This is a summary of the 4 emails I (ANTHONY HOWE) wrote on the 7th Jan 2006 to 
ASRG-IAR in response to John Levine's comment about using DNS to do
reputation like other DNS based blacklists:

Packing a domain and IPv6 lookup into a DNS packet
--------------------------------------------------

DNS query overhead: 90 octets

Max. domain length to lookup, 255 octets to work with.

Max. length reversed IPv6 (done on the nibble as I recall), 64 octets
eg 2001:0DB8:1234:5678:9012:3456:7890:1234 reversed is
4.3.2.1.0.9.8.7.6.5.4.3.2.1.0.9.8.7.6.5.4.3.2.1.8.B.D.0.1.0.0.2.
(dots replaced by label length octet, plus one)

If you're grabbing the domain from the MAIL FROM: address, which itself
is limited to 255 octets in length (RFC 2821), then its never possible
to create a max. length domain, though you could come close with:

a@really.long.domain...goes.here

Now since the local part can be a max. of 64 octets, you could say the
max. length for a domain in an email address is really 190 octets, which
would allow just enough room to create a domain+IPv6 request, but
without the query server's domain.

Now if you're willing to cut corners still further, you could opt to
support only a max. domain length of 128 octets. Which leaves room for
the query server's domain suffix (think .in-addr.arpa.).

really.long.domain....goes.here.\
4.3.2.1.0.9.8.7.6.5.4.3.2.1.0.9.\
8.7.6.5.4.3.2.1.8.B.D.0.1.0.0.2.\
siq.dns.query.server.goes.here.

So for common light-weight cases you could fit a domain+IP lookup
request into one DNS UDP packet. For longer domains, you fall back on
doing HTTP POST requests.

Also we haven't even considered I18N DNS requests, which I know nil
about, but I'm sure it will strive to cause some havoc as well.

Now in DNS BLs, typically 127.0.0.X, where X is greater than 1 is used,
but why limit ourselves to A records and one octet of information.

One could do some neat juggling here in the DNS response packet to
return BOTH scores and class of result. Consider returning an IPv6 AAAA
record, instead of an A record, which gives you 16 octets of information
that could be returned.

But for the sake cleanliness, assume that DNS AAAA response is always in
the IPv6 Test Net (RFC 3849), then your DNS zone entry might look
something like:

domain.ipv6 IN AAAA 2001:0DB8: .......

Which reduces us to 12 octets of useful information that can be defined
in the AAAA record.

In theory, you could map the current SIQ UDP protocol onto a DNS UDP
packet. In the AAAA response as part of the 2001:0DB8: space use:

1 octet for the THE SCORE
1 octet for the DEVIATION
1 octet for the IP SCORE
1 octet for the DOMAIN SCORE
1 octet for the IP-DOMAIN RELATIONSHIP SCORE

There is still enough octets left over for a "permission level" or
classification octet as suggested by someone else.

Also remember that we could "multi-home" the record and return multiple
AAAA records in order to extend the response, though that would mean
we'd require some other IPv6 reserved space to denote the other record,
like Link-Local (FE80::/10) and Site-Local (FEC0::/10).

A TXT record could be returned in the same response as extra info to
provide human reasons and/or logging information. The DNS query does not
have enough room to encode two questions. And I don't think DNS servers
return TXT in the AR section as a rule, so that probably means a second
DNS request to fetch the TXT record back. But a custom DNS-like server
could be built if really necessary to over come that and provide dynamic
TXT records on the fly.

All that would be required would be to define the actual AAAA response
format.

Another thing I've not looked into concerning DNS in general and would
be an issue to resolve if a DNS-RL were defined, is doing:

a) secure requests, ie. TLS
b) authenticated requests, ie. customer subscriptions maybe

But then I guess we could punt in those cases like SIQ did and jump to
HTTP(S) for TLS/SSL and authentication.

--
Anthony C Howe http://www.snert.com/ +33 6 11 89 73 78
AIM: SirWumpus ICQ: 7116561 Skype: SirWumpus
Sendmail Anti-Spam Solutions http://www.snertsoft.com/
We Serve Your Server