The “<arf:EmailMessage>
that I see in http://bgp.potaroo.n=
et/ietf/all-ids/draft-vesely-mile-mail-abuse-00.txt looks like just an =
email message. I don’t see “=
feedback-type" or other ARF fields f=
or example that would make it a ARF.

draft-vesely-mile-mail-abuse-00.txt seems to define a header and then have the opti=
on for the actual message (EmailMessage). Am I reading it wrong?=

Panos

The =93<arf:EmailMess=
age>
that I see in ht=
tp://bgp.potaroo.net/ietf/all-ids/draft-vesely-mile-mail-abuse-00.txt l=
ooks like just an email message. I don=92t see =93feedba=
ck-type" or other ARF fields for exa=
mple that would make it a ARF.
=A0
draft-vesely-mile-mail-abuse-00.txt seems to define a header and then have the option for the actua=
l message (EmailMessage). Am I reading it wrong?
=A0
Panos
=A0
The “<arf:EmailMessage> =
  Received: from mailserver.example.net
    &nb=
sp;   (mailserver.example.net [192.0.2.1])
   &nb=
sp;    by e=
xample.com with ESMTP id M63d4137594e46;
<=
span style=3D'font-size:10.0pt;font-family:"Courier New"'>   =
;     Thu, 08 Mar 2005 14:00:00 -0400=
 =
;  From: &lt;somespammer@example.net&gt;
  =
 To: &lt;Undisclosed Recipients&gt;
<=
span style=3D'font-size:10.0pt;font-family:"Courier New"'>   Subj=
ect: Earn money
   MIME-Version: 1.0
&nbs=
p;  Content-type: text/plain
   Message-ID: 8=
787KJKJ3K4J3K4J3K4J3.mail@example.net
   Date: Th=
u, 02 Sep 2004 12:31:03 -0500

   S=
pam Spam Spam
   Spam Spam Spam=
 &nb=
sp; Spam Spam Spam
   Spam Spam Spam
&nbs=
p;        </arf:EmailMessage>”
that I see in http://bgp.potaroo.net/ietf/all-ids/draft-vesely-mile-mail-=
abuse-00.txt looks like just an email message. I don’t see “=
;feedback-type" or other ARF fields for example that wou=
ld make it a ARF.

draft-vesely-mile-mail-abuse-00.txt seems to define a h=
eader and then have the option for the actual message (EmailMessage). Am I =
reading it wrong?

Panos

From: Murray S. Kucherawy [mailto:superuser@gmail.com] 
Sent: S=
unday, March 03, 2013 4:10 AM
To: Panos Kampanakis (pkampana)
=
Cc: Moriarty, Kathleen; mile@ietf.org; marf@ietf.org
Subject: Re: [marf] Including Mail fields in =
IODEF

=
The issue with MARF inside IODEF is that the receiver needs to know t=
hat the payload being provided inside an EmailMessage element is itself an =
ARF report, and not the message that caused the report in the first place.&=
nbsp; You certainly could crack open the EmailMessage content and see if co=
nforms to the ARF specification to tell which kind of report you've gotten,=
 but that seems inelegant.
I suppose then another op=
tion is an extension element that indicates you've received an ARF payload =
rather than the actual offending message.

Also of note: An ARF can c=
ontain the offending message or only the offending message's header, and st=
ill be compliant.  If your application needs the whole message, you'll=
 have to add some additional stipulations someplace.
-MSK

On Fri=
, Mar 1, 2013 at 1:52 PM, Panos Kampanakis (pkampana) <pkampana@cisco.com> wrote:
I think MARF provides more functionality and should be l=
everage for emails in IODEF.
I also think we need to resurrect http://tools.ietf.org/html/draft-vesely-mile-mail-abuse-00 withi=
n MILE since MARF was concluded..
Panos

-----Original Message-----
From: =
mile-bounces@iet=
f.org [mailto:mile-bounces@ietf.org] On Behalf Of Moriarty, Kathleen=
Sent: Thursday, February 21, 2013 5:19 AM
To: mile@ietf.org; marf@ietf.org
Subject: [=
mile] Including Mail fields in IODEF

Hello,

Cross posting wit=
h MAIL and MARF -

In MILE related work, I have come across use cases=
 that would like to include DKIM and SPF information in addition to specifi=
c mail fields (like the ones Chris lists below).  We would like some h=
elp to figure out the best approach.  Should we embed ARF and MARF RFC=
 extensions to accommodate this need or should we look at updating RFC5901?=
  Both take the approach of including an email message as opposed to u=
sing XML to tag each field and allow for this in the data model (in my opin=
ion, that is fine and reduces bloat, but there may be other opinions).
<=
br>There was a draft published last year (link included below) that include=
s MARF in an IODE extension.

Thanks,
Kathleen
________________=
________________________
From: Harrington, Christopher
Sent: Wednesda=
y, February 20, 2013 2:57 PM
To: Moriarty, Kathleen; mile@ietf.org
Subject: RE: Mail fiel=
ds

I'm for the simplest solution as always. These are the indicator =
types that we routinely share. I would use these as a base:

Email ad=
dress (denoting if it is to or from) Email Subject Email attachment name Em=
ail attachment hash X-Mailer (from header) Hyperlink in email

It's a=
lso very common to share the whole header. Bad guys routinely forge them an=
d put extra header items that can be used as indicators.  Although not=
 an indicator sharing the entire email as an .eml or .msg file is also pret=
ty common.

Thanks,

--Chris

-----Original Message--=
---
From: mil=
e-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of Moriarty, KathleenSent: Wednesday, February 20, 2013 2:58 AM
To: mile@ietf.org
Subject: [mile] Mail field=
s

Hi,

In looking at the updated rfc5070bis and coming across =
some requests for handling certain types of exchanges, I am curious to hear=
 how others think we should handle mail related indicators and incidents. &=
nbsp;A couple of commonly exchanged fields were added into the Record class=
.  You can still extend out using RFC5901 and include a full mail mess=
age, but if you wanted to include DKIM or Sender Policy Framework, you need=
 something else.  The IETF group MARF already solved these issues.
=

MARF uses the email tags rather than XML and there was a draft that emb=
edded MARF content into IODEF (contains an example), can be found here:
=
http://tools.ietf.org/html/draft-vesely-mile-mail-abuse-00

Since mail is already marked and can be parsed, would this be a be=
tter option to use what MARF has already done to solve the question on how =
to exchange this data?  Other options would be to update RFC5901 or to=
 extend IODEF further.  I prefer the use of MARF.  It is already =
in use by mail operators, so there is adoption.

Thanks,
Kathleen<=
br>_______________________________________________
mile mailing list
=
mile@ietf.org
https=
://www.ietf.org/mailman/listinfo/mile
______________________________=
_________________
mile mailing list
mile@ietf.org
https://www.ietf.org/mailman/listinfo/=
mile
_______________________________________________
marf mailing=
 list
marf@ietf.org
https://www.ietf.org/mailman/listinfo/marf