Subject: [marf] draft-ietf-marf-spf-reporting review comments

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 15 Feb 2012 20:57:38 -0800

Just took a pass through the document and found the following things:

-          I think because it creates a registry that SPF implementations should know about, that this one should advertise that it updates RFC4408.  (Barry, please check my math on this one.)  I think that means we need a second paragraph in the Abstract saying "This memo updates RFC4408", and also add updates="4408" in the <rfc> tag.

-          The "ra=" definition talks about "r=", which should probably also be "ra=" now.

-          The "rp=" definition talks about signature authentication failures.  Should be path authorization failures.

-          The DKIM reporting draft includes "rs=" to ask rejecting sites to use a particular string in the SMTP reply.  Is that omitted here for a reason?  (I have some vague recollection that SPF itself can do this, so maybe that's why.)

-          The ABNF for "spf-rr-tag" includes a reference to "spf-ro-tag" which is undefined.

-          Section 4 also refers to the "ro" token, which should probably also become "rr".

-          Section 4 also refers to "these lists", but there's only one.

-          A note for later: If the SPFbis effort renames the result codes to all lowercase, it'll have to "Updates" this one.

That's it.

-MSK

---

From: Scott Kitterman <[email-masked]>
Date: Thu, 16 Feb 2012 13:57:40 -0500

> Just took a pass through the document and found the following things:

Thanks for the review.
> 
> -          I think because it creates a registry that SPF implementations
> should know about, that this one should advertise that it updates RFC4408. 
> (Barry, please check my math on this one.)  I think that means we need a
> second paragraph in the Abstract saying "This memo updates RFC4408", and
> also add updates="4408" in the <rfc> tag.

Agreed.  Done.

> -          The "ra=" definition talks about "r=", which should probably also

Fixed

> -          The "rp=" definition talks about signature authentication
> failures.  Should be path authorization failures.

I made it SPF failures since that's what we're talking about.

> -          The DKIM reporting draft includes "rs=" to ask rejecting sites to
> use a particular string in the SMTP reply.  Is that omitted here for a
> reason?  (I have some vague recollection that SPF itself can do this, so
> maybe that's why.)

Yes.  This is done with the exp= modifier.

> -          The ABNF for "spf-rr-tag" includes a reference to "spf-ro-tag"

Changed to 'spf-rr-type'.

> -          Section 4 also refers to the "ro" token, which should probably

Fixed.

> -          Section 4 also refers to "these lists", but there's only one.

Fixed

> -          A note for later: If the SPFbis effort renames the result codes
> to all lowercase, it'll have to "Updates" this one.

Or not since they're technically case insensitive, either way we can address 
it later.  I think it's an editorial preference, not a technical 
characteristic.

> That's it.

Great.

Scott K