Having gone through all of this, it seems clear that it was “at least possible” to set up communications between Trump Organization, Alfa Bank, and/or Spectrum Health (whose Devos family had some sort of rewards or credit card deal with Alfa Bank via Amway), as follows. Because of the employment of so many “different” domain names, different IP addresses, different times, and different queries (thousands within a few months, so about less than 100 per day), some in “exclusive” channels (at least Spectrum Health), and where encryption was also employed, and given “back channels” were discussed and sought out, and given Trump and Russian representatives went back and forth, it would have been possible to create a “basic” communications system, for example, but not limited to, using different IP addresses as commands and responses, one IP for “go”, one IP for “stop”, one IP for “hold”, one IP for “yes”, one IP for “no”, and where domain names, and/or times sent could have been predetermined questions, missions, projects, orders, et cetera. Other similar configurations of the many different IP, domains, times, queries, could develop similar “basic” communications systems. Of course none of this proves anything, but it was “at least possible” that those going back and forth on behalf of Trump and Russia (for example but not limited to nor accusing Kislyak) could have set up a cryptic back channel communication in this or a similar manner by bringing the list of predetermined questions, topics, orders, projects, missions, plots, et cetera that would correspond to different times, dates, IPs, domains, et cetera, allowing Trump and Russia to communicate through DNS queries, but not limited to nor alleging the same. Just stating the same was “at least possible”, but then who really needs another Trump rabbit hole? ;0)

I’ve run some email and DNS servers before. I read the exhibits above because the DNS query log intrigued me after semi-following it here in the past.

My take overall: vanilla-style delivering mail to a recipient should result in an MX record lookup, and then maybe also lookups for mail-related TXT records for sender policy and so on, and then A/AAAA record lookup for the selected mail exchange, and then contacting that mail exchange and requesting to deliver mail to a recipient. The usual standard is that no authentication is needed for port 25 delivery, but the receiving exchange sometimes does things like a reverse lookup on the contacting address, matching it against an allow- or deny-list, or negotiating an encrypted connection and checking TLS certificates.

Let’s say I have a server in my domain already, however, and I want it to be able to send emails for notification purposes to an existing email infrastructure. Or maybe I have arranged some regular clandestine transfer of information between parties in different countries! In this case I might not bother setting it up the plain-vanilla way (“look it up in public records and relay accordingly”), because that is bringing the availability and correctness of DNS records into the equation when I already know where the mail will end up.

So I just hard-code the mailserver DNS A record name (mail1.example.com) into the script or configuration that’s sending it, and let it authenticate itself with a username and password or client TLS certificate or whatever (or a combination of these). In this case, no MX lookup to DNS is produced because we know the name to fetch an A record before we even got started (mail1.example.com). On the other side, mail1.example.com has been configured with its allow-list or other auth, knows the entity on the other end because it’s been prearranged, and accepts mail for delivery.

Hey-presto, a publicly accessible email server with a configuration that appears legitimate until you attempt to deliver mail without being in on the secret(s). TOR will attempt to obscure the origin of inbound delivery connections. Not super complicated in that it requires only the technical expertise of the channel-opening part and none required for sending/receiving/interpreting once that’s done; the user-facing part of it would be 100% familiar.

Does that track at all with the thinking about what was happening? Fully admit to not having read everything about it previously, there’s a lot.

Is there any chance this microscopic examination of the Alfa Bank logs and Trump server could yield conclusions that were once dismissed?