MX domain is the candidate TLSA base domain. When
905 no "secure" TLSA records are found at either the CNAME-expanded or
906 unexpanded domain, then DANE TLS does not apply for mail delivery via
907 the input domain in question. And, as always, errors, bogus or
908 indeterminate results for any query in the process MUST result in
909 delaying or abandoning delivery.
9112.2.3. TLSA record lookup
913 Each candidate TLSA base domain (the original or fully CNAME-expanded
914 name of a non-MX destination or a particular MX hostname of an MX
915 destination) is in turn prefixed with service labels of the form
916 "_<port>._tcp". The resulting domain name is used to issue a DNSSEC
917 query with the query type set to TLSA ([RFC6698] Section 7.1).
919 For SMTP, the destination TCP port is typically 25, but this may be
920 different with custom routes specified by the MTA administrator in
921 which case the SMTP client MUST use the appropriate number in the
922 "_<port>" prefix in place of "_25". If, for example, the candidate
923 base domain is "", and the SMTP connection is to port
924 25, the TLSA RRset is obtained via a DNSSEC query of the form:
926 IN TLSA ?
928 The query response may be a CNAME, or the actual TLSA RRset. If the
929 response is a CNAME, the SMTP client (through the use of its
930 security-aware stub resolver) restarts the TLSA query at the target
931 domain, following CNAMEs as appropriate and keeping track of whether
932 the entire chain is "secure". If any "insecure" records are
933 encountered, or the TLSA records don't exist, the next candidate TLSA
934 base is tried instead.
936 If the ultimate response is a "secure" TLSA RRset, then the candidate
937 TLSA base domain will be the actual TLSA base domain and the TLSA
938 RRset will constitute the TLSA records for the destination. If none
939 of the candidate TLSA base domains yield "secure" TLSA records then
940 delivery MAY proceed via pre-DANE opportunistic TLS. SMTP clients
941 MAY elect to use "insecure" TLSA records to avoid STARTTLS downgrades
942 or even to skip SMTP servers that fail authentication, but MUST NOT
943 misrepresent authentication success as either a secure connection to
944 the SMTP server or as a secure delivery to the intended next-hop
945 domain.
947 TLSA record publishers may leverage CNAMEs to reference a single
948 authoritative TLSA RRset specifying a common Certification Authority
952Dukhovni & Hardaker Expires November 26, 2014 [Page 17]
954Internet-Draft SMTP security via opportunistic DANE TLS May 2014
957 or a common end entity certificate to be used with multiple TLS
958 services. Such CNAME expansion does not change the SMTP client's
959 notion of the TLSA base domain; thus, when is
960 a CNAME, the base domain remains and this is still the
961 reference identifier used together with the next-hop domain in peer
962 certificate name checks.
964 Note, shared end entity certificate associations expose the
965 publishing domain to substitution attacks, where an MITM attacker can
966 reroute traffic to a different server that shares the same end entity
967 certificate. Such shared end entity records SHOULD be avoided unless
968 the servers in question are functionally equivalent (an active
969 attacker gains nothing by diverting client traffic from one such
970 server to another).
972 For example, given the DNSSEC validated records below:
974 IN MX 0
975 IN MX 0
978 IN TLSA 2 1 1 e3b0c44298fc1c149a...
980 The SMTP servers and will be expected
981 to have certificates issued under a common trust anchor, but each MX
982 hostname's TLSA base domain remains unchanged despite the above CNAME
983 records. Correspondingly, each SMTP server will be associated with a
984 pair of reference identifiers consisting of its hostname plus the
985 next-hop domain "".
987 If, during TLSA resolution (including possible CNAME indirection), at
988 least one "secure" TLSA record is found (even if not usable because
989 it is unsupported by the implementation or support is
990 administratively disabled), then the corresponding host has signaled
991 its commitment to implement TLS. The SMTP client MUST NOT deliver
992 mail via the corresponding host unless a TLS session is negotiated
993 via STARTTLS. This is required to avoid MITM STARTTLS downgrade
994 attacks.
996 As noted previously (in Section Section 2.2.2), when no "secure" TLSA
997 records are found at the fully CNAME-expanded name, the original
998 unexpanded name MUST be tried instead. This supports customers of
999 hosting providers where the provider's zone cannot be validated with
1000 DNSSEC, but the customer has shared appropriate key material with the
1001 hosting provider to enable TLS via SNI. Intermediate names that
1002 arise during CNAME expansion that are neither the original, nor the
1003 final name, are never candidate TLSA base domains, even if "secure".
1008Dukhovni & Hardaker Expires November 26, 2014 [Page 18]
1010Internet-Draft SMTP security via opportunistic DANE TLS May 2014
10133. DANE authentication
1015 This section describes which TLSA records are applicable to SMTP
1016 opportunistic DANE TLS and how to apply such records to authenticate
1017 the SMTP server. With opportunistic DANE TLS, both the TLS support
1018 implied by the presence of DANE TLSA records and the verification
1019 parameters necessary to authenticate the TLS peer are obtained
1020 together. In contrast to protocols where channel security policy is
1021 set exclusively by the client, authentication via this protocol is
1022 expected to be less prone to connection failure caused by
1023 incompatible configuration of the client and server.
10253.1. TLSA certificate usages
1027 The DANE TLSA specification [RFC6698] defines multiple TLSA RR types
1028 via combinations of 3 numeric parameters. The numeric values of
1029 these parameters were later given symbolic names in
1030 [I-D.ietf-dane-registry-acronyms]. The rest of the TLSA record is
1031 the "certificate association data field", which specifies the full or
1032 digest value of a certificate or public key. The parameters are:
1034 The TLSA Certificate Usage field: Section 2.1.1 of [RFC6698]
1035 specifies 4 values: PKIX-TA(0), PKIX-EE(1), DANE-TA(2), and DANE-
1036 EE(3). There is an additional private-use value: PrivCert(255).
1037 All other values are reserved for use by future specifications.
1039 The selector field: Section 2.1.2 of [RFC6698] specifies 2 values:
1040 Cert(0), SPKI(1). There is an additional private-use value:
1041 PrivSel(255). All other values are reserved for use by future
1042 specifications.
1044 The matching type field: Section 2.1.3 of [RFC6698] specifies 3
1045 values: Full(0), SHA2-256(1), SHA2-512(2). There is an additional
1046 private-use value: PrivMatch(255). All other values are reserved
1047 for use by future specifications.
1049 We may think of TLSA Certificate Usage values 0 through 3 as a
1050 combination of two one-bit flags. The low bit chooses between trust
1051 anchor (TA) and end entity (EE) certificates. The high bit chooses
1052 between public PKI issued and domain-issued certificates.
1054 The selector field specifies whether the TLSA RR matches the whole
1055 certificate: Cert(0), or just its subjectPublicKeyInfo: SPKI(1). The
1056 subjectPublicKeyInfo is an ASN.1 DER encoding of the certificate's
1057 algorithm id, any parameters and the public key data.
1059 The matching type field specifies how the TLSA RR Certificate
1060 Association Data field is to be compared with the certificate or
1064Dukhovni & Hardaker Expires November 26, 2014 [Page 19]
1066Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1069 public key. A value of Full(0) means an exact match: the full DER
1070 encoding of the certificate or public key is given in the TLSA RR. A
1071 value of SHA2-256(1) means that the association data matches the
1072 SHA2-256 digest of the certificate or public key, and likewise
1073 SHA2-512(2) means a SHA2-512 digest is used.
1075 Since opportunistic DANE TLS will be used by non-interactive MTAs,
1076 with no user to "press OK" when authentication fails, reliability of
1077 peer authentication is paramount. Server operators are advised to
1078 publish TLSA records that are least likely to fail authentication due
1079 to interoperability or operational problems. Because DANE TLS relies
1080 on coordinated changes to DNS and SMTP server settings, the best
1081 choice of records to publish will depend on site-specific practices.
1083 The certificate usage element of a TLSA record plays a critical role
1084 in determining how the corresponding certificate association data
1085 field is used to authenticate server's certificate chain. The next
1086 two subsections explain the process for certificate usages DANE-EE(3)
1087 and DANE-TA(2). The third subsection briefly explains why
1088 certificate usages PKIX-TA(0) and PKIX-EE(1) are not applicable with
1089 opportunistic DANE TLS.
1091 In summary, we recommend the use of either "DANE-EE(3) SPKI(1)
1092 SHA2-256(1)" or "DANE-TA(2) Cert(0) SHA2-256(1)" TLSA records
1093 depending on site needs. Other combinations of TLSA parameters are
1094 either explicitly unsupported, or offer little to recommend them over
1095 these two.
1097 The mandatory to support digest algorithm in [RFC6698] is
1098 SHA2-256(1). When the server's TLSA RRset includes records with a
1099 matching type indicating a digest record (i.e., a value other than
1100 Full(0)), a TLSA record with a SHA2-256(1) matching type SHOULD be
1101 provided along with any other digest published, since some SMTP
1102 clients may support only SHA2-256(1). If at some point the SHA2-256
1103 digest algorithm is tarnished by new cryptanalytic attacks,
1104 publishers will need to include an appropriate stronger digest in
1105 their TLSA records, initially along with, and ultimately in place of,
1106 SHA2-256.
11083.1.1. Certificate usage DANE-EE(3)
1110 Authentication via certificate usage DANE-EE(3) TLSA records involves
1111 simply checking that the server's leaf certificate matches the TLSA
1112 record. In particular the binding of the server public key to its
1113 name is based entirely on the TLSA record association. The server
1114 MUST be considered authenticated even if none of the names in the
1115 certificate match the client's reference identity for the server.
1120Dukhovni & Hardaker Expires November 26, 2014 [Page 20]
1122Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1125 Similarly, the expiration date of the server certificate MUST be
1126 ignored, the validity period of the TLSA record key binding is
1127 determined by the validity interval of the TLSA record DNSSEC
1128 signature.
1130 With DANE-EE(3) servers need not employ SNI (may ignore the client's
1131 SNI message) even when the server is known under independent names
1132 that would otherwise require separate certificates. It is instead
1133 sufficient for the TLSA RRsets for all the domains in question to
1134 match the server's default certificate. Of course with SMTP servers
1135 it is simpler still to publish the same MX hostname for all the
1136 hosted domains.
1138 For domains where it is practical to make coordinated changes in DNS
1139 TLSA records during SMTP server key rotation, it is often best to
1140 publish end-entity DANE-EE(3) certificate associations. DANE-EE(3)
1141 certificates don't suddenly stop working when leaf or intermediate
1142 certificates expire, and don't fail when the server operator neglects
1143 to configure all the required issuer certificates in the server
1144 certificate chain.
1146 TLSA records published for SMTP servers SHOULD, in most cases, be
1147 "DANE-EE(3) SPKI(1) SHA2-256(1)" records. Since all DANE
1148 implementations are required to support SHA2-256, this record type
1149 works for all clients and need not change across certificate renewals
1150 with the same key.
11523.1.2. Certificate usage DANE-TA(2)
1154 Some domains may prefer to avoid the operational complexity of
1155 publishing unique TLSA RRs for each TLS service. If the domain
1156 employs a common issuing Certification Authority to create
1157 certificates for multiple TLS services, it may be simpler to publish
1158 the issuing authority as a trust anchor (TA) for the certificate
1159 chains of all relevant services. The TLSA query domain (TLSA base
1160 domain with port and protocol prefix labels) for each service issued
1161 by the same TA may then be set to a CNAME alias that points to a
1162 common TLSA RRset that matches the TA. For example:
1164 IN MX 0
1165 IN MX 0
1168 IN TLSA 2 1 1 e3b0c44298fc1c14....
1176Dukhovni & Hardaker Expires November 26, 2014 [Page 21]
1178Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1181 With usage DANE-TA(2) the server certificates will need to have names
1182 that match one of the client's reference identifiers (see [RFC6125]).
1183 The server MAY employ SNI to select the appropriate certificate to
1184 present to the client.
1186 SMTP servers that rely on certificate usage DANE-TA(2) TLSA records
1187 for TLS authentication MUST include the TA certificate as part of the
1188 certificate chain presented in the TLS handshake server certificate
1189 message even when it is a self-signed root certificate. At this
1190 time, many SMTP servers are not configured with a comprehensive list
1191 of trust anchors, nor are they expected to at any point in the
1192 future. Some MTAs will ignore all locally trusted certificates when
1193 processing usage DANE-TA(2) TLSA records. Thus even when the TA
1194 happens to be a public Certification Authority known to the SMTP
1195 client, authentication is likely to fail unless the TA certificate is
1196 included in the TLS server certificate message.
1198 TLSA records with selector Full(0) are discouraged. While these
1199 potentially obviate the need to transmit the TA certificate in the
1200 TLS server certificate message, client implementations may not be
1201 able to augment the server certificate chain with the data obtained
1202 from DNS, especially when the TLSA record supplies a bare key
1203 (selector SPKI(1)). Since the server will need to transmit the TA
1204 certificate in any case, server operators SHOULD publish TLSA records
1205 with a selector other than Full(0) and avoid potential
1206 interoperability issues with large TLSA records containing full
1207 certificates or keys.
1209 TLSA Publishers employing DANE-TA(2) records SHOULD publish records
1210 with a selector of Cert(0). Such TLSA records are associated with
1211 the whole trust anchor certificate, not just with the trust anchor
1212 public key. In particular, the SMTP client SHOULD then apply any
1213 relevant constraints from the trust anchor certificate, such as, for
1214 example, path length constraints.
1216 While a selector of SPKI(1) may also be employed, the resulting TLSA
1217 record will not specify the full trust anchor certificate content,
1218 and elements of the trust anchor certificate other than the public
1219 key become mutable. This may, for example, allow a subsidiary CA to
1220 issue a chain that violates the trust anchor's path length or name
1221 constraints.
12233.1.3. Certificate usages PKIX-TA(0) and PKIX-EE(1)
1225 As noted in the introduction, SMTP clients cannot, without relying on
1226 DNSSEC for secure MX records and DANE for STARTTLS support signaling,
1227 perform server identity verification or prevent STARTTLS downgrade
1228 attacks. The use of PKIX CAs offers no added security since an
1232Dukhovni & Hardaker Expires November 26, 2014 [Page 22]
1234Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1237 attacker capable of compromising DNSSEC is free to replace any PKIX-
1238 TA(0) or PKIX-EE(1) TLSA records with records bearing any convenient
1239 non-PKIX certificate usage.
1241 SMTP servers SHOULD NOT publish TLSA RRs with certificate usage PKIX-
1242 TA(0) or PKIX-EE(1). SMTP clients cannot be expected to be
1243 configured with a suitably complete set of trusted public CAs.
1244 Lacking a complete set of public CAs, clients would not be able to
1245 verify the certificates of SMTP servers whose issuing root CAs are
1246 not trusted by the client.
1248 Opportunistic DANE TLS needs to interoperate without bilateral
1249 coordination of security settings between client and server systems.
1250 Therefore, parameter choices that are fragile in the absence of
1251 bilateral coordination are unsupported. Nothing is lost since the
1252 PKIX certificate usages cannot aid SMTP TLS security, they can only
1253 impede SMTP TLS interoperability.
1255 SMTP client treatment of TLSA RRs with certificate usages PKIX-TA(0)
1256 or PKIX-EE(1) is undefined. SMTP clients should generally treat such
1257 TLSA records as unusable.
12593.2. Certificate matching
1261 When at least one usable "secure" TLSA record is found, the SMTP
1262 client MUST use TLSA records to authenticate the SMTP server.
1263 Messages MUST NOT be delivered via the SMTP server if authentication
1264 fails, otherwise the SMTP client is vulnerable to MITM attacks.
12663.2.1. DANE-EE(3) name checks
1268 The SMTP client MUST NOT perform certificate name checks with
1269 certificate usage DANE-EE(3), see Section 3.1.1 above.
12713.2.2. DANE-TA(2) name checks
1273 To match a server via a TLSA record with certificate usage DANE-
1274 TA(2), the client MUST perform name checks to ensure that it has
1275 reached the correct server. In all DANE-TA(2) cases the SMTP client
1276 MUST include the TLSA base domain as one of the valid reference
1277 identifiers for matching the server certificate.
1279 TLSA records for MX hostnames: If the TLSA base domain was obtained
1280 indirectly via a "secure" MX lookup (including any CNAME-expanded
1281 name of an MX hostname), then the original next-hop domain used in
1282 the MX lookup MUST be included as as a second reference
1283 identifier. The CNAME-expanded original next-hop domain MUST be
1284 included as a third reference identifier if different from the
1288Dukhovni & Hardaker Expires November 26, 2014 [Page 23]
1290Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1293 original next-hop domain. When the client MTA is employing DANE
1294 TLS security despite "insecure" MX redirection the MX hostname is
1295 the only reference identifier.
1297 TLSA records for Non-MX hostnames: If MX records were not used
1298 (e.g., if none exist) and the TLSA base domain is the CNAME-
1299 expanded original next-hop domain, then the original next-hop
1300 domain MUST be included as a second reference identifier.
1302 Accepting certificates with the original next-hop domain in addition
1303 to the MX hostname allows a domain with multiple MX hostnames to
1304 field a single certificate bearing a single domain name (i.e., the
1305 email domain) across all the SMTP servers. This also aids
1306 interoperability with pre-DANE SMTP clients that are configured to
1307 look for the email domain name in server certificates. For example,
1308 with "secure" DNS records as below:
1312 IN MX 10
1313 IN MX 15
1314 IN MX 20
1315 ;
1316 IN A
1317 IN TLSA 2 0 1 ...
1318 ;
1320 IN A
1322 IN TLSA 2 0 1 ...
1323 ;
1325 IN A
1326 IN TLSA 2 0 1 ...
1328 Certificate name checks for delivery of mail to
1329 via any of the associated SMTP servers MUST accept at least the names
1330 "" and "", which are respectively the
1331 original and fully expanded next-hop domain. When the SMTP server is
1332, name checks MUST accept the TLSA base domain
1333 "". If, despite the fact that MX hostnames are
1334 required to not be aliases, the MTA supports delivery via
1335 "" or "" then name checks MUST accept
1336 the respective TLSA base domains "" and
1337 "".
13393.2.3. Reference identifier matching
1344Dukhovni & Hardaker Expires November 26, 2014 [Page 24]
1346Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1349 When name checks are applicable (certificate usage DANE-TA(2)), if
1350 the server certificate contains a Subject Alternative Name extension
1351 ([RFC5280]), with at least one DNS-ID ([RFC6125]) then only the DNS-
1352 IDs are matched against the client's reference identifiers. The CN-
1353 ID ([RFC6125]) is only considered when no DNS-IDs are present. The
1354 server certificate is considered matched when one of its presented
1355 identifiers ([RFC5280]) matches any of the client's reference
1356 identifiers.
1358 Wildcards are valid in either DNS-IDs or the CN-ID when applicable.
1359 The wildcard character must be entire first label of the DNS-ID or
1360 CN-ID. Thus, "*" is valid, while "smtp*" and
1361 "*" are not. SMTP clients MUST support wildcards
1362 that match the first label of the reference identifier, with the
1363 remaining labels matching verbatim. For example, the DNS-ID
1364 "*" matches the reference identifier "".
1365 SMTP clients MAY, subject to local policy allow wildcards to match
1366 multiple reference identifier labels, but servers cannot expect broad
1367 support for such a policy. Therefore any wildcards in server
1368 certificates SHOULD match exactly one label in either the TLSA base
1369 domain or the next-hop domain.
13714. Server key management
1373 Two TLSA records MUST be published before employing a new EE or TA
1374 public key or certificate, one matching the currently deployed key
1375 and the other matching the new key scheduled to replace it. Once
1376 sufficient time has elapsed for all DNS caches to expire the previous
1377 TLSA RRset and related signature RRsets, servers may be configured to
1378 use the new EE private key and associated public key certificate or
1379 may employ certificates signed by the new trust anchor.
1381 Once the new public key or certificate is in use, the TLSA RR that
1382 matches the retired key can be removed from DNS, leaving only RRs
1383 that match keys or certificates in active use.
1385 As described in Section 3.1.2, when server certificates are validated
1386 via a DANE-TA(2) trust anchor, and CNAME records are employed to
1387 store the TA association data at a single location, the
1388 responsibility of updating the TLSA RRset shifts to the operator of
1389 the trust anchor. Before a new trust anchor is used to sign any new
1390 server certificates, its certificate (digest) is added to the
1391 relevant TLSA RRset. After enough time elapses for the original TLSA
1392 RRset to age out of DNS caches, the new trust anchor can start
1393 issuing new server certificates. Once all certificates issued under
1394 the previous trust anchor have expired, its associated RRs can be
1395 removed from the TLSA RRset.
1400Dukhovni & Hardaker Expires November 26, 2014 [Page 25]
1402Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1405 In the DANE-TA(2) key management model server operators do not
1406 generally need to update DNS TLSA records after initially creating a
1407 CNAME record that references the centrally operated DANE-TA(2) RRset.
1408 If a particular server's key is compromised, its TLSA CNAME SHOULD be
1409 replaced with a DANE-EE(3) association until the certificate for the
1410 compromised key expires, at which point it can return to using CNAME
1411 record. If the central trust anchor is compromised, all servers need
1412 to be issued new keys by a new TA, and a shared DANE-TA(2) TLSA RRset
1413 needs to be published containing just the new TA. SMTP servers
1414 cannot expect broad SMTP client CRL or OCSP support.
14165. Digest algorithm agility
1418 While [RFC6698] specifies multiple digest algorithms, it does not
1419 specify a protocol by which the SMTP client and TLSA record publisher
1420 can agree on the strongest shared algorithm. Such a protocol would
1421 allow the client and server to avoid exposure to any deprecated
1422 weaker algorithms that are published for compatibility with less
1423 capable clients, but should be ignored when possible. We specify
1424 such a protocol below.
1426 Suppose that a DANE TLS client authenticating a TLS server considers
1427 digest algorithm "BetterAlg" stronger than digest algorithm
1428 "WorseAlg". Suppose further that a server's TLSA RRset contains some
1429 records with "BetterAlg" as the digest algorithm. Finally, suppose
1430 that for every raw public key or certificate object that is included
1431 in the server's TLSA RRset in digest form, whenever that object
1432 appears with algorithm "WorseAlg" with some usage and selector it
1433 also appears with algorithm "BetterAlg" with the same usage and
1434 selector. In that case our client can safely ignore TLSA records
1435 with the weaker algorithm "WorseAlg", because it suffices to check
1436 the records with the stronger algorithm "BetterAlg".
1438 Server operators MUST ensure that for any given usage and selector,
1439 each object (certificate or public key), for which a digest
1440 association exists in the TLSA RRset, is published with the SAME SET
1441 of digest algorithms as all other objects that published with that
1442 usage and selector. In other words, for each usage and selector, the
1443 records with non-zero matching types will correspond to on a cross-
1444 product of a set of underlying objects and a fixed set of digest
1445 algorithms that apply uniformly to all the objects.
1447 To achieve digest algorithm agility, all published TLSA RRsets for
1448 use with opportunistic DANE TLS for SMTP MUST conform to the above
1449 requirements. Then, for each combination of usage and selector, SMTP
1450 clients can simply ignore all digest records except those that employ
1451 the strongest digest algorithm. The ordering of digest algorithms by
1452 strength is not specified in advance, it is entirely up to the SMTP
1456Dukhovni & Hardaker Expires November 26, 2014 [Page 26]
1458Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1461 client. SMTP client implementations SHOULD make the digest algorithm
1462 preference order configurable. Only the future will tell which
1463 algorithms might be weakened by new attacks and when.
1465 Note, TLSA records with a matching type of Full(0), that publish the
1466 full value of a certificate or public key object, play no role in
1467 digest algorithm agility. They neither trump the processing of
1468 records that employ digests, nor are they ignored in the presence of
1469 any records with a digest (i.e. non-zero) matching type.
1471 SMTP clients SHOULD use digest algorithm agility when processing the
1472 DANE TLSA records of an SMTP server. Algorithm agility is to be
1473 applied after first discarding any unusable or malformed records
1474 (unsupported digest algorithm, or incorrect digest length). Thus,
1475 for each usage and selector, the client SHOULD process only any
1476 usable records with a matching type of Full(0) and the usable records
1477 whose digest algorithm is believed to be the strongest among usable
1478 records with the given usage and selector.
1480 The main impact of this requirement is on key rotation, when the TLSA
1481 RRset is pre-populated with digests of new certificates or public
1482 keys, before these replace or augment their predecessors. Were the
1483 newly introduced RRs to include previously unused digest algorithms,
1484 clients that employ this protocol could potentially ignore all the
1485 digests corresponding to the current keys or certificates, causing
1486 connectivity issues until the new keys or certificates are deployed.
1487 Similarly, publishing new records with fewer digests could cause
1488 problems for clients using cached TLSA RRsets that list both the old
1489 and new objects once the new keys are deployed.
1491 To avoid problems, server operators SHOULD apply the following
1492 strategy:
1494 o When changing the set of objects published via the TLSA RRset
1495 (e.g. during key rotation), DO NOT change the set of digest
1496 algorithms used; change just the list of objects.
1498 o When changing the set of digest algorithms, change only the set of
1499 algorithms, and generate a new RRset in which all the current
1500 objects are re-published with the new set of digest algorithms.
1502 After either of these two changes are made, the new TLSA RRset should
1503 be left in place long enough that the older TLSA RRset can be flushed
1504 from caches before making another change.
15066. Mandatory TLS Security
1512Dukhovni & Hardaker Expires November 26, 2014 [Page 27]
1514Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1517 An MTA implementing this protocol may require a stronger security
1518 assurance when sending email to selected destinations. The sending
1519 organization may need to send sensitive email and/or may have
1520 regulatory obligations to protect its content. This protocol is not
1521 in conflict with such a requirement, and in fact can often simplify
1522 authenticated delivery to such destinations.
1524 Specifically, with domains that publish DANE TLSA records for their
1525 MX hostnames, a sending MTA can be configured to use the receiving
1526 domains's DANE TLSA records to authenticate the corresponding SMTP
1527 server. Authentication via DANE TLSA records is easier to manage, as
1528 changes in the receiver's expected certificate properties are made on
1529 the receiver end and don't require manually communicated
1530 configuration changes. With mandatory DANE TLS, when no usable TLSA
1531 records are found, message delivery is delayed. Thus, mail is only
1532 sent when an authenticated TLS channel is established to the remote
1533 SMTP server.
1535 Administrators of mail servers that employ mandatory DANE TLS, need
1536 to carefully monitor their mail logs and queues. If a partner domain
1537 unwittingly misconfigures their TLSA records, disables DNSSEC, or
1538 misconfigures SMTP server certificate chains, mail will be delayed
1539 and may bounce if the issue is not resolved in a timely manner.
15417. Note on DANE for Message User Agents
1543 We note that the SMTP protocol is also used between Message User
1544 Agents (MUAs) and Message Submission Agents (MSAs) [RFC6409]. In
1545 [RFC6186] a protocol is specified that enables an MUA to dynamically
1546 locate the MSA based on the user's email address. SMTP connection
1547 security considerations for MUAs implementing [RFC6186] are largely
1548 analogous to connection security requirements for MTAs, and this
1549 specification could be applied largely verbatim with DNS MX records
1550 replaced by corresponding DNS Service (SRV) records
1551 [I-D.ietf-dane-srv].
1553 However, until MUAs begin to adopt the dynamic configuration
1554 mechanisms of [RFC6186] they are adequately served by more
1555 traditional static TLS security policies. Specification of DANE TLS
1556 for Message User Agent (MUA) to Message Submission Agent (MSA) SMTP
1557 is left to future documents that focus specifically on SMTP security
1558 between MUAs and MSAs.
1568Dukhovni & Hardaker Expires November 26, 2014 [Page 28]
1570Internet-Draft SMTP security via opportunistic DANE TLS May 2014
15738. Interoperability considerations
15758.1. SNI support
1577 To ensure that the server sends the right certificate chain, the SMTP
1578 client MUST send the TLS SNI extension containing the TLSA base
1579 domain. This precludes the use of the backward compatible SSL 2.0
1580 compatible SSL HELLO by the SMTP client. The minimum SSL/TLS client
1581 HELLO version for SMTP clients performing DANE authentication is SSL
1582 3.0, but a client that offers SSL 3.0 MUST also offer at least TLS
1583 1.0 and MUST include the SNI extension. Servers that don't make use
1584 of SNI MAY negotiate SSL 3.0 if offered by the client.
1586 Each SMTP server MUST present a certificate chain (see [RFC5246]
1587 Section 7.4.2) that matches at least one of the TLSA records. The
1588 server MAY rely on SNI to determine which certificate chain to
1589 present to the client. Clients that don't send SNI information may
1590 not see the expected certificate chain.
1592 If the server's TLSA records match the server's default certificate
1593 chain, the server need not support SNI. In either case, the server
1594 need not include the SNI extension in its TLS HELLO as simply
1595 returning a matching certificate chain is sufficient. Servers MUST
1596 NOT enforce the use of SNI by clients, as the client may be using
1597 unauthenticated opportunistic TLS and may not expect any particular
1598 certificate from the server. If the client sends no SNI extension,
1599 or sends an SNI extension for an unsupported domain, the server MUST
1600 simply send some fallback certificate chain of its choice. The
1601 reason for not enforcing strict matching of the requested SNI
1602 hostname is that DANE TLS clients are typically willing to accept
1603 multiple server names, but can only send one name in the SNI
1604 extension. The server's fallback certificate may match a different
1605 name acceptable to the client, e.g., the original next-hop domain.
16078.2. Anonymous TLS cipher suites
1609 Since many SMTP servers either do not support or do not enable any
1610 anonymous TLS cipher suites, SMTP client TLS HELLO messages SHOULD
1611 offer to negotiate a typical set of non-anonymous cipher suites
1612 required for interoperability with such servers. An SMTP client
1613 employing pre-DANE opportunistic TLS MAY in addition include one or
1614 more anonymous TLS cipher suites in its TLS HELLO. SMTP servers,
1615 that need to interoperate with opportunistic TLS clients SHOULD be
1616 prepared to interoperate with such clients by either always selecting
1617 a mutually supported non-anonymous cipher suite or by correctly
1618 handling client connections that negotiate anonymous cipher suites.
1624Dukhovni & Hardaker Expires November 26, 2014 [Page 29]
1626Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1629 Note that while SMTP server operators are under no obligation to
1630 enable anonymous cipher suites, no security is gained by sending
1631 certificates to clients that will ignore them. Indeed support for
1632 anonymous cipher suites in the server makes audit trails more
1633 informative. Log entries that record connections that employed an
1634 anonymous cipher suite record the fact that the clients did not care
1635 to authenticate the server.
16379. Operational Considerations
16399.1. Client Operational Considerations
1641 An operational error on the sending or receiving side that cannot be
1642 corrected in a timely manner may, at times, lead to consistent
1643 failure to deliver time-sensitive email. The sending MTA
1644 administrator may have to choose between letting email queue until
1645 the error is resolved and disabling opportunistic or mandatory DANE
1646 TLS for one or more destinations. The choice to disable DANE TLS
1647 security should not be made lightly. Every reasonable effort should
1648 be made to determine that problems with mail delivery are the result
1649 of an operational error, and not an attack. A fallback strategy may
1650 be to configure explicit out-of-band TLS security settings if
1651 supported by the sending MTA.
1653 SMTP clients may deploy opportunistic DANE TLS incrementally by
1654 enabling it only for selected sites, or may occasionally need to
1655 disable opportunistic DANE TLS for peers that fail to interoperate
1656 due to misconfiguration or software defects on either end. Some
1657 implementations MAY support DANE TLS in an "audit only" mode in which
1658 failure to achieve the requisite security level is logged as a
1659 warning and delivery proceeds at a reduced security level. Unless
1660 local policy specifies "audit only" or that opportunistic DANE TLS is
1661 not to be used for a particular destination, an SMTP client MUST NOT
1662 deliver mail via a server whose certificate chain fails to match at
1663 least one TLSA record when usable TLSA records are found for that
1664 server.
16669.2. Publisher Operational Considerations
1668 SMTP servers that publish certificate usage DANE-TA(2) associations
1669 MUST include the TA certificate in their TLS server certificate
1670 chain, even when that TA certificate is a self-signed root
1671 certificate.
1673 TLSA Publishers must follow the digest agility guidelines in
1674 Section 5 and must make sure that all objects published in digest
1675 form for a particular usage and selector are published with the same
1676 set of digest algorithms.
1680Dukhovni & Hardaker Expires November 26, 2014 [Page 30]
1682Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1685 TLSA Publishers should follow the TLSA publication size guidance
1686 found in [I-D.ietf-dane-ops] about "DANE DNS Record Size Guidelines".
168810. Security Considerations
1690 This protocol leverages DANE TLSA records to implement MITM resistant
1691 opportunistic channel security for SMTP. For destination domains
1692 that sign their MX records and publish signed TLSA records for their
1693 MX hostnames, this protocol allows sending MTAs to securely discover
1694 both the availability of TLS and how to authenticate the destination.
1696 This protocol does not aim to secure all SMTP traffic, as that is not
1697 practical until DNSSEC and DANE adoption are universal. The
1698 incremental deployment provided by following this specification is a
1699 best possible path for securing SMTP. This protocol coexists and
1700 interoperates with the existing insecure Internet email backbone.
1702 The protocol does not preclude existing non-opportunistic SMTP TLS
1703 security arrangements, which can continue to be used as before via
1704 manual configuration with negotiated out-of-band key and TLS
1705 configuration exchanges.
1707 Opportunistic SMTP TLS depends critically on DNSSEC for downgrade
1708 resistance and secure resolution of the destination name. If DNSSEC
1709 is compromised, it is not possible to fall back on the public CA PKI
1710 to prevent MITM attacks. A successful breach of DNSSEC enables the
1711 attacker to publish TLSA usage 3 certificate associations, and
1712 thereby bypass any security benefit the legitimate domain owner might
1713 hope to gain by publishing usage 0 or 1 TLSA RRs. Given the lack of
1714 public CA PKI support in existing MTA deployments, avoiding
1715 certificate usages 0 and 1 simplifies implementation and deployment
1716 with no adverse security consequences.
1718 Implementations must strictly follow the portions of this
1719 specification that indicate when it is appropriate to initiate a non-
1720 authenticated connection or cleartext connection to a SMTP server.
1721 Specifically, in order to prevent downgrade attacks on this protocol,
1722 implementation must not initiate a connection when this specification
1723 indicates a particular SMTP server must be considered unreachable.
172511. IANA considerations
1727 This specification requires no support from IANA.
172912. Acknowledgements
1731 The authors would like to extend great thanks to Tony Finch, who
1732 started the original version of a DANE SMTP document. His work is
1736Dukhovni & Hardaker Expires November 26, 2014 [Page 31]
1738Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1741 greatly appreciated and has been incorporated into this document.
1742 The authors would like to additionally thank Phil Pennock for his
1743 comments and advice on this document.
1745 Acknowledgments from Viktor: Thanks to Paul Hoffman who motivated me
1746 to begin work on this memo and provided feedback on early drafts.
1747 Thanks to Patrick Koetter, Perry Metzger and Nico Williams for
1748 valuable review comments. Thanks also to Wietse Venema who created
1749 Postfix, and whose advice and feedback were essential to the
1750 development of the Postfix DANE implementation.
175213. References
175413.1. Normative References
1756 [I-D.ietf-dane-ops]
1757 Dukhovni, V. and W. Hardaker, "DANE TLSA implementation
1758 and operational guidance", draft-ietf-dane-ops-00 (work in
1759 progress), October 2013.
1761 [RFC1035] Mockapetris, P., "Domain names - implementation and
1762 specification", STD 13, RFC 1035, November 1987.
1764 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
1765 Requirement Levels", BCP 14, RFC 2119, March 1997.
1767 [RFC3207] Hoffman, P., "SMTP Service Extension for Secure SMTP over
1768 Transport Layer Security", RFC 3207, February 2002.
1770 [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S.
1771 Rose, "DNS Security Introduction and Requirements", RFC
1772 4033, March 2005.
1774 [RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S.
1775 Rose, "Resource Records for the DNS Security Extensions",
1776 RFC 4034, March 2005.
1778 [RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S.
1779 Rose, "Protocol Modifications for the DNS Security
1780 Extensions", RFC 4035, March 2005.
1782 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
1783 (TLS) Protocol Version 1.2", RFC 5246, August 2008.
1785 [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
1786 Housley, R., and W. Polk, "Internet X.509 Public Key
1787 Infrastructure Certificate and Certificate Revocation List
1788 (CRL) Profile", RFC 5280, May 2008.
1792Dukhovni & Hardaker Expires November 26, 2014 [Page 32]
1794Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1797 [RFC5321] Klensin, J., "Simple Mail Transfer Protocol", RFC 5321,
1798 October 2008.
1800 [RFC6066] Eastlake, D., "Transport Layer Security (TLS) Extensions:
1801 Extension Definitions", RFC 6066, January 2011.
1803 [RFC6125] Saint-Andre, P. and J. Hodges, "Representation and
1804 Verification of Domain-Based Application Service Identity
1805 within Internet Public Key Infrastructure Using X.509
1806 (PKIX) Certificates in the Context of Transport Layer
1807 Security (TLS)", RFC 6125, March 2011.
1809 [RFC6186] Daboo, C., "Use of SRV Records for Locating Email
1810 Submission/Access Services", RFC 6186, March 2011.
1812 [RFC6672] Rose, S. and W. Wijngaards, "DNAME Redirection in the
1813 DNS", RFC 6672, June 2012.
1815 [RFC6698] Hoffman, P. and J. Schlyter, "The DNS-Based Authentication
1816 of Named Entities (DANE) Transport Layer Security (TLS)
1817 Protocol: TLSA", RFC 6698, August 2012.
181913.2. Informative References
1821 [I-D.ietf-dane-registry-acronyms]
1822 Gudmundsson, O., "Adding acronyms to simplify DANE
1823 conversations", draft-ietf-dane-registry-acronyms-01 (work
1824 in progress), October 2013.
1826 [I-D.ietf-dane-srv]
1827 Finch, T., "Using DNS-Based Authentication of Named
1828 Entities (DANE) TLSA records with SRV and MX records.",
1829 draft-ietf-dane-srv-02 (work in progress), February 2013.
1831 [RFC5598] Crocker, D., "Internet Mail Architecture", RFC 5598, July
1832 2009.
1834 [RFC6409] Gellens, R. and J. Klensin, "Message Submission for Mail",
1835 STD 72, RFC 6409, November 2011.
1837Authors' Addresses
1839 Viktor Dukhovni
1840 Two Sigma
1842 Email:
1848Dukhovni & Hardaker Expires November 26, 2014 [Page 33]
1850Internet-Draft SMTP security via opportunistic DANE TLS May 2014
1853 Wes Hardaker
1854 Parsons
1855 P.O. Box 382
1856 Davis, CA 95617
1857 US
1859 Email:
1904Dukhovni & Hardaker Expires November 26, 2014 [Page 34]