Subject: [marf] Working Group Last Call: draft-ietf-marf-spf-reporting and draft-ietf-marf-dkim-reporting

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 8 Feb 2012 21:52:36 -0800

This message begins a Working Group Last Call on the above drafts, ending February 24th.  Everyone please review these drafts (probably alongside the AS, which is also in WGLC already) and provide your comments by then.

Thanks,
-MSK, as co-chair

---

From: Scott Kitterman <[email-masked]>
Date: Thu, 09 Feb 2012 01:49:12 -0500

On Wednesday, February 08, 2012 09:52:36 PM Murray S. Kucherawy wrote:
> This message begins a Working Group Last Call on the above drafts, ending
> February 24th.  Everyone please review these drafts (probably alongside the
> AS, which is also in WGLC already) and provide your comments by then.

Comments on the dkim-reporting draft (for the record, I'm happy with the spf-
reporting draft):

paragraph 3.3, items 3/5: It seems to me to be overkill to specify anything 
about what should be logged locally.  It's not relevant to interoperability 
and is really an implementation detail.

paragraph 3.3, item 8: Since ra= for dkim is required, then it seems to me if 
ra= is missing, the record has already failed step 5, so step is is redundant.  
Recommend removing step 8 and rewording step 5 (taking the liberty of 
resolving my previous comment for this item as well):

   5.   If the TXT content is syntactically invalid (including missing
         required tags like ra=), terminate.

In the last hunk of paragraph 3, there is the phrase:

"It might be useful to some Signers to receive such reports.  To enable this, 
a Verifier could violate the first step above and continue even in the absence 
of an "r=" tag."

I know that the rest of the paragraph gets to "Don't do this", but I'm afraid 
the current wording is an invitation to mischief.  Perhaps something like:

"It might be useful to some Signers to receive such reports, but this use case 
is not supported.  To support this, a Verifier would have to violate the first 
step above and continue even in the absence of an "r=" tag."

Looks pretty good.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 9 Feb 2012 10:23:08 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Scott Kitterman
> Sent: Wednesday, February 08, 2012 10:49 PM
> To: [email-masked]
> Subject: Re: [marf] Working Group Last Call: draft-ietf-marf-spf-reporting and draft-ietf-marf-dkim-reporting
> 
> Comments on the dkim-reporting draft (for the record, I'm happy with
> the spf- reporting draft):

I think we assume that about authors... :-)

> paragraph 3.3, items 3/5: It seems to me to be overkill to specify
> anything about what should be logged locally.  It's not relevant to
> interoperability and is really an implementation detail.

Fixed.

> paragraph 3.3, item 8: Since ra= for dkim is required, then it seems to
> me if ra= is missing, the record has already failed step 5, so step is
> is redundant.

Oversight; "ra=" is no longer required.  Changed it to OPTIONAL.  This was done a couple of versions ago to allow for the case where someone wants failures to be reported via SMTP errors only and not ARF reports.

> "It might be useful to some Signers to receive such reports.  To enable
> this, a Verifier could violate the first step above and continue even
> in the absence of an "r=" tag."
> 
> I know that the rest of the paragraph gets to "Don't do this", but I'm
> afraid the current wording is an invitation to mischief.  Perhaps
> something like:
> 
> "It might be useful to some Signers to receive such reports, but this
> use case is not supported.  To support this, a Verifier would have to
> violate the first step above and continue even in the absence of an
> "r=" tag."

Applied.  Thanks for the review!

-MSK