This is a summary of the 4 emails I (ANTHONY HOWE) wrote on the 7th Jan 2006 to 
ASRG-IAR in response to John Levine's comment about using DNS to do 
reputation like other DNS based blacklists:

Packing a domain and IPv6 lookup into a DNS packet
--------------------------------------------------

DNS query overhead: 90 octets

Max. domain length to lookup, 255 octets to work with.

Max. length reversed IPv6 (done on the nibble as I recall), 64 octets
eg 2001:0DB8:1234:5678:9012:3456:7890:1234 reversed is 
4.3.2.1.0.9.8.7.6.5.4.3.2.1.0.9.8.7.6.5.4.3.2.1.8.B.D.0.1.0.0.2.
(dots replaced by label length octet, plus one)

If you're grabbing the domain from the MAIL FROM: address, which itself 
is limited to 255 octets in length (RFC 2821), then its never possible 
to create a max. length domain, though you could come close with:

	a@really.long.domain...goes.here

Now since the local part can be a max. of 64 octets, you could say the 
max. length for a domain in an email address is really 190 octets, which 
would allow just enough room to create a domain+IPv6 request, but 
without the query server's domain.

Now if you're willing to cut corners still further, you could opt to 
support only a max. domain length of 128 octets. Which leaves room for 
the query server's domain suffix (think .in-addr.arpa.).

	really.long.domain....goes.here.\
	4.3.2.1.0.9.8.7.6.5.4.3.2.1.0.9.\
	8.7.6.5.4.3.2.1.8.B.D.0.1.0.0.2.\
	siq.dns.query.server.goes.here.

So for common light-weight cases you could fit a domain+IP lookup 
request into one DNS UDP packet. For longer domains, you fall back on 
doing HTTP POST requests.

Also we haven't even considered I18N DNS requests, which I know nil 
about, but I'm sure it will strive to cause some havoc as well.

Now in DNS BLs, typically 127.0.0.X, where X is greater than 1 is used, 
but why limit ourselves to A records and one octet of information.

One could do some neat juggling here in the DNS response packet to 
return BOTH scores and class of result. Consider returning an IPv6 AAAA 
record, instead of an A record, which gives you 16 octets of information 
that could be returned.

But for the sake cleanliness, assume that DNS AAAA response is always in 
the IPv6 Test Net (RFC 3849), then your DNS zone entry might look 
something like:

     domain.ipv6   IN AAAA  2001:0DB8: .......

Which reduces us to 12 octets of useful information that can be defined 
in the AAAA record.

In theory, you could map the current SIQ UDP protocol onto a DNS UDP 
packet. In the AAAA response as part of the 2001:0DB8: space use:

     1 octet for the THE SCORE
     1 octet for the DEVIATION
     1 octet for the IP SCORE
     1 octet for the DOMAIN SCORE
     1 octet for the IP-DOMAIN RELATIONSHIP SCORE

There is still enough octets left over for a "permission level" or 
classification octet as suggested by someone else.

Also remember that we could "multi-home" the record and return multiple 
AAAA records in order to extend the response, though that would mean 
we'd require some other IPv6 reserved space to denote the other record, 
like Link-Local (FE80::/10) and Site-Local (FEC0::/10).

A TXT record could be returned in the same response as extra info to 
provide human reasons and/or logging information. The DNS query does not 
have enough room to encode two questions. And I don't think DNS servers 
return TXT in the AR section as a rule, so that probably means a second 
DNS request to fetch the TXT record back. But a custom DNS-like server 
could be built if really necessary to over come that and provide dynamic 
TXT records on the fly.

All that would be required would be to define the actual AAAA response 
format.

Another thing I've not looked into concerning DNS in general and would 
be an issue to resolve if a DNS-RL were defined, is doing:

a) secure requests, ie. TLS
b) authenticated requests, ie. customer subscriptions maybe

But then I guess we could punt in those cases like SIQ did and jump to 
HTTP(S) for TLS/SSL and authentication.

-- 
Anthony C Howe       http://www.snert.com/     +33 6 11 89 73 78
AIM: SirWumpus            ICQ: 7116561          Skype: SirWumpus
Sendmail Anti-Spam Solutions           http://www.snertsoft.com/
                       We Serve Your Server