Re: false scoring for DNS_FROM_RFC_ABUSE

[Jamie L. Penman-Smithson]

On 25 May 2006, at 21:54, Magnus Holmgren wrote:

On Thursday 25 May 2006 21:31, Kai Schaetzl took the opportunity to write:

Jamie L. Penman-Smithson wrote on Thu, 25 May 2006 17:12:07 +0100:

.de does not have a working WHOIS server, that's fundamentally broken:

No, *your* whois client is outdated and broken.

<snip>

And this is not the only TLD they are wrong about. If you want to
follow-up, better to me directly, I think it's off-topic.

bogus.

You should have explained why they where wrong from the beginning. You're absolutely right. The RFC doesn't define any syntax. The evidence is totally

No, RFC 1932 defines the WHOIS protocol, including the syntax.



<ftp://ftp.isi.edu/in-notes/rfc3912.txt>

2.  Protocol Specification

   A WHOIS server listens on TCP port 43 for requests from WHOIS
   clients.  The WHOIS client makes a text request to the WHOIS server,
   then the WHOIS server replies with text content.  All requests are
   terminated with ASCII CR and then ASCII LF.  The response might
   contain more than one line of text, so the presence of ASCII CR or
   ASCII LF characters does not indicate the end of the response.  The

   The closed TCP connection is the indication to the client that the
   response has been received.

3.  Protocol Example

   If one places a request of the WHOIS server located at whois.nic.mil
   for information about "Smith", the packets on the wire will look
   like:

   client                           server at whois.nic.mil

   open TCP   ---- (SYN) ------------------------------>
              <---- (SYN+ACK) -------------------------
   send query ---- "Smith<CR><LF>" -------------------->
   get answer <---- "Info about Smith<CR><LF>" ---------
              <---- "More info about Smith<CR><LF>" ----
   close      <---- (FIN) ------------------------------
              ----- (FIN) ----------------------------->

Working WHOIS server:

$ telnet whois.iana.org 43
Trying 192.0.34.118...
Connected to whois.iana.org.
Escape character is '^]'.
example.net

IANA Whois Service
Domain: example.net
Name: IANA_RESERVED

Registrant:
    Name: Internet Assigned Numbers Authority (IANA)
    Organization: Internet Assigned Numbers Authority (IANA)
    Address1: 4676 Admiralty Way, Suite 330
[..]

Broken WHOIS server:

$ telnet whois.denic.de 43
Trying 81.91.162.8...
Connected to whois.denic.de.
Escape character is '^]'.
something.de
Domain:      something.de
Status:      connect

Connection closed by foreign host.



-j

After some research, I came to the conclusion that .de is, indeed, still broken: WHOIS server closes its connection as soon as the output is finished. The WHOIS server for .de is not RFC compliant, therefore it is and should be listed until it is RFC compliant. Whether some whois clients decide to cater to whatever broken syntax .de has decided to use is immaterial.

PGP.sig
Description: This is a digitally signed message part