1220595 - ISPDB application: webhuset.no

Status: RESOLVED FIXED

(Webtools :: ISPDB Database Entries, defect)

Description

[Hogne Vevle]

Attachment: webhuset.no.xml

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.35 Safari/537.36

Steps to reproduce:

Request for ISPDB listing for webhuset.no. 

Attached: webhuset.no.xml

Comment 1

[Andrew Sutherland [:asuth] (he/him)]

You already seem to be hosting a valid autoconfig file at http://autoconfig.webhuset.no/mail/config-v1.1.xml so this doesn't really need to be hosted in the ISPDB unless there are vanity domains (ex: user-controlled-domain.blah) that have MX entries referencing mx.webhuset.no.

Can you clarify why you want this also hosted in the ISPDB?  Thanks!

Comment 2

[Hogne Vevle]

Thanks for your review, Andrew. That's correct, our autoconfig serves mail accounts under @webhuset.no just fine. However, our customers' domains don't benefit from this. However, as they all use mx.webhuset.no as their MX, they would benefit as well, if we were added to the ISPDB.

Excerpt from https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration:
"Mechanisms
[...]
- look up "MX example.com" in DNS, and for mx1.mail.hoster.com, look up "hoster.com" in the ISPDB"

It is my understanding that for whicheverdomain.no with MX at mx.webhuset.no, Thunderbird will then lookup webhuset.no in the ISPDB.

This is our main motivation for having webhuset.no added to the ISPDB. 

We could, of course, add autoconfig in DNS for all our customers' domains (~10k domains), but that would be quite time consuming and seems like a waste, as Thunderbird already offers a great way of doing lookups via the ISPDB.

Comment 3

[Andrew Sutherland [:asuth] (he/him)]

Yes, the DNS would be a hassle and it would be even worse when Thunderbird finally gets its act together and starts requiring https.  (And indeed, your understanding is correct.)

I've committed your entry to the ISPDB with the non-encrypted entries (socketType=plain) removed.  I'd recommend removing those entries from your self-hosted version as well, although obviously there's nothing to stop an attacker from just spoofing those[1].  It should go live in about 30 minutes.

Thank you very much for your efforts to improve the ISPDB and your Thunderbird (and other ISPDB-using clients) users' experience!

$ svn commit
Adding         webhuset.no
Transmitting file data .
Committed revision 148732.


1: The Firefox OS email client does require https for self-hosted autoconfig for this reason.  Although its threat profile is very different from Thunderbird's.