[Bug 308181]

[Tdulcet]

For some hard data, I wrote a script to check all of the config files in
Mozilla's IPSDB, which includes over 900 domains. Of those 153 config
files, I was able to find a full configuration directly from the
provider for 41 of them. I of course first looked for an XML autoconfig
file, but then fell back to looking for DNS SRV records. Of the 41
configurations I was able to find, 9 were from DNS SRV records, so by
supporting RFC 6186, we could potentially remove at least 9 config files
from the ISPDB. See [this
comment](https://github.com/thunderbird/autoconfig/issues/135#issuecomment-2781472396)
on the ISPDB repository for more information the full results. If anyone
wants to reproduce these results or test other providers, the script is
[available
here](https://gist.github.com/tdulcet/aff722eaf42698233ea192b78077b4f9).

A couple of things to note: The current autoconfig standard that
Thunderbird follows already requires looking up the DNS MX record, which
without validating the DNSSEC is just as vulnerable as looking up DNS
SRV records. In addition, Thunderbird actually already uses DNS SRV
records without validating the DNSSEC when determining the CardDAV and
CalDAV configuration per [RFC
6764](https://datatracker.ietf.org/doc/html/rfc6764). Obviously, we will
need local DNSSEC validation in Thunderbird, as well as private DNS with
DoH.

-- 
You received this bug notification because you are a member of Mozilla
Bugs, which is subscribed to Mozilla.
https://bugs.launchpad.net/bugs/308181

Title:
  xmpp4moz doesn't read SRV DNS records

To manage notifications about this bug go to:
https://bugs.launchpad.net/sameplace/+bug/308181/+subscriptions