Interesting People mailing list archives
more on FEMA mail server lacks MX record, bounced mail during emergency
From: David Farber <dave () farber net>
Date: Tue, 13 Sep 2005 14:11:51 -0400
Begin forwarded message: From: Craig Partridge <craig () aland bbn com> Date: September 13, 2005 1:00:28 PM EDT To: dave () farber net To: Steven Champeon <schampeo () hesketh com> To: doctorow () craphound comSubject: Re: [IP] FEMA mail server lacks MX record, bounced mail during emergency
Um, this article is a bit under cooked. Mail servers have been required since 1986 to look for MX records (this is not new) and have been required since 1986 to look for an A record if MX doesn't exist. The guy what wrote the spec back then. Craig
From: Steven Champeon <schampeo () hesketh com> Date: September 13, 2005 12:23:24 PM EDT To: dave () farber netSubject: FEMA mail server lacks MX record, bounced mail during emergencyDave - An article in the Wall Street Journal today said: "Attempts by officials at NIH to reach FEMA officials and send them briefing materials by email failed as the agency's server failed. "I noticed that every email to a FEMA person bounced back this week. They need a better internet provider during disasters!!" one frustrated Department of Health official wrote to colleagues last Thursday." http://online.wsj.com/article/0,,SB112658472240639074,00.html Frustrated, indeed. The fema.gov DNS zone doesn't define an MX record, which most modern mail servers use to determine where to send mail: shell:1005 $ dig mx fema.gov ; <<>> DiG 9.2.3 <<>> mx fema.gov ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59174 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;fema.gov. IN MX ;; AUTHORITY SECTION: fema.gov. 1800 IN SOA ns.fema.gov. root.ns2.fema.gov. 2005090901 10800 3600 604800 1800 ;; Query time: 39 msec ;; SERVER: 216.27.21.209#53(216.27.21.209) ;; WHEN: Tue Sep 13 12:09:12 2005 ;; MSG SIZE rcvd: 74 OK, then, most modern mail servers default to the A record when MX lookups fail. So, can we connect to the fema.gov host? ;; ANSWER SECTION: fema.gov. 1800 IN A 205.128.1.44 Nope: shell:1008 $ telnet fema.gov smtp Trying 205.128.1.44... ^C Well, then, where is the fema.gov mail server? Attempts to connect to ns2.fema.gov were successful, though we have no way of knowing whether that's just an unattended sendmail installation on what is arguably a name server first and foremost (and notably on a completely different net; it's hosted by Verizon) and the sendmail install is several years outof date (sendmail is up to 8.13 now and there are security flaws in alldistributions up to 8.12.10 or so): shell:1009 $ telnet ns2.fema.gov smtp Trying 162.83.67.144... Connected to ns2.fema.gov. Escape character is '^]'. 220 ns2.fema.gov ESMTP Sendmail 8.11.7p1+Sun/8.11.7; Tue, 13 Sep 2005 12:11:55 -0400 (EDT) ^] Attempts have been made to contact the SOA for the zone, root () ns2 fema gov, but unless someone is actively reading mail for that account it's unlikely that anyone at FEMA is minding the store.Wouldn't it be tragic if FEMA delayed or failed to respond to emergencysituations, or failed to properly coordinate with other agencies and NGOsbecause those agencies and organizations actually tried to contact FEMAusing the contact information on their Web site? http://www.fema.gov/feedback/ Sure, some of the addresses listed go to dhs.gov, but many go to fema.gov, which as we've seen isn't on the email network for all practical intents and purposes. Perhaps instead of sending Bibles to refugees, we should be sending aset of introductory O'Reilly systems administration and security books?Steve -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http:// hesketh.com antispam news, solutions for sendmail, exim, postfix: http:// enemieslist.com/ ------------------------------------- You are subscribed as craig () aland bbn com To manage your subscription, go to http://v2.listbox.com/member/?listname=ipArchives at: http://www.interesting-people.org/archives/interesting- people/
------------------------------------- You are subscribed as lists-ip () insecure org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/
Current thread:
- more on FEMA mail server lacks MX record, bounced mail during emergency David Farber (Sep 13)