idnits 2.17.00 (12 Aug 2021) /tmp/idnits26436/draft-ietf-dane-smtp-with-dane-08.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- -- The document has examples using IPv4 documentation addresses according to RFC6890, but does not use any IPv6 documentation addresses. Maybe there should be IPv6 examples, too? Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (April 23, 2014) is 2949 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: draft-ietf-dane-ops has been published as RFC 7671 ** Obsolete normative reference: RFC 5246 (Obsoleted by RFC 8446) == Outdated reference: draft-ietf-dane-registry-acronyms has been published as RFC 7218 == Outdated reference: draft-ietf-dane-srv has been published as RFC 7673 Summary: 1 error (**), 0 flaws (~~), 4 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 DANE V. Dukhovni 3 Internet-Draft Two Sigma 4 Intended status: Standards Track W. Hardaker 5 Expires: October 25, 2014 Parsons 6 April 23, 2014 8 SMTP security via opportunistic DANE TLS 9 draft-ietf-dane-smtp-with-dane-08 11 Abstract 13 This memo describes a downgrade-resistant protocol for SMTP transport 14 security between Mail Transfer Agents (MTAs) based on the DNS-Based 15 Authentication of Named Entities (DANE) TLSA DNS record. Adoption of 16 this protocol enables an incremental transition of the Internet email 17 backbone to one using encrypted and authenticated Transport Layer 18 Security (TLS). 20 Status of This Memo 22 This Internet-Draft is submitted in full conformance with the 23 provisions of BCP 78 and BCP 79. 25 Internet-Drafts are working documents of the Internet Engineering 26 Task Force (IETF). Note that other groups may also distribute 27 working documents as Internet-Drafts. The list of current Internet- 28 Drafts is at http://datatracker.ietf.org/drafts/current/. 30 Internet-Drafts are draft documents valid for a maximum of six months 31 and may be updated, replaced, or obsoleted by other documents at any 32 time. It is inappropriate to use Internet-Drafts as reference 33 material or to cite them other than as "work in progress." 35 This Internet-Draft will expire on October 25, 2014. 37 Copyright Notice 39 Copyright (c) 2014 IETF Trust and the persons identified as the 40 document authors. All rights reserved. 42 This document is subject to BCP 78 and the IETF Trust's Legal 43 Provisions Relating to IETF Documents 44 (http://trustee.ietf.org/license-info) in effect on the date of 45 publication of this document. Please review these documents 46 carefully, as they describe your rights and restrictions with respect 47 to this document. Code Components extracted from this document must 48 include Simplified BSD License text as described in Section 4.e of 49 the Trust Legal Provisions and are provided without warranty as 50 described in the Simplified BSD License. 52 Table of Contents 54 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 55 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 56 1.2. Background . . . . . . . . . . . . . . . . . . . . . . . 4 57 1.3. SMTP channel security . . . . . . . . . . . . . . . . . . 5 58 1.3.1. STARTTLS downgrade attack . . . . . . . . . . . . . . 5 59 1.3.2. Insecure server name without DNSSEC . . . . . . . . . 6 60 1.3.3. Sender policy does not scale . . . . . . . . . . . . 7 61 1.3.4. Too many certification authorities . . . . . . . . . 7 62 2. Opportunistic DANE TLS . . . . . . . . . . . . . . . . . . . 8 63 2.1. DNS errors, bogus and indeterminate responses . . . . . . 8 64 2.2. TLS discovery . . . . . . . . . . . . . . . . . . . . . . 11 65 2.2.1. MX resolution . . . . . . . . . . . . . . . . . . . . 13 66 2.2.2. Non-MX destinations . . . . . . . . . . . . . . . . . 14 67 2.2.3. TLSA record lookup . . . . . . . . . . . . . . . . . 16 68 2.3. DANE authentication . . . . . . . . . . . . . . . . . . . 17 69 2.3.1. TLSA certificate usages . . . . . . . . . . . . . . . 18 70 2.3.2. Certificate matching . . . . . . . . . . . . . . . . 22 71 2.3.3. Key rotation . . . . . . . . . . . . . . . . . . . . 24 72 2.3.4. Digest algorithm agility . . . . . . . . . . . . . . 24 73 3. Mandatory TLS Security . . . . . . . . . . . . . . . . . . . 26 74 4. Note on DANE for Message User Agents . . . . . . . . . . . . 26 75 5. Interoperability considerations . . . . . . . . . . . . . . . 27 76 5.1. SNI support . . . . . . . . . . . . . . . . . . . . . . . 27 77 5.2. Anonymous TLS cipher suites . . . . . . . . . . . . . . . 28 78 6. Operational Considerations . . . . . . . . . . . . . . . . . 28 79 6.1. Client Operational Considerations . . . . . . . . . . . . 28 80 6.2. Publisher Operational Considerations . . . . . . . . . . 29 81 7. Security Considerations . . . . . . . . . . . . . . . . . . . 29 82 8. IANA considerations . . . . . . . . . . . . . . . . . . . . . 30 83 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 30 84 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 30 85 10.1. Normative References . . . . . . . . . . . . . . . . . . 30 86 10.2. Informative References . . . . . . . . . . . . . . . . . 32 87 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 32 89 1. Introduction 91 This memo specifies a new connection security model for Message 92 Transfer Agents (MTAs). This model is motivated by key features of 93 inter-domain SMTP delivery, in particular the fact that the 94 destination server is selected indirectly via DNS Mail Exchange (MX) 95 records and that with MTA to MTA SMTP the use of TLS is generally 96 opportunistic. 98 Problems with existing use of TLS in MTA to MTA SMTP that motivate 99 this specification are described in Section 1.3. The specification 100 itself follows in Section 2. Then, in Section 3, we discuss 101 application of DANE TLS to destinations for which channel integrity 102 and confidentiality are mandatory. In Section 4 we briefly comment 103 on potential applicability of this specification to Message User 104 Agents. 106 1.1. Terminology 108 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 109 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 110 "OPTIONAL" in this document are to be interpreted as described in 111 [RFC2119]. 113 The following terms or concepts are used through the document: 115 Man-in-the-middle or MITM attack: Active modification of network 116 traffic by an adversary able to thereby compromise the 117 confidentiality or integrity of the data. 119 secure, bogus, insecure, indeterminate: DNSSEC validation results, 120 as defined in Section 4.3 of [RFC4035]. 122 Validating Security-Aware Stub Resolver and Non-Validating 123 Security-Aware Stub Resolver: 124 Capabilities of the stub resolver in use as defined in [RFC4033]; 125 note that this specification requires the use of a Security-Aware 126 Stub Resolver; Security-Oblivious stub-resolvers MUST NOT be used. 128 opportunistic DANE TLS: Best-effort use of TLS, resistant to 129 downgrade attacks for destinations with DNSSEC-validated TLSA 130 records. When opportunistic DANE TLS is determined to be 131 unavailable, clients should fall back to opportunistic TLS below. 132 Opportunistic DANE TLS requires support for DNSSEC, DANE and 133 STARTTLS on the client side and STARTTLS plus a DNSSEC published 134 TLSA record on the server side. 136 (pre-DANE) opportunistic TLS: Best-effort use of TLS that is 137 generally vulnerable to DNS forgery and STARTTLS downgrade 138 attacks. When a TLS-encrypted communication channel is not 139 available, message transmission takes place in the clear. MX 140 record indirection generally precludes authentication even when 141 TLS is available. 143 reference identifier: (Special case of [RFC6125] definition). One 144 of the domain names associated by the SMTP client with the 145 destination SMTP server for performing name checks on the server 146 certificate. When name checks are applicable, at least one of the 147 reference identifiers MUST match an [RFC6125] DNS-ID (or if none 148 are present the [RFC6125] CN-ID) of the server certificate (see 149 Section 2.3.2.3). 151 MX hostname: The RRDATA of an MX record consists of a 16 bit 152 preference followed by a Mail Exchange domain name (see [RFC1035], 153 Section 3.3.9). We will use the term "MX hostname" to refer to 154 the latter, that is, the DNS domain name found after the 155 preference value in an MX record. Thus an "MX hostname" is 156 specifically a reference to a DNS domain name, rather than any 157 host that bears that name. 159 delayed delivery: Email delivery is a multi-hop store & forward 160 process. When an MTA is unable forward a message that may become 161 deliverable later, the message is queued and delivery is retried 162 periodically. Some MTAs may be configured with a fallback next- 163 hop destination that handles messages that the MTA would otherwise 164 queue and retry. In these cases, messages that would otherwise 165 have to be delayed, may be sent to the fallback next-hop 166 destination instead. The fallback destination may itself be 167 subject to opportunistic or mandatory DANE TLS as though it were 168 the original message destination. 170 original next hop destination: The logical destination for mail 171 delivery. By default this is the domain portion of the recipient 172 address, but MTAs may be configured to forward mail for some or 173 all recipients via designated relays. The original next hop 174 destination is, respectively, either the recipient domain or the 175 associated configured relay. 177 MTA: Message Transfer Agent ([RFC5598], Section 4.3.2). 179 MSA: Message Submission Agent ([RFC5598], Section 4.3.1). 181 MUA: Message User Agent ([RFC5598], Section 4.2.1). 183 RR: A DNS Resource Record 185 RRset: A set of DNS Resource Records for a particular class, domain 186 and record type. 188 1.2. Background 190 The Domain Name System Security Extensions (DNSSEC) add data origin 191 authentication, data integrity and data non-existence proofs to the 192 Domain Name System (DNS). DNSSEC is defined in [RFC4033], [RFC4034] 193 and [RFC4035]. 195 As described in the introduction of [RFC6698], TLS authentication via 196 the existing public Certification Authority (CA) PKI suffers from an 197 over-abundance of trusted parties capable of issuing certificates for 198 any domain of their choice. DANE leverages the DNSSEC infrastructure 199 to publish trusted public keys and certificates for use with the 200 Transport Layer Security (TLS) [RFC5246] protocol via a new "TLSA" 201 DNS record type. With DNSSEC each domain can only vouch for the keys 202 of its directly delegated sub-domains. 204 The TLS protocol enables secure TCP communication. In the context of 205 this memo, channel security is assumed to be provided by TLS. Used 206 without authentication, TLS provides only privacy protection against 207 eavesdropping attacks. With authentication, TLS also provides data 208 integrity protection to guard against MITM attacks. 210 1.3. SMTP channel security 212 With HTTPS, Transport Layer Security (TLS) employs X.509 certificates 213 [RFC5280] issued by one of the many Certificate Authorities (CAs) 214 bundled with popular web browsers to allow users to authenticate 215 their "secure" websites. Before we specify a new DANE TLS security 216 model for SMTP, we will explain why a new security model is needed. 217 In the process, we will explain why the familiar HTTPS security model 218 is inadequate to protect inter-domain SMTP traffic. 220 The subsections below outline four key problems with applying 221 traditional PKI to SMTP that are addressed by this specification. 222 Since SMTP channel security policy is not explicitly specified in 223 either the recipient address or the MX record, a new signaling 224 mechanism is required to indicate when channel security is possible 225 and should be used. The publication of TLSA records allows server 226 operators to securely signal to SMTP clients that TLS is available 227 and should be used. DANE TLSA makes it possible to simultaneously 228 discover which destination domains support secure delivery via TLS 229 and how to verify the authenticity of the associated SMTP services, 230 providing a path forward to ubiquitous SMTP channel security. 232 1.3.1. STARTTLS downgrade attack 233 The Simple Mail Transfer Protocol (SMTP) [RFC5321] is a single-hop 234 protocol in a multi-hop store & forward email delivery process. SMTP 235 envelope recipient addresses are not transport addresses and are 236 security-agnostic. Unlike the Hypertext Transfer Protocol (HTTP) and 237 its corresponding secured version, HTTPS, where the use of TLS is 238 signalled via the URI scheme, email recipient addresses do not 239 directly signal transport security policy. Indeed, no such signaling 240 could work well with SMTP since TLS encryption of SMTP protects email 241 traffic on a hop-by-hop basis while email addresses could only 242 express end-to-end policy. 244 With no mechanism available to signal transport security policy, SMTP 245 relays employ a best-effort "opportunistic" security model for TLS. 246 A single SMTP server TCP listening endpoint can serve both TLS and 247 non-TLS clients; the use of TLS is negotiated via the SMTP STARTTLS 248 command ([RFC3207]). The server signals TLS support to the client 249 over a cleartext SMTP connection, and, if the client also supports 250 TLS, it may negotiate a TLS encrypted channel to use for email 251 transmission. The server's indication of TLS support can be easily 252 suppressed by an MITM attacker. Thus pre-DANE SMTP TLS security can 253 be subverted by simply downgrading a connection to cleartext. No TLS 254 security feature, such as the use of PKIX, can prevent this. The 255 attacker can simply disable TLS. 257 1.3.2. Insecure server name without DNSSEC 259 With SMTP, DNS Mail Exchange (MX) records abstract the next-hop 260 transport endpoint and allow administrators to specify a set of 261 target servers to which SMTP traffic should be directed for a given 262 domain. 264 A PKIX TLS client is vulnerable to MITM attacks unless it verifies 265 that the server's certificate binds the public key to a name that 266 matches one of the client's reference identifiers. A natural choice 267 of reference identifier is the server's domain name. However, with 268 SMTP, server names are obtained indirectly via MX records. Without 269 DNSSEC, the MX lookup is vulnerable to MITM and DNS cache poisoning 270 attacks. Active attackers can forge DNS replies with fake MX records 271 and can redirect email to servers with names of their choice. 272 Therefore, secure verification of SMTP TLS certificates matching the 273 server name is not possible without DNSSEC. 275 One might try to harden TLS for SMTP against DNS attacks by using the 276 envelope recipient domain as a reference identifier and requiring 277 each SMTP server to possess a trusted certificate for the envelope 278 recipient domain rather than the MX hostname. Unfortunately, this is 279 impractical as email for many domains is handled by third parties 280 that are not in a position to obtain certificates for all the domains 281 they serve. Deployment of the Server Name Indication (SNI) extension 282 to TLS (see [RFC6066] Section 3) is no panacea, since SNI key 283 management is operationally challenging except when the email service 284 provider is also the domain's registrar and its certificate issuer; 285 this is rarely the case for email. 287 Since the recipient domain name cannot be used as the SMTP server 288 reference identifier, and neither can the MX hostname without DNSSEC, 289 large-scale deployment of authenticated TLS for SMTP requires that 290 the DNS be secure. 292 Since SMTP security depends critically on DNSSEC, it is important to 293 point out that consequently SMTP with DANE is the most conservative 294 possible trust model. It trusts only what must be trusted and no 295 more. Adding any other trusted actors to the mix can only reduce 296 SMTP security. A sender may choose to further harden DNSSEC for 297 selected high-value receiving domains, by configuring explicit trust 298 anchors for those domains instead of relying on the chain of trust 299 from the root domain. Detailed discussion of DNSSEC security 300 practices is out of scope for this document. 302 1.3.3. Sender policy does not scale 304 Sending systems are in some cases explicitly configured to use TLS 305 for mail sent to selected peer domains. This requires sending MTAs 306 to be configured with appropriate subject names or certificate 307 content digests to expect in the presented server certificates. 308 Because of the heavy administrative burden, such statically 309 configured SMTP secure channels are used rarely (generally only 310 between domains that make bilateral arrangements with their business 311 partners). Internet email, on the other hand, requires regularly 312 contacting new domains for which security configurations cannot be 313 established in advance. 315 The abstraction of the SMTP transport endpoint via DNS MX records, 316 often across organization boundaries, limits the use of public CA PKI 317 with SMTP to a small set of sender-configured peer domains. With 318 little opportunity to use TLS authentication, sending MTAs are rarely 319 configured with a comprehensive list of trusted CAs. SMTP services 320 that support STARTTLS often deploy X.509 certificates that are self- 321 signed or issued by a private CA. 323 1.3.4. Too many certification authorities 325 Even if it were generally possible to determine a secure server name, 326 the SMTP client would still need to verify that the server's 327 certificate chain is issued by a trusted Certification Authority (a 328 trust anchor). MTAs are not interactive applications where a human 329 operator can make a decision (wisely or otherwise) to selectively 330 disable TLS security policy when certificate chain verification 331 fails. With no user to "click OK", the MTAs list of public CA trust 332 anchors would need to be comprehensive in order to avoid bouncing 333 mail addressed to sites that employ unknown Certification 334 Authorities. 336 On the other hand, each trusted CA can issue certificates for any 337 domain. If even one of the configured CAs is compromised or operated 338 by an adversary, it can subvert TLS security for all destinations. 339 Any set of CAs is simultaneously both overly inclusive and not 340 inclusive enough. 342 2. Opportunistic DANE TLS 344 Neither email addresses nor MX hostnames signal a requirement for 345 either secure or cleartext transport. Therefore, aside from a few 346 manually configured exceptions, SMTP transport security is of 347 necessity opportunistic. 349 This specification uses the presence of DANE TLSA records to securely 350 signal TLS support and to publish the means by which SMTP clients can 351 successfully authenticate legitimate SMTP servers. This becomes 352 "opportunistic DANE TLS" and is resistant to downgrade and MITM 353 attacks, and enables an incremental transition of the email backbone 354 to authenticated TLS delivery, with increased global protection as 355 adoption increases. 357 With opportunistic DANE TLS, traffic from SMTP clients to domains 358 that publish "usable" DANE TLSA records in accordance with this memo 359 is authenticated and encrypted. Traffic from non-compliant clients 360 or to domains that do not publish TLSA records will continue to be 361 sent in the same manner as before, via manually configured security, 362 (pre-DANE) opportunistic TLS or just cleartext SMTP. 364 2.1. DNS errors, bogus and indeterminate responses 366 An SMTP client that implements opportunistic DANE TLS per this 367 specification depends critically on the integrity of DNSSEC lookups, 368 as discussed in Section 1.3. This section lists the DNS resolver 369 requirements needed to avoid downgrade attacks when using 370 opportunistic DANE TLS. 372 A DNS lookup may signal an error or return a definitive answer. A 373 security-aware resolver must be used for this specification. 374 Security-aware resolvers will indicate the security status of a DNS 375 RRset with one of four possible values defined in Section 4.3 of 376 [RFC4035]: "secure", "insecure", "bogus" and "indeterminate". In 377 [RFC4035] the meaning of the "indeterminate" security status is: 379 An RRset for which the resolver is not able to determine whether 380 the RRset should be signed, as the resolver is not able to obtain 381 the necessary DNSSEC RRs. This can occur when the security-aware 382 resolver is not able to contact security-aware name servers for 383 the relevant zones. 385 Note, the "indeterminate" security status has a conflicting 386 definition in section 5 of [RFC4033]. 388 There is no trust anchor that would indicate that a specific 389 portion of the tree is secure. 391 SMTP clients following this specification SHOULD NOT distinguish 392 between "insecure" and "indeterminate" in the [RFC4033] sense. Both 393 "insecure" and RFC4033 "indeterminate" are handled identically: in 394 either case unvalidated data for the query domain is all that is and 395 can be available, and authentication using the data is impossible. 396 In what follows, when we say "insecure", we include also DNS results 397 for domains that lie in a portion of the DNS tree for which there is 398 no applicable trust anchor. With the DNS root zone signed, we expect 399 that validating resolvers used by Internet-facing MTAs will be 400 configured with trust anchor data for the root zone. Therefore, 401 RFC4033-style "indeterminate" domains should be rare in practice. 402 From here on, when we say "indeterminate", it is exclusively in the 403 sense of [RFC4035]. 405 As noted in section 4.3 of [RFC4035], a security-aware DNS resolver 406 MUST be able to determine whether a given non-error DNS response is 407 "secure", "insecure", "bogus" or "indeterminate". It is expected 408 that most security-aware stub resolvers will not signal an 409 "indeterminate" security status in the RFC4035-sense to the 410 application, and will signal a "bogus" or error result instead. If a 411 resolver does signal an RFC4035 "indeterminate" security status, this 412 MUST be treated by the SMTP client as though a "bogus" or error 413 result had been returned. 415 An MTA making use of a non-validating security-aware stub resolver 416 MAY use the stub resolver's ability, if available, to signal DNSSEC 417 validation status based on information the stub resolver has learned 418 from an upstream validating recursive resolver. In accordance with 419 section 4.9.3 of [RFC4035]: 421 ... a security-aware stub resolver MUST NOT place any reliance on 422 signature validation allegedly performed on its behalf, except 423 when the security-aware stub resolver obtained the data in question 424 from a trusted security-aware recursive name server via a secure 425 channel. 427 To avoid much repetition in the text below, we will pause to explain 428 the handling of "bogus" or "indeterminate" DNSSEC query responses. 429 These are not necessarily the result of a malicious actor; they can, 430 for example, occur when network packets are corrupted or lost in 431 transit. Therefore, "bogus" or "indeterminate" replies are equated 432 in this memo with lookup failure. 434 There is an important non-failure condition we need to highlight in 435 addition to the obvious case of the DNS client obtaining a non-empty 436 "secure" or "insecure" RRset of the requested type. Namely, it is 437 not an error when either "secure" or "insecure" non-existence is 438 determined for the requested data. When a DNSSEC response with a 439 validation status that is either "secure" or "insecure" reports 440 either no records of the requested type or non-existence of the query 441 domain, the response is not a DNS error condition. The DNS client 442 has not been left without an answer; it has learned that records of 443 the requested type do not exist. 445 Security-aware stub resolvers will, of course, also signal DNS lookup 446 errors in other cases, for example when processing a "ServFail" 447 RCODE, which will not have an associated DNSSEC status. All lookup 448 errors are treated the same way by this specification, regardless of 449 whether they are from a "bogus" or "indeterminate" DNSSEC status or 450 from a more generic DNS error: the information that was requested can 451 not be obtained by the security-aware resolver at this time. A 452 lookup error is thus a failure to obtain the relevant RRset if it 453 exists, or to determine that no such RRset exists when it does not. 455 In contrast to a "bogus" or an "indeterminate" response, an 456 "insecure" DNSSEC response is not an error, rather it indicates that 457 the target DNS zone is either securely opted out of DNSSEC validation 458 or is not connected with the DNSSEC trust anchors being used. 459 Insecure results will leave the SMTP client with degraded channel 460 security, but do not stand in the way of message delivery. See 461 section Section 2.2 for further details. 463 When a stub resolver receives a response containing a CNAME alias, it 464 will generally restart the query at the target of the alias, and 465 should do so recursively up to some configured or implementation- 466 dependent recursion limit. If at any stage of recursive CNAME 467 expansion a query fails, the stub resolver's lookup of the original 468 requested records will result in a failure status being returned. If 469 at any stage of recursive expansion the response is "insecure", then 470 it and all subsequent results (in particular, the final result) MUST 471 be considered "insecure" regardless of whether the other responses 472 received were deemed "secure". If at any stage of recursive 473 expansion the validation status is "bogus" or "indeterminate" or 474 associated with another DNS lookup error, the resolution of the 475 requested records MUST be considered to have failed. 477 When a DNS lookup failure (error or "bogus" or "indeterminate" as 478 defined above) prevents an SMTP client from determining which SMTP 479 server or servers it should connect to, message delivery MUST be 480 delayed. This naturally includes, for example, the case when a 481 "bogus" or "indeterminate" response is encountered during MX 482 resolution. When multiple MX hostnames are obtained from a 483 successful MX lookup, but a later DNS lookup failure prevents network 484 address resolution for a given MX hostname, delivery may proceed via 485 any remaining MX hosts. 487 When a particular SMTP server is selected as the delivery 488 destination, a set of DNS lookups must be performed to discover any 489 related TLSA records. If any DNS queries used to locate TLSA records 490 fail (be it due to "bogus" or "indeterminate" records, timeouts, 491 malformed replies, ServFails, etc.), then the SMTP client MUST treat 492 that server as unreachable and MUST NOT deliver the message via that 493 server. If no servers are reachable, delivery is delayed. 495 In what follows, we will only describe what happens when all relevant 496 DNS queries succeed. If any DNS failure occurs, the SMTP client MUST 497 behave as described in this section, by skipping the problem SMTP 498 server, or the problem destination. Queries for candidate TLSA 499 records are explicitly part of "all relevant DNS queries" and SMTP 500 clients MUST NOT continue to connect to an SMTP server or destination 501 whose TLSA record lookup fails. 503 2.2. TLS discovery 505 As noted previously (in Section 1.3.1), opportunistic TLS with SMTP 506 servers that advertise TLS support via STARTTLS is subject to an MITM 507 downgrade attack. Also some SMTP servers that are not, in fact, TLS 508 capable erroneously advertise STARTTLS by default and clients need to 509 be prepared to retry cleartext delivery after STARTTLS fails. In 510 contrast, DNSSEC validated TLSA records MUST NOT be published for 511 servers that do not support TLS. Clients can safely interpret their 512 presence as a commitment by the server operator to implement TLS and 513 STARTTLS. 515 This memo defines four actions to be taken after the search for a 516 TLSA record returns secure usable results, secure unusable results, 517 insecure or no results or an error signal. The term "usable" in this 518 context is in the sense of Section 4.1 of [RFC6698]. Specifically, 519 if the DNS lookup for a TLSA record returns: 521 A secure TLSA RRset with at least one usable record: A connection to 522 the MTA MUST be made using authenticated and encrypted TLS, using 523 the techniques discussed in the rest of this document. Failure to 524 establish an authenticated TLS connection MUST result in falling 525 back to the next SMTP server or delayed delivery. 527 A Secure non-empty TLSA RRset where all the records are unusable: A 528 connection to the MTA MUST be made via TLS, but authentication is 529 not required. Failure to establish an encrypted TLS connection 530 MUST result in falling back to the next SMTP server or delayed 531 delivery. 533 An insecure TLSA RRset or DNSSEC validated proof-of-non-existent TLSA 534 records: 535 A connection to the MTA SHOULD be made using (pre-DANE) 536 opportunistic TLS, this includes using cleartext delivery when the 537 remote SMTP server does not appear to support TLS. The MTA MAY 538 retry in cleartext when delivery via TLS fails either during the 539 handshake or even during data transfer. 541 Any lookup error: Lookup errors, including "bogus" and 542 "indeterminate", as explained in Section 2.1 MUST result in 543 falling back to the next SMTP server or delayed delivery. 545 An SMTP client MAY be configured to require DANE verified delivery 546 for some destinations. We will call such a configuration "mandatory 547 DANE TLS". With mandatory DANE TLS, delivery proceeds only when 548 "secure" TLSA records are used to establish an encrypted and 549 authenticated TLS channel with the SMTP server. 551 A note about DNAME aliases: a query for a domain name whose ancestor 552 domain is a DNAME alias returns the DNAME RR for the ancestor domain, 553 along with a CNAME that maps the query domain to the corresponding 554 sub-domain of the target domain of the DNAME alias [RFC6672]. 555 Therefore, whenever we speak of CNAME aliases, we implicitly allow 556 for the possibility that the alias in question is the result of an 557 ancestor domain DNAME record. Consequently, no explicit support for 558 DNAME records is needed in SMTP software, it is sufficient to process 559 the resulting CNAME aliases. DNAME records only require special 560 processing in the validating stub-resolver library that checks the 561 integrity of the combined DNAME + CNAME reply. When DNSSEC 562 validation is handled by a local caching resolver, rather than the 563 MTA itself, even that part of the DNAME support logic is outside the 564 MTA. 566 When the original next-hop destination is an address literal, rather 567 than a DNS domain, DANE TLS does not apply. Delivery proceeds using 568 any relevant security policy configured by the MTA administrator. 569 Similarly, when an MX RRset incorrectly lists a network address in 570 lieu of an MX hostname, if the MTA chooses to connect to the network 571 address DANE TLSA does not apply for such a connection. 573 In the subsections that follow we explain how to locate the SMTP 574 servers and the associated TLSA records for a given next-hop 575 destination domain. We also explain which name or names are to be 576 used in identity checks of the SMTP server certificate. 578 2.2.1. MX resolution 580 In this section we consider next-hop domains that are subject to MX 581 resolution and have MX records. The TLSA records and the associated 582 base domain are derived separately for each MX hostname that is used 583 to attempt message delivery. Clearly, if DANE TLS security is to 584 apply to message delivery via any of the SMTP servers, the MX records 585 must be obtained securely via a DNSSEC validated MX lookup. 587 MX records MUST be sorted by preference; an MX hostname with a worse 588 (numerically higher) MX preference that has TLSA records MUST NOT 589 preempt an MX hostname with a better (numerically lower) preference 590 that has no TLSA records. In other words, prevention of delivery 591 loops by obeying MX preferences MUST take precedence over channel 592 security considerations. Even with two equal-preference MX records, 593 an MTA is not obligated to choose the MX hostname that offers more 594 security. Domains that want secure inbound mail delivery need to 595 ensure that all their SMTP servers and MX records are configured 596 accordingly. 598 In the language of [RFC5321] Section 5.1, the original next-hop 599 domain is the "initial name". If the MX lookup of the initial name 600 results in a CNAME alias, the MTA replaces the initial name with the 601 resulting name and performs a new lookup with the new name. MTAs 602 typically support recursion in CNAME expansion, so this replacement 603 is performed repeatedly until the ultimate non-CNAME domain is found. 605 If the MX RRset (or any CNAME leading to it) is "insecure" (see 606 Section 2.1), DANE TLS does not apply, and delivery proceeds via pre- 607 DANE opportunistic TLS. Otherwise (assuming no DNS errors or "bogus" 608 /"indeterminate" responses), the MX RRset is "secure", and the SMTP 609 client MUST treat each MX hostname as a separate non-MX destination 610 for opportunistic DANE TLS as described in Section 2.2.2. When, for 611 a given MX hostname, no TLSA records are found, or only "insecure" 612 TLSA records are found, DANE TLSA is not applicable with the SMTP 613 server in question and delivery proceeds to that host as with pre- 614 DANE opportunistic TLS. To avoid downgrade attacks, any errors 615 during TLSA lookups MUST, as explained in Section 2.1, cause the SMTP 616 server in question to be treated as unreachable. 618 2.2.2. Non-MX destinations 620 This section describes the algorithm used to locate the TLSA records 621 and associated TLSA base domain for an input domain not subject to MX 622 resolution. Such domains include: 624 o Each MX hostname used in a message delivery attempt for an 625 original next-hop destination domain subject to MX resolution. 626 Note, MTAs are not obligated to support CNAME expansion of MX 627 hostnames. 629 o Any administrator configured relay hostname, not subject to MX 630 resolution. This frequently involves configuration set by the MTA 631 administrator to handle some or all mail. 633 o A next-hop destination domain subject to MX resolution that has no 634 MX records. In this case the domain's name is implicitly also its 635 sole SMTP server name. 637 Note that DNS queries with type TLSA are mishandled by load balancing 638 nameservers that serve the MX hostnames of some large email 639 providers. The DNS zones served by these nameservers are not signed 640 and contain no TLSA records, but queries for TLSA records fail, 641 rather than returning the non-existence of the requested TLSA 642 records. 644 To avoid problems delivering mail to domains whose SMTP servers are 645 served by the problem nameservers the SMTP client MUST perform any A 646 and/or AAAA queries for the destination before attempting to locate 647 the associated TLSA records. This lookup is needed in any case to 648 determine whether the destination domain is reachable and the DNSSEC 649 validation status of the chain of CNAME queries required to reach the 650 ultimate address records. 652 If no address records are found, the destination is unreachable. If 653 address records are found, but the DNSSEC validation status of the 654 first query response is "insecure" (there may be additional queries 655 if the initial response is a CNAME alias), the SMTP client SHOULD NOT 656 proceed to search for any associated TLSA records. With the problem 657 domains, TLSA queries will lead to DNS lookup errors and cause 658 messages to be consistently delayed and ultimately returned to the 659 sender. We don't expect to find any "secure" TLSA records associated 660 with a TLSA base domain that lies in an unsigned DNS zone. 661 Therefore, skipping TLSA lookups in this case will also reduce 662 latency with no detrimental impact on security. 664 If the A and/or AAAA lookup of the "initial name" yields a CNAME, we 665 replace it with the resulting name as if it were the initial name and 666 perform a lookup again using the new name. This replacement is 667 performed recursively. 669 We consider the following cases for handling a DNS response for an A 670 or AAAA DNS lookup: 672 Not found: When the DNS queries for A and/or AAAA records yield 673 neither a list of addresses nor a CNAME (or CNAME expansion is not 674 supported) the destination is unreachable. 676 Non-CNAME: The answer is not a CNAME alias. If the address RRset 677 is "secure", TLSA lookups are performed as described in 678 Section 2.2.3 with the initial name as the candidate TLSA base 679 domain. If no "secure" TLSA records are found, DANE TLS is not 680 applicable and mail delivery proceeds with pre-DANE opportunistic 681 TLS (which, being best-effort, degrades to cleartext delivery when 682 STARTTLS is not available or the TLS handshake fails). 684 Insecure CNAME: The input domain is a CNAME alias, but the ultimate 685 network address RRset is "insecure" (see Section 2.1). If the 686 initial CNAME response is also "insecure", DANE TLS does not 687 apply. Otherwise, this case is treated just like the non-CNAME 688 case above, where a search is performed for a TLSA record with the 689 original input domain as the candidate TLSA base domain. 691 Secure CNAME: The input domain is a CNAME alias, and the ultimate 692 network address RRset is "secure" (see Section 2.1). Two 693 candidate TLSA base domains are tried: the fully CNAME-expanded 694 initial name and, failing that, then the initial name itself. 696 In summary, if it is possible to securely obtain the full, CNAME- 697 expanded, DNSSEC-validated address records for the input domain, then 698 that name is the preferred TLSA base domain. Otherwise, the 699 unexpanded input-MX domain is the candidate TLSA base domain. When 700 no "secure" TLSA records are found at either the CNAME-expanded or 701 unexpanded domain, then DANE TLS does not apply for mail delivery via 702 the input domain in question. And, as always, errors, bogus or 703 indeterminate results for any query in the process MUST result in 704 delaying or abandoning delivery. 706 2.2.3. TLSA record lookup 708 Each candidate TLSA base domain (the original or fully CNAME-expanded 709 name of a non-MX destination or a particular MX hostname of an MX 710 destination) is in turn prefixed with service labels of the form 711 "_._tcp". The resulting domain name is used to issue a DNSSEC 712 query with the query type set to TLSA ([RFC6698] Section 7.1). 714 For SMTP, the destination TCP port is typically 25, but this may be 715 different with custom routes specified by the MTA administrator in 716 which case the SMTP client MUST use the appropriate number in the 717 "_" prefix in place of "_25". If, for example, the candidate 718 base domain is "mx.example.com", and the SMTP connection is to port 719 25, the TLSA RRset is obtained via a DNSSEC query of the form: 721 _25._tcp.mx.example.com. IN TLSA ? 723 The query response may be a CNAME, or the actual TLSA RRset. If the 724 response is a CNAME, the SMTP client (through the use of its 725 security-aware stub resolver) restarts the TLSA query at the target 726 domain, following CNAMEs as appropriate and keeping track of whether 727 the entire chain is "secure". If any "insecure" records are 728 encountered, or the TLSA records don't exist, the next candidate TLSA 729 base is tried instead. 731 If the ultimate response is a "secure" TLSA RRset, then the candidate 732 TLSA base domain will be the actual TLSA base domain and the TLSA 733 RRset will constitute the TLSA records for the destination. If none 734 of the candidate TLSA base domains yield "secure" TLSA records then 735 delivery should proceed via pre-DANE opportunistic TLS. 737 TLSA record publishers may leverage CNAMEs to reference a single 738 authoritative TLSA RRset specifying a common Certification Authority 739 or a common end entity certificate to be used with multiple TLS 740 services. Such CNAME expansion does not change the SMTP client's 741 notion of the TLSA base domain; thus, when _25._tcp.mx.example.com is 742 a CNAME, the base domain remains mx.example.com and this is still the 743 reference identifier used together with the next-hop domain in peer 744 certificate name checks. 746 Note, shared end entity certificate associations expose the 747 publishing domain to substitution attacks, where an MITM attacker can 748 reroute traffic to a different server that shares the same end entity 749 certificate. Such shared end entity records SHOULD be avoided unless 750 the servers in question are functionally equivalent (an active 751 attacker gains nothing by diverting client traffic from one such 752 server to another). 754 For example, given the DNSSEC validated records below: 756 example.com. IN MX 0 mx1.example.com. 757 example.com. IN MX 0 mx2.example.com. 758 _25._tcp.mx1.example.com. IN CNAME tlsa211._dane.example.com. 759 _25._tcp.mx2.example.com. IN CNAME tlsa211._dane.example.com. 760 tlsa211._dane.example.com. IN TLSA 2 1 1 e3b0c44298fc1c149a... 762 The SMTP servers mx1.example.com and mx2.example.com will be expected 763 to have certificates issued under a common trust anchor, but each MX 764 hostname's TLSA base domain remains unchanged despite the above CNAME 765 records. Correspondingly, each SMTP server will be associated with a 766 pair of reference identifiers consisting of its hostname plus the 767 next-hop domain "example.com". 769 If, during TLSA resolution (including possible CNAME indirection), at 770 least one "secure" TLSA record is found (even if not usable because 771 it is unsupported by the implementation or support is 772 administratively disabled), then the corresponding host has signaled 773 its commitment to implement TLS. The SMTP client SHOULD NOT deliver 774 mail via the corresponding host unless a TLS session is negotiated 775 via STARTTLS. This is required to avoid MITM STARTTLS downgrade 776 attacks. 778 As noted previously (in Section Section 2.2.2), when no "secure" TLSA 779 records are found at the fully CNAME-expanded name, the original 780 unexpanded name MUST be tried instead. This supports customers of 781 hosting providers where the provider's zone cannot be validated with 782 DNSSEC, but the customer has shared appropriate key material with the 783 hosting provider to enable TLS via SNI. Intermediate names that 784 arise during CNAME expansion that are neither the original, nor the 785 final name, are never candidate TLSA base domains, even if "secure". 787 2.3. DANE authentication 789 This section describes which TLSA records are applicable to SMTP 790 opportunistic DANE TLS and how to apply such records to authenticate 791 the SMTP server. With opportunistic DANE TLS, both the TLS support 792 implied by the presence of DANE TLSA records and the verification 793 parameters necessary to authenticate the TLS peer are obtained 794 together. In contrast to protocols where channel security policy is 795 set exclusively by the client, authentication via this protocol is 796 expected to be less prone to connection failure caused by 797 incompatible configuration of the client and server. 799 2.3.1. TLSA certificate usages 801 The DANE TLSA specification [RFC6698] defines multiple TLSA RR types 802 via combinations of 3 numeric parameters. The numeric values of 803 these parameters were later given symbolic names in 804 [I-D.ietf-dane-registry-acronyms]. The rest of the TLSA record is 805 the "certificate association data field", which specifies the full or 806 digest value of a certificate or public key. The parameters are: 808 The TLSA Certificate Usage field: Section 2.1.1 of [RFC6698] 809 specifies 4 values: PKIX-TA(0), PKIX-EE(1), DANE-TA(2), and DANE- 810 EE(3). There is an additional private-use value: PrivCert(255). 811 All other values are reserved for use by future specifications. 813 The selector field: Section 2.1.2 of [RFC6698] specifies 2 values: 814 Cert(0), SPKI(1). There is an additional private-use value: 815 PrivSel(255). All other values are reserved for use by future 816 specifications. 818 The matching type field: Section 2.1.3 of [RFC6698] specifies 3 819 values: Full(0), SHA2-256(1), SHA2-512(2). There is an additional 820 private-use value: PrivMatch(255). All other values are reserved 821 for use by future specifications. 823 We may think of TLSA Certificate Usage values 0 through 3 as a 824 combination of two one-bit flags. The low bit chooses between trust 825 anchor (TA) and end entity (EE) certificates. The high bit chooses 826 between public PKI issued and domain-issued certificates. 828 The selector field specifies whether the TLSA RR matches the whole 829 certificate: Cert(0), or just its subjectPublicKeyInfo: SPKI(1). The 830 subjectPublicKeyInfo is an ASN.1 DER encoding of the certificate's 831 algorithm id, any parameters and the public key data. 833 The matching type field specifies how the TLSA RR Certificate 834 Association Data field is to be compared with the certificate or 835 public key. A value of Full(0) means an exact match: the full DER 836 encoding of the certificate or public key is given in the TLSA RR. A 837 value of SHA2-256(1) means that the association data matches the 838 SHA2-256 digest of the certificate or public key, and likewise 839 SHA2-512(2) means a SHA2-512 digest is used. 841 Since opportunistic DANE TLS will be used by non-interactive MTAs, 842 with no user to "press OK" when authentication fails, reliability of 843 peer authentication is paramount. Server operators are advised to 844 publish TLSA records that are least likely to fail authentication due 845 to interoperability or operational problems. Because DANE TLS relies 846 on coordinated changes to DNS and SMTP server settings, the best 847 choice of records to publish will depend on site-specific practices. 849 The certificate usage element of a TLSA record plays a critical role 850 in determining how the corresponding certificate association data 851 field is used to authenticate server's certificate chain. The next 852 two subsections explain the process for certificate usages DANE-EE(3) 853 and DANE-TA(2). The third subsection briefly explains why 854 certificate usages PKIX-TA(0) and PKIX-EE(1) are not applicable with 855 opportunistic DANE TLS. 857 In summary, we recommend the use of either "DANE-EE(3) SPKI(1) 858 SHA2-256(1)" or "DANE-TA(2) Cert(0) SHA2-256(1)" TLSA records 859 depending on site needs. Other combinations of TLSA parameters are 860 either explicitly unsupported, or offer little to recommend them over 861 these two. 863 The mandatory to support digest algorithm in [RFC6698] is 864 SHA2-256(1). When the server's TLSA RRset includes records with a 865 matching type indicating a digest record (i.e., a value other than 866 Full(0)), a TLSA record with a SHA2-256(1) matching type SHOULD be 867 provided along with any other digest published, since some SMTP 868 clients may support only SHA2-256(1). If at some point the SHA2-256 869 digest algorithm is tarnished by new cryptanalytic attacks, 870 publishers will need to include an appropriate stronger digest in 871 their TLSA records, initially along with, and ultimately in place of, 872 SHA2-256. 874 2.3.1.1. Certificate usage DANE-EE(3) 876 Authentication via certificate usage DANE-EE(3) TLSA records involves 877 simply checking that the server's leaf certificate matches the TLSA 878 record. In particular the binding of the server public key to its 879 name is based entirely on the TLSA record association The server MUST 880 be considered authenticated even if none of the names in the 881 certificate match the client's reference identity for the server. 883 Similarly, the expiration date of the server certificate MUST be 884 ignored, the validity period of the TLSA record key binding is 885 determined by the validity interval of the TLSA record DNSSEC 886 signature. 888 With DANE-EE(3) servers need not employ SNI (may ignore the client's 889 SNI message) even when the server is known under independent names 890 that would otherwise require separate certificates. It is instead 891 sufficient for the TLSA RRsets for all the domains in question to 892 match the server's default certificate. Of course with SMTP servers 893 it is simpler still to publish the same MX hostname for all the 894 hosted domains. 896 For domains where it is practical to make coordinated changes in DNS 897 TLSA records during SMTP server key rotation, it is often best to 898 publish end-entity DANE-EE(3) certificate associations. DANE-EE(3) 899 certificates don't suddenly stop working when leaf or intermediate 900 certificates expire, and don't fail when the server operator neglects 901 to configure all the required issuer certificates in the server 902 certificate chain. 904 TLSA records published for SMTP servers SHOULD, in most cases, be 905 "DANE-EE(3) SPKI(1) SHA2-256(1)" records. Since all DANE 906 implementations are required to support SHA2-256, this record type 907 works for all clients and need not change across certificate renewals 908 with the same key. 910 2.3.1.2. Certificate usage DANE-TA(2) 912 Some domains may prefer to avoid the operational complexity of 913 publishing unique TLSA RRs for each TLS service. If the domain 914 employs a common issuing Certification Authority to create 915 certificates for multiple TLS services, it may be simpler to publish 916 the issuing authority as a trust anchor (TA) for the certificate 917 chains of all relevant services. The TLSA query domain (TLSA base 918 domain with port and protocol prefix labels) for each service issued 919 by the same TA may then be set to a CNAME alias that points to a 920 common TLSA RRset that matches the TA. For example: 922 example.com. IN MX 0 mx1.example.com. 923 example.com. IN MX 0 mx2.example.com. 924 _25._tcp.mx1.example.com. IN CNAME tlsa211._dane.example.com. 925 _25._tcp.mx2.example.com. IN CNAME tlsa211._dane.example.com. 926 tlsa211._dane.example.com. IN TLSA 2 1 1 e3b0c44298fc1c14.... 928 With usage DANE-TA(2) the server certificates will need to have names 929 that match one of the client's reference identifiers (see [RFC6125]). 930 The server MAY employ SNI to select the appropriate certificate to 931 present to the client. 933 SMTP servers that rely on certificate usage DANE-TA(2) TLSA records 934 for TLS authentication MUST include the TA certificate as part of the 935 certificate chain presented in the TLS handshake server certificate 936 message even when it is a self-signed root certificate. At this 937 time, many SMTP servers are not configured with a comprehensive list 938 of trust anchors, nor are they expected to at any point in the 939 future. Some MTAs will ignore all locally trusted certificates when 940 processing usage DANE-TA(2) TLSA records. Thus even when the TA 941 happens to be a public Certification Authority known to the SMTP 942 client, authentication is likely to fail unless the TA certificate is 943 included in the TLS server certificate message. 945 TLSA records with selector Full(0) are discouraged. While these 946 potentially obviate the need to transmit the TA certificate in the 947 TLS server certificate message, client implementations may not be 948 able to augment the server certificate chain with the data obtained 949 from DNS, especially when the TLSA record supplies a bare key 950 (selector SPKI(1)). Since the server will need to transmit the TA 951 certificate in any case, server operators SHOULD publish TLSA records 952 with a selector other than Full(0) and avoid potential 953 interoperability issues with large TLSA records containing full 954 certificates or keys. 956 TLSA Publishers employing DANE-TA(2) records SHOULD publish records 957 with a selector of Cert(0). Such TLSA records are associated with 958 the whole trust anchor certificate, not just with the trust anchor 959 public key. In particular, the SMTP client SHOULD then apply any 960 relevant constraints from the trust anchor certificate, such as, for 961 example, path length constraints. 963 While a selector of SPKI(1) may also be employed, the resulting TLSA 964 record will not specify the full trust anchor certificate content, 965 and elements of the trust anchor certificate other than the public 966 key become mutable. This may, for example, allow a subsidiary CA to 967 issue a chain that violates the trust anchor's path length or name 968 constraints. 970 2.3.1.3. Certificate usages PKIX-TA(0) and PKIX-EE(1) 972 SMTP servers SHOULD NOT publish TLSA RRs with certificate usage 973 "PKIX-TA(0)" or "PKIX-EE(1)". SMTP clients cannot be expected to be 974 configured with a suitably complete set of trusted public CAs. Even 975 with a full set of public CAs, SMTP clients cannot (without relying 976 on DNSSEC for secure MX records and DANE for STARTTLS support 977 signaling) perform [RFC6125] server identity verification or prevent 978 STARTTLS downgrade attacks. The use of trusted public CAs offers no 979 added security since an attacker capable of compromising DNSSEC is 980 free to replace any PKIX-TA(0) or PKIX-EE(1) TLSA records with 981 records bearing any convenient non-PKIX certificate usage. 983 SMTP client treatment of TLSA RRs with certificate usages "PKIX- 984 TA(0)" or "PKIX-EE(1)" is undefined. For example, clients MAY (will 985 likely) treat such TLSA records as unusable. 987 2.3.2. Certificate matching 989 When at least one usable "secure" TLSA record is found, the SMTP 990 client SHOULD use TLSA records to authenticate the SMTP server. 991 Messages SHOULD NOT be delivered via the SMTP server if 992 authentication fails, otherwise the SMTP client is vulnerable to MITM 993 attacks. 995 2.3.2.1. DANE-EE(3) name checks 997 The SMTP client MUST NOT perform certificate name checks with 998 certificate usage DANE-EE(3), see Section 2.3.1.1 above. 1000 2.3.2.2. DANE-TA(2) name checks 1002 To match a server via a TLSA record with certificate usage DANE- 1003 TA(2), the client MUST perform name checks to ensure that it has 1004 reached the correct server. In all DANE-TA(2) cases the SMTP client 1005 MUST include the TLSA base domain as one of the valid reference 1006 identifiers for matching the server certificate. 1008 TLSA records for MX hostnames: If the TLSA base domain was obtained 1009 indirectly via an MX lookup (including any CNAME-expanded name of 1010 an MX hostname), then the original next-hop domain used in the MX 1011 lookup MUST be included as as a second reference identifier. The 1012 CNAME-expanded original next-hop domain MUST be included as a 1013 third reference identifier if different from the original next-hop 1014 domain. 1016 TLSA records for Non-MX hostnames: If MX records were not used 1017 (e.g., if none exist) and the TLSA base domain is the CNAME- 1018 expanded original next-hop domain, then the original next-hop 1019 domain MUST be included as a second reference identifier. 1021 Accepting certificates with the original next-hop domain in addition 1022 to the MX hostname allows a domain with multiple MX hostnames to 1023 field a single certificate bearing a single domain name (i.e., the 1024 email domain) across all the SMTP servers. This also aids 1025 interoperability with pre-DANE SMTP clients that are configured to 1026 look for the email domain name in server certificates. For example, 1027 with "secure" DNS records as below: 1029 exchange.example.org. IN CNAME mail.example.org. 1030 mail.example.org. IN CNAME example.com. 1031 example.com. IN MX 10 mx10.example.com. 1032 example.com. IN MX 15 mx15.example.com. 1033 example.com. IN MX 20 mx20.example.com. 1034 ; 1035 mx10.example.com. IN A 192.0.2.10 1036 _25._tcp.mx10.example.com. IN TLSA 2 0 1 ... 1037 ; 1038 mx15.example.com. IN CNAME mxbackup.example.com. 1039 mxbackup.example.com. IN A 192.0.2.15 1040 ; _25._tcp.mxbackup.example.com. IN TLSA ? (NXDOMAIN) 1041 _25._tcp.mx15.example.com. IN TLSA 2 0 1 ... 1042 ; 1043 mx20.example.com. IN CNAME mxbackup.example.net. 1044 mxbackup.example.net. IN A 198.51.100.20 1045 _25._tcp.mxbackup.example.net. IN TLSA 2 0 1 ... 1047 Certificate name checks for delivery of mail to exchange.example.org 1048 via any of the associated SMTP servers MUST accept at least the names 1049 "exchange.example.org" and "example.com", which are respectively the 1050 original and fully expanded next-hop domain. When the SMTP server is 1051 mx10.example.com, name checks MUST accept the TLSA base domain 1052 "mx10.example.com". If, despite the fact that MX hostnames are 1053 required to not be aliases, the MTA supports delivery via 1054 "mx15.example.com" or "mx20.example.com" then name checks MUST accept 1055 the respective TLSA base domains "mx15.example.com" and 1056 "mxbackup.example.net". 1058 2.3.2.3. Reference identifier matching 1060 When name checks are applicable (certificate usage DANE-TA(2)), if 1061 the server certificate contains a Subject Alternative Name extension 1062 ([RFC5280]), with at least one DNS-ID ([RFC6125]) then only the DNS- 1063 IDs are matched against the client's reference identifiers. The CN- 1064 ID ([RFC6125]) is only considered when no DNS-IDs are present. The 1065 server certificate is considered matched when one of its presented 1066 identifiers ([RFC5280]) matches any of the client's reference 1067 identifiers. 1069 Wildcards are valid in either DNS-IDs or the CN-ID when applicable. 1070 The wildcard character must be entire first label of the DNS-ID or 1071 CN-ID. Thus, "*.example.com" is valid, while "smtp*.example.com" and 1072 "*smtp.example.com" are not. SMTP clients MUST support wildcards 1073 that match the first label of the reference identifier, with the 1074 remaining labels matching verbatim. For example, the DNS-ID 1075 "*.example.com" matches the reference identifier "mx1.example.com". 1076 SMTP clients MAY, subject to local policy allow wildcards to match 1077 multiple reference identifier labels, but servers cannot expect broad 1078 support for such a policy. Therefore any wildcards in server 1079 certificates SHOULD match exactly one label in either the TLSA base 1080 domain or the next-hop domain. 1082 2.3.3. Key rotation 1084 Two TLSA records MUST be published before employing a new EE or TA 1085 public key or certificate, one matching the currently deployed key 1086 and the other matching the new key scheduled to replace it. Once 1087 sufficient time has elapsed for all DNS caches to expire the previous 1088 TLSA RRset and related signature RRsets, servers may be configured to 1089 use the new EE private key and associated public key certificate or 1090 may employ certificates signed by the new trust anchor. 1092 Once the new public key or certificate is in use, the TLSA RR that 1093 matches the retired key can be removed from DNS, leaving only RRs 1094 that match keys or certificates in active use. 1096 2.3.4. Digest algorithm agility 1098 While [RFC6698] specifies multiple digest algorithms, it does not 1099 specify a protocol by which the SMTP client and TLSA record publisher 1100 can agree on the strongest shared algorithm. Such a protocol would 1101 allow the client and server to avoid exposure to any deprecated 1102 weaker algorithms that are published for compatibility with less 1103 capable clients, but should be ignored when possible. We specify 1104 such a protocol below. 1106 Suppose that a DANE TLS client authenticating a TLS server considers 1107 digest algorithm BETTER stronger than digest algorithm WORSE. 1108 Suppose further that a server's TLSA RRset contains some records with 1109 BETTER as the digest algorithm. Finally, suppose that for every raw 1110 public key or certificate object that is included in the server's 1111 TLSA RRset in digest form, whenever that object appears with 1112 algorithm WORSE with some usage and selector it also appears with 1113 algorithm BETTER with the same usage and selector. In that case our 1114 client can safely ignore TLSA records with the weaker algorithm 1115 WORSE, because it suffices to check the records with the stronger 1116 algorithm BETTER. 1118 Server operators MUST ensure that for any given usage and selector, 1119 each object (certificate or public key), for which a digest 1120 association exists in the TLSA RRset, is published with the SAME SET 1121 of digest algorithms as all other objects that published with that 1122 usage and selector. In other words, for each usage and selector, the 1123 records with non-zero matching types will correspond to on a cross- 1124 product of a set of underlying objects and a fixed set of digest 1125 algorithms that apply uniformly to all the objects. 1127 To achieve digest algorithm agility, all published TLSA RRsets for 1128 use with opportunistic DANE TLS for SMTP MUST conform to the above 1129 requirements. Then, for each combination of usage and selector, SMTP 1130 clients can simply ignore all digest records except those that employ 1131 the strongest digest algorithm. The ordering of digest algorithms by 1132 strength is not specified in advance, it is entirely up to the SMTP 1133 client. SMTP client implementations SHOULD make the digest algorithm 1134 preference order configurable. Only the future will tell which 1135 algorithms might be weakened by new attacks and when. 1137 Note, TLSA records with a matching type of Full(0), that publish the 1138 full value of a certificate or public key object, play no role in 1139 digest algorithm agility. They neither trump the processing of 1140 records that employ digests, nor are they ignored in the presence of 1141 any records with a digest (i.e. non-zero) matching type. 1143 SMTP clients SHOULD use digest algorithm agility when processing the 1144 DANE TLSA records of an SMTP server. Algorithm agility is to be 1145 applied after first discarding any unusable or malformed records 1146 (unsupported digest algorithm, or incorrect digest length). Thus, 1147 for each usage and selector, the client SHOULD process only any 1148 usable records with a matching type of Full(0) and the usable records 1149 whose digest algorithm is believed to be the strongest among usable 1150 records with the given usage and selector. 1152 The main impact of this requirement is on key rotation, when the TLSA 1153 RRset is pre-populated with digests of new certificates or public 1154 keys, before these replace or augment their predecessors. Were the 1155 newly introduced RRs to include previously unused digest algorithms, 1156 clients that employ this protocol could potentially ignore all the 1157 digests corresponding to the current keys or certificates, causing 1158 connectivity issues until the new keys or certificates are deployed. 1159 Similarly, publishing new records with fewer digests could cause 1160 problems for clients using cached TLSA RRsets that list both the old 1161 and new objects once the new keys are deployed. 1163 To avoid problems, server operators SHOULD apply the following 1164 strategy: 1166 o When changing the set of objects published via the TLSA RRset 1167 (e.g. during key rotation), DO NOT change the set of digest 1168 algorithms used; change just the list of objects. 1170 o When changing the set of digest algorithms, change only the set of 1171 algorithms, and generate a new RRset in which all the current 1172 objects are re-published with the new set of digest algorithms. 1174 After either of these two changes are made, the new TLSA RRset should 1175 be left in place long enough that the older TLSA RRset can be flushed 1176 from caches before making another change. 1178 3. Mandatory TLS Security 1180 An MTA implementing this protocol may require a stronger security 1181 assurance when sending email to selected destinations. The sending 1182 organization may need to send sensitive email and/or may have 1183 regulatory obligations to protect its content. This protocol is not 1184 in conflict with such a requirement, and in fact can often simplify 1185 authenticated delivery to such destinations. 1187 Specifically, with domains that publish DANE TLSA records for their 1188 MX hostnames, a sending MTA can be configured to use the receiving 1189 domains's DANE TLSA records to authenticate the corresponding SMTP 1190 server. Authentication via DANE TLSA records is easier to manage, as 1191 changes in the receiver's expected certificate properties are made on 1192 the receiver end and don't require manually communicated 1193 configuration changes. With mandatory DANE TLS, when no usable TLSA 1194 records are found, message delivery is delayed. Thus, mail is only 1195 sent when an authenticated TLS channel is established to the remote 1196 SMTP server. 1198 Administrators of mail servers that employ mandatory DANE TLS, need 1199 to carefully monitor their mail logs and queues. If a partner domain 1200 unwittingly misconfigures their TLSA records, disables DNSSEC, or 1201 misconfigures SMTP server certificate chains, mail will be delayed 1202 and may bounce if the issue is not resolved in a timely manner. 1204 4. Note on DANE for Message User Agents 1205 We note that the SMTP protocol is also used between Message User 1206 Agents (MUAs) and Message Submission Agents (MSAs) [RFC6409]. In 1207 [RFC6186] a protocol is specified that enables an MUA to dynamically 1208 locate the MSA based on the user's email address. SMTP connection 1209 security considerations for MUAs implementing [RFC6186] are largely 1210 analogous to connection security requirements for MTAs, and this 1211 specification could be applied largely verbatim with DNS MX records 1212 replaced by corresponding DNS Service (SRV) records 1213 [I-D.ietf-dane-srv]. 1215 However, until MUAs begin to adopt the dynamic configuration 1216 mechanisms of [RFC6186] they are adequately served by more 1217 traditional static TLS security policies. Specification of DANE TLS 1218 for Message User Agent (MUA) to Message Submission Agent (MSA) SMTP 1219 is left to future documents that focus specifically on SMTP security 1220 between MUAs and MSAs. 1222 5. Interoperability considerations 1224 5.1. SNI support 1226 To ensure that the server sends the right certificate chain, the SMTP 1227 client MUST send the TLS SNI extension containing the TLSA base 1228 domain. This precludes the use of the backward compatible SSL 2.0 1229 compatible SSL HELLO by the SMTP client. The minimum SSL/TLS client 1230 HELLO version for SMTP clients performing DANE authentication is SSL 1231 3.0, but a client that offers SSL 3.0 MUST also offer at least TLS 1232 1.0 and MUST include the SNI extension. Servers that don't make use 1233 of SNI MAY negotiate SSL 3.0 if offered by the client. 1235 Each SMTP server MUST present a certificate chain (see [RFC5246] 1236 Section 7.4.2) that matches at least one of the TLSA records. The 1237 server MAY rely on SNI to determine which certificate chain to 1238 present to the client. Clients that don't send SNI information may 1239 not see the expected certificate chain. 1241 If the server's TLSA records match the server's default certificate 1242 chain, the server need not support SNI. In either case, the server 1243 need not include the SNI extension in its TLS HELLO as simply 1244 returning a matching certificate chain is sufficient. Servers MUST 1245 NOT enforce the use of SNI by clients, as the client may be using 1246 unauthenticated opportunistic TLS and may not expect any particular 1247 certificate from the server. If the client sends no SNI extension, 1248 or sends an SNI extension for an unsupported domain, the server MUST 1249 simply send its default certificate chain. The reason for not 1250 enforcing strict matching of the requested SNI hostname is that DANE 1251 TLS clients are typically willing to accept multiple server names, 1252 but can only send one name in the SNI extension. The server's 1253 default certificate may match a different name acceptable to the 1254 client, e.g., the original next-hop domain. 1256 5.2. Anonymous TLS cipher suites 1258 Since many SMTP servers either do not support or do not enable any 1259 anonymous TLS cipher suites, SMTP client TLS HELLO messages SHOULD 1260 offer to negotiate a typical set of non-anonymous cipher suites 1261 required for interoperability with such servers. An SMTP client 1262 employing pre-DANE opportunistic TLS MAY in addition include one or 1263 more anonymous TLS cipher suites in its TLS HELLO. SMTP servers, 1264 that need to interoperate with opportunistic TLS clients SHOULD be 1265 prepared to interoperate with such clients by either always selecting 1266 a mutually supported non-anonymous cipher suite or by correctly 1267 handling client connections that negotiate anonymous cipher suites. 1269 Note that while SMTP server operators are under no obligation to 1270 enable anonymous cipher suites, no security is gained by sending 1271 certificates to clients that will ignore them. Indeed support for 1272 anonymous cipher suites in the server makes audit trails more 1273 informative. Log entries that record connections that employed an 1274 anonymous cipher suite record the fact that the clients did not care 1275 to authenticate the server. 1277 6. Operational Considerations 1279 6.1. Client Operational Considerations 1281 An operational error on the sending or receiving side that cannot be 1282 corrected in a timely manner may, at times, lead to consistent 1283 failure to deliver time-sensitive email. The sending MTA 1284 administrator may have to choose between letting email queue until 1285 the error is resolved and disabling opportunistic or mandatory DANE 1286 TLS for one or more destinations. The choice to disable DANE TLS 1287 security should not be made lightly. Every reasonable effort should 1288 be made to determine that problems with mail delivery are the result 1289 of an operational error, and not an attack. A fallback strategy may 1290 be to configure explicit out-of-band TLS security settings if 1291 supported by the sending MTA. 1293 SMTP clients may deploy opportunistic DANE TLS incrementally by 1294 enabling it only for selected sites, or may occasionally need to 1295 disable opportunistic DANE TLS for peers that fail to interoperate 1296 due to misconfiguration or software defects on either end. Some 1297 implementations MAY support DANE TLS in an "audit only" mode in which 1298 failure to achieve the requisite security level is logged as a 1299 warning and delivery proceeds at a reduced security level. Unless 1300 local policy specifies "audit only" or that opportunistic DANE TLS is 1301 not to be used for a particular destination, an SMTP client MUST NOT 1302 deliver mail via a server whose certificate chain fails to match at 1303 least one TLSA record when usable TLSA records are found for that 1304 server. 1306 6.2. Publisher Operational Considerations 1308 SMTP servers that publish certificate usage DANE-TA(2) associations 1309 MUST include the TA certificate in their TLS server certificate 1310 chain, even when that TA certificate is a self-signed root 1311 certificate. 1313 TLSA Publishers must follow the digest agility guidelines in 1314 Section 2.3.4 and must make sure that all objects published in digest 1315 form for a particular usage and selector are published with the same 1316 set of digest algorithms. 1318 TLSA Publishers should follow the TLSA publication size guidance 1319 found in [I-D.ietf-dane-ops] about "DANE DNS Record Size Guidelines". 1321 7. Security Considerations 1323 This protocol leverages DANE TLSA records to implement MITM resistant 1324 opportunistic channel security for SMTP. For destination domains 1325 that sign their MX records and publish signed TLSA records for their 1326 MX hostnames, this protocol allows sending MTAs to securely discover 1327 both the availability of TLS and how to authenticate the destination. 1329 This protocol does not aim to secure all SMTP traffic, as that is not 1330 practical until DNSSEC and DANE adoption are universal. The 1331 incremental deployment provided by following this specification is a 1332 best possible path for securing SMTP. This protocol coexists and 1333 interoperates with the existing insecure Internet email backbone. 1335 The protocol does not preclude existing non-opportunistic SMTP TLS 1336 security arrangements, which can continue to be used as before via 1337 manual configuration with negotiated out-of-band key and TLS 1338 configuration exchanges. 1340 Opportunistic SMTP TLS depends critically on DNSSEC for downgrade 1341 resistance and secure resolution of the destination name. If DNSSEC 1342 is compromised, it is not possible to fall back on the public CA PKI 1343 to prevent MITM attacks. A successful breach of DNSSEC enables the 1344 attacker to publish TLSA usage 3 certificate associations, and 1345 thereby bypass any security benefit the legitimate domain owner might 1346 hope to gain by publishing usage 0 or 1 TLSA RRs. Given the lack of 1347 public CA PKI support in existing MTA deployments, avoiding 1348 certificate usages 0 and 1 simplifies implementation and deployment 1349 with no adverse security consequences. 1351 Implementations must strictly follow the portions of this 1352 specification that indicate when it is appropriate to initiate a non- 1353 authenticated connection or cleartext connection to a SMTP server. 1354 Specifically, in order to prevent downgrade attacks on this protocol, 1355 implementation must not initiate a connection when this specification 1356 indicates a particular SMTP server must be considered unreachable. 1358 8. IANA considerations 1360 This specification requires no support from IANA. 1362 9. Acknowledgements 1364 The authors would like to extend great thanks to Tony Finch, who 1365 started the original version of a DANE SMTP document. His work is 1366 greatly appreciated and has been incorporated into this document. 1367 The authors would like to additionally thank Phil Pennock for his 1368 comments and advice on this document. 1370 Acknowledgments from Viktor: Thanks to Paul Hoffman who motivated me 1371 to begin work on this memo and provided feedback on early drafts. 1372 Thanks to Patrick Koetter, Perry Metzger and Nico Williams for 1373 valuable review comments. Thanks also to Wietse Venema who created 1374 Postfix, and whose advice and feedback were essential to the 1375 development of the Postfix DANE implementation. 1377 10. References 1379 10.1. Normative References 1381 [I-D.ietf-dane-ops] 1382 Dukhovni, V. and W. Hardaker, "DANE TLSA implementation 1383 and operational guidance", draft-ietf-dane-ops-00 (work in 1384 progress), October 2013. 1386 [RFC1035] Mockapetris, P., "Domain names - implementation and 1387 specification", STD 13, RFC 1035, November 1987. 1389 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1390 Requirement Levels", BCP 14, RFC 2119, March 1997. 1392 [RFC3207] Hoffman, P., "SMTP Service Extension for Secure SMTP over 1393 Transport Layer Security", RFC 3207, February 2002. 1395 [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. 1396 Rose, "DNS Security Introduction and Requirements", RFC 1397 4033, March 2005. 1399 [RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S. 1400 Rose, "Resource Records for the DNS Security Extensions", 1401 RFC 4034, March 2005. 1403 [RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S. 1404 Rose, "Protocol Modifications for the DNS Security 1405 Extensions", RFC 4035, March 2005. 1407 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security 1408 (TLS) Protocol Version 1.2", RFC 5246, August 2008. 1410 [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., 1411 Housley, R., and W. Polk, "Internet X.509 Public Key 1412 Infrastructure Certificate and Certificate Revocation List 1413 (CRL) Profile", RFC 5280, May 2008. 1415 [RFC5321] Klensin, J., "Simple Mail Transfer Protocol", RFC 5321, 1416 October 2008. 1418 [RFC6066] Eastlake, D., "Transport Layer Security (TLS) Extensions: 1419 Extension Definitions", RFC 6066, January 2011. 1421 [RFC6125] Saint-Andre, P. and J. Hodges, "Representation and 1422 Verification of Domain-Based Application Service Identity 1423 within Internet Public Key Infrastructure Using X.509 1424 (PKIX) Certificates in the Context of Transport Layer 1425 Security (TLS)", RFC 6125, March 2011. 1427 [RFC6186] Daboo, C., "Use of SRV Records for Locating Email 1428 Submission/Access Services", RFC 6186, March 2011. 1430 [RFC6672] Rose, S. and W. Wijngaards, "DNAME Redirection in the 1431 DNS", RFC 6672, June 2012. 1433 [RFC6698] Hoffman, P. and J. Schlyter, "The DNS-Based Authentication 1434 of Named Entities (DANE) Transport Layer Security (TLS) 1435 Protocol: TLSA", RFC 6698, August 2012. 1437 10.2. Informative References 1439 [I-D.ietf-dane-registry-acronyms] 1440 Gudmundsson, O., "Adding acronyms to simplify DANE 1441 conversations", draft-ietf-dane-registry-acronyms-01 (work 1442 in progress), October 2013. 1444 [I-D.ietf-dane-srv] 1445 Finch, T., "Using DNS-Based Authentication of Named 1446 Entities (DANE) TLSA records with SRV and MX records.", 1447 draft-ietf-dane-srv-02 (work in progress), February 2013. 1449 [RFC5598] Crocker, D., "Internet Mail Architecture", RFC 5598, July 1450 2009. 1452 [RFC6409] Gellens, R. and J. Klensin, "Message Submission for Mail", 1453 STD 72, RFC 6409, November 2011. 1455 Authors' Addresses 1457 Viktor Dukhovni 1458 Two Sigma 1460 Email: ietf-dane@dukhovni.org 1462 Wes Hardaker 1463 Parsons 1464 P.O. Box 382 1465 Davis, CA 95617 1466 US 1468 Email: ietf@hardakers.net